26 replies to this topic

[55shazzie55]

Hi, I have rebooted twice and it gets to "Listing partitions, please wait" and just sits there. How long should I let it go for for before I reboot again? Cheers Sharon update: @ 11.15pm - still hsn't moved almost two hours later....

Edited by 55shazzie55, 24 September 2012 - 07:16 AM.

[jeffce]

Hi, Ok... I am speaking with a colleague about your system. I will return as quickly as I can.

[jeffce]

Hi,

Please delete your copy of FRST and then download a fresh copy from here. Once downloaded, run FRST again with the instructions that I provided before but this time make sure that List Partitions is unchecked. When the log is created be sure to post that to your next reply.
----------

Please download Listparts64
Run the tool, click Scan and post the log (Result.txt) it makes.
------------

[55shazzie55]

Hi there, Yeah!!! I was finally able to get both scans done, so here you go: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-09-2012 Ran by SYSTEM at 25-09-2012 20:43:27 Running from H:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11613288 2010-11-16] (Realtek Semiconductor) HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2817872 2012-04-24] (ELAN Microelectronics Corp.) HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [38872 2012-07-31] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-11] (Adobe Systems Incorporated) Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 AppInit_DLLs: C:\windows\system32\nvinitx.dll ==================== Services (Whitelisted) =================== 2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [86224 2012-05-08] (Avira Operations GmbH & Co. KG) 2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [110032 2012-05-08] (Avira Operations GmbH & Co. KG) 2 CLKMSVC10_38F51D56; "C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe" /svc [246256 2010-08-24] (CyberLink) 2 RichVideo; "C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe" [244904 2009-11-30] () ==================== Drivers (Whitelisted) ===================== 2 avgntflt; C:\Windows\System32\Drivers\avgntflt.sys [98848 2012-05-08] (Avira GmbH) 1 avipbb; C:\Windows\System32\Drivers\avipbb.sys [132832 2012-05-08] (Avira GmbH) 1 avkmgr; C:\Windows\System32\Drivers\avkmgr.sys [27760 2011-09-15] (Avira GmbH) 3 rtport; C:\Windows\SysWow64\Drivers\rtport.sys [15144 2011-05-08] (Windows ® 2003 DDK 3790 provider) ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2012-09-22 16:18 - 2012-08-24 03:15 - 17810944 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-09-22 16:18 - 2012-08-24 02:39 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-09-22 16:18 - 2012-08-24 02:31 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-09-22 16:18 - 2012-08-24 02:22 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-09-22 16:18 - 2012-08-24 02:21 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-09-22 16:18 - 2012-08-24 02:20 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-09-22 16:18 - 2012-08-24 02:18 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-09-22 16:18 - 2012-08-24 02:17 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-09-22 16:18 - 2012-08-24 02:14 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-09-22 16:18 - 2012-08-24 02:14 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-09-22 16:18 - 2012-08-24 02:13 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2012-09-22 16:18 - 2012-08-24 02:12 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-09-22 16:18 - 2012-08-24 02:11 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-09-22 16:18 - 2012-08-24 02:10 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-09-22 16:18 - 2012-08-24 02:09 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-09-22 16:18 - 2012-08-24 02:04 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-09-22 16:18 - 2012-08-23 23:27 - 12319744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-09-22 16:18 - 2012-08-23 23:03 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-09-22 16:18 - 2012-08-23 22:59 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-09-22 16:18 - 2012-08-23 22:51 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-09-22 16:18 - 2012-08-23 22:51 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-09-22 16:18 - 2012-08-23 22:51 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-09-22 16:18 - 2012-08-23 22:49 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-09-22 16:18 - 2012-08-23 22:48 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-09-22 16:18 - 2012-08-23 22:47 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-09-22 16:18 - 2012-08-23 22:47 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2012-09-22 16:18 - 2012-08-23 22:47 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-09-22 16:18 - 2012-08-23 22:45 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2012-09-22 16:18 - 2012-08-23 22:44 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-09-22 16:18 - 2012-08-23 22:44 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-09-22 16:18 - 2012-08-23 22:43 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-09-22 16:18 - 2012-08-23 22:40 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-09-22 06:03 - 2012-09-22 06:03 - 00006304 ____A C:\Users\Sharon\Desktop\09222012_234429.log 2012-09-22 05:38 - 2012-09-22 05:38 - 00006774 ____A C:\Users\Sharon\Desktop\09222012_232011.log 2012-09-22 05:20 - 2012-09-22 05:20 - 00000000 ____D C:\_OTL 2012-09-21 04:56 - 2012-09-22 06:23 - 00064770 ____A C:\Users\Sharon\Desktop\OTL.Txt 2012-09-21 04:56 - 2012-09-21 04:56 - 00109114 ____A C:\Users\Sharon\Desktop\Extras.Txt 2012-09-21 04:08 - 2012-09-21 04:08 - 00600576 ____A (OldTimer Tools) C:\Users\Sharon\Desktop\OTL.exe 2012-09-20 20:51 - 2012-09-20 20:51 - 00000000 ___SD C:\ComboFix 2012-09-20 04:08 - 2012-09-20 04:08 - 00000000 ____D C:\Windows\erdnt 2012-09-20 04:08 - 2012-09-20 04:08 - 00000000 ____D C:\Qoobox 2012-09-20 04:08 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe 2012-09-20 04:08 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe 2012-09-20 04:08 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2012-09-20 04:08 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2012-09-20 04:08 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2012-09-20 04:08 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe 2012-09-20 04:08 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe 2012-09-20 04:08 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe 2012-09-20 04:05 - 2012-09-20 04:06 - 04753679 ____R (Swearware) C:\Users\Sharon\Desktop\ComboFix.exe 2012-09-19 18:59 - 2012-09-19 19:25 - 00004196 ____A C:\Users\Sharon\Desktop\aswMBR.txt 2012-09-19 18:59 - 2012-09-19 19:25 - 00000512 ____A C:\Users\Sharon\Desktop\MBR.dat 2012-09-19 18:33 - 2012-09-19 18:34 - 04731392 ____A (AVAST Software) C:\Users\Sharon\Desktop\aswMBR.exe 2012-09-19 18:32 - 2012-09-19 18:32 - 00015366 ____A C:\Users\Sharon\Desktop\Attach.txt 2012-09-19 18:31 - 2012-09-19 18:31 - 00018612 ____A C:\Users\Sharon\Desktop\DDS.txt 2012-09-19 18:14 - 2012-09-19 18:14 - 00607260 ____R (Swearware) C:\Users\Sharon\Desktop\dds.com 2012-09-19 00:34 - 2012-09-19 00:34 - 00000000 ____D C:\Program Files (x86)\FLV_Runner 2012-09-18 19:21 - 2012-09-18 19:21 - 00001790 ____A C:\Users\UpdatusUser\Desktop\HijackThis.lnk 2012-09-18 19:21 - 2012-09-18 19:21 - 00001790 ____A C:\Users\Sharon\Desktop\HijackThis.lnk 2012-09-18 19:18 - 2012-09-18 19:18 - 00812344 ____A (Trend Micro Inc.) C:\Users\Sharon\Downloads\HJTInstall.exe 2012-09-18 18:55 - 2012-09-18 18:55 - 00204496 ____A (Malwarebytes) C:\Users\Sharon\Downloads\startuplite-setup-1.07.exe 2012-09-18 17:40 - 2012-09-18 17:40 - 00000995 ____A C:\Users\Sharon\Desktop\WinDirStat.lnk 2012-09-18 17:40 - 2012-09-18 17:40 - 00000000 ____D C:\Program Files (x86)\WinDirStat 2012-09-16 04:16 - 2012-09-16 04:16 - 00000000 ____D C:\fb72a9157f3a9b14a5228aea 2012-09-16 03:03 - 2012-08-22 10:12 - 01913200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-09-16 03:03 - 2012-08-22 10:12 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys 2012-09-16 03:03 - 2012-08-22 10:12 - 00376688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys 2012-09-16 03:03 - 2012-08-22 10:12 - 00288624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS 2012-09-16 03:03 - 2012-08-02 09:58 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll 2012-09-16 03:03 - 2012-08-02 08:57 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll 2012-09-16 03:03 - 2012-07-04 12:26 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys 2012-09-15 21:17 - 2012-09-15 21:17 - 00062648 ____A C:\Users\Sharon\AppData\Local\GDIPFONTCACHEV1.DAT 2012-09-15 21:05 - 2012-09-15 21:07 - 00276096 ____A C:\Windows\System32\FNTCACHE.DAT 2012-09-15 07:00 - 2012-09-24 23:40 - 00001288 ____A C:\Windows\setupact.log 2012-09-15 07:00 - 2012-09-15 07:00 - 00000000 ____A C:\Windows\setuperr.log 2012-09-15 02:23 - 2012-09-22 23:29 - 00002292 ____A C:\Users\Sharon\Desktop\Rkill.txt2012-09-11 20:54 - 2012-09-11 20:57 - 74031672 ____A (Microsoft Corporation) C:\Users\Sharon\Downloads\msert.exe 2012-09-09 05:07 - 2012-09-09 05:07 - 00000000 ____D C:\Users\Sharon\Desktop\rkill 2012-09-09 05:06 - 2012-09-09 05:07 - 01629088 ____A (Bleeping Computer, LLC) C:\Users\Sharon\Downloads\rkill.com 2012-09-09 04:36 - 2012-09-09 04:36 - 00000000 ____D C:\Program Files (x86)\ESET 2012-09-01 00:57 - 2012-09-01 00:57 - 00263186 ____A C:\Users\Sharon\Desktop\Minecraft.exe 2012-09-01 00:56 - 2012-09-16 23:35 - 00000000 ____D C:\Users\Sharon\AppData\Roaming\.minecraft 2012-08-31 01:04 - 2012-09-24 02:14 - 00725084 ____A C:\Windows\WindowsUpdate.log 2012-08-27 01:13 - 2012-08-27 01:13 - 00000000 ____D C:\Users\Sharon\AppData\Roaming\AustarAnywhereDesktopApplication.7C28940E702BD503DC2BDA2FC8B8270C7F1C0180.1 ==================== 3 Months Modified Files ================== 2012-09-25 01:50 - 2012-05-14 05:28 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-09-24 23:40 - 2012-09-15 07:00 - 00001288 ____A C:\Windows\setupact.log 2012-09-24 17:45 - 2009-07-13 20:45 - 00021200 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-09-24 17:45 - 2009-07-13 20:45 - 00021200 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-09-24 17:34 - 2009-07-13 21:13 - 00727310 ____A C:\Windows\System32\PerfStringBackup.INI 2012-09-24 17:22 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-09-24 02:14 - 2012-08-31 01:04 - 00725084 ____A C:\Windows\WindowsUpdate.log 2012-09-22 23:29 - 2012-09-15 02:23 - 00002292 ____A C:\Users\Sharon\Desktop\Rkill.txt 2012-09-22 06:23 - 2012-09-21 04:56 - 00064770 ____A C:\Users\Sharon\Desktop\OTL.Txt 2012-09-22 06:03 - 2012-09-22 06:03 - 00006304 ____A C:\Users\Sharon\Desktop\09222012_234429.log 2012-09-22 05:38 - 2012-09-22 05:38 - 00006774 ____A C:\Users\Sharon\Desktop\09222012_232011.log 2012-09-21 04:56 - 2012-09-21 04:56 - 00109114 ____A C:\Users\Sharon\Desktop\Extras.Txt 2012-09-21 04:08 - 2012-09-21 04:08 - 00600576 ____A (OldTimer Tools) C:\Users\Sharon\Desktop\OTL.exe 2012-09-20 20:00 - 2009-07-13 21:08 - 00032624 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-09-20 04:06 - 2012-09-20 04:05 - 04753679 ____R (Swearware) C:\Users\Sharon\Desktop\ComboFix.exe 2012-09-19 19:25 - 2012-09-19 18:59 - 00004196 ____A C:\Users\Sharon\Desktop\aswMBR.txt 2012-09-19 19:25 - 2012-09-19 18:59 - 00000512 ____A C:\Users\Sharon\Desktop\MBR.dat 2012-09-19 18:34 - 2012-09-19 18:33 - 04731392 ____A (AVAST Software) C:\Users\Sharon\Desktop\aswMBR.exe 2012-09-19 18:32 - 2012-09-19 18:32 - 00015366 ____A C:\Users\Sharon\Desktop\Attach.txt 2012-09-19 18:31 - 2012-09-19 18:31 - 00018612 ____A C:\Users\Sharon\Desktop\DDS.txt 2012-09-19 18:14 - 2012-09-19 18:14 - 00607260 ____R (Swearware) C:\Users\Sharon\Desktop\dds.com 2012-09-18 19:21 - 2012-09-18 19:21 - 00001790 ____A C:\Users\UpdatusUser\Desktop\HijackThis.lnk 2012-09-18 19:21 - 2012-09-18 19:21 - 00001790 ____A C:\Users\Sharon\Desktop\HijackThis.lnk 2012-09-18 19:18 - 2012-09-18 19:18 - 00812344 ____A (Trend Micro Inc.) C:\Users\Sharon\Downloads\HJTInstall.exe 2012-09-18 18:55 - 2012-09-18 18:55 - 00204496 ____A (Malwarebytes) C:\Users\Sharon\Downloads\startuplite-setup-1.07.exe 2012-09-18 17:40 - 2012-09-18 17:40 - 00000995 ____A C:\Users\Sharon\Desktop\WinDirStat.lnk 2012-09-18 17:40 - 2012-07-27 03:01 - 00000995 ____A C:\Users\UpdatusUser\Desktop\WinDirStat.lnk 2012-09-18 16:20 - 2012-04-03 20:44 - 00002118 ___AH C:\Users\Sharon\Documents\Default.rdp 2012-09-16 04:16 - 2011-07-15 00:48 - 64462936 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-09-15 21:17 - 2012-09-15 21:17 - 00062648 ____A C:\Users\Sharon\AppData\Local\GDIPFONTCACHEV1.DAT 2012-09-15 21:07 - 2012-09-15 21:05 - 00276096 ____A C:\Windows\System32\FNTCACHE.DAT 2012-09-15 07:00 - 2012-09-15 07:00 - 00000000 ____A C:\Windows\setuperr.log 2012-09-13 03:02 - 2012-01-02 05:58 - 00001073 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-09-13 01:57 - 2012-05-14 05:28 - 00696520 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-09-13 01:57 - 2011-08-05 06:47 - 00073416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2012-09-11 20:57 - 2012-09-11 20:54 - 74031672 ____A (Microsoft Corporation) C:\Users\Sharon\Downloads\msert.exe 2012-09-09 05:07 - 2012-09-09 05:06 - 01629088 ____A (Bleeping Computer, LLC) C:\Users\Sharon\Downloads\rkill.com 2012-09-06 23:04 - 2011-08-04 05:04 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-09-01 00:57 - 2012-09-01 00:57 - 00263186 ____A C:\Users\Sharon\Desktop\Minecraft.exe 2012-08-24 03:15 - 2012-09-22 16:18 - 17810944 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-08-24 02:39 - 2012-09-22 16:18 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-08-24 02:31 - 2012-09-22 16:18 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-08-24 02:22 - 2012-09-22 16:18 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-08-24 02:21 - 2012-09-22 16:18 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-08-24 02:20 - 2012-09-22 16:18 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-08-24 02:18 - 2012-09-22 16:18 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-08-24 02:17 - 2012-09-22 16:18 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-08-24 02:14 - 2012-09-22 16:18 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-08-24 02:14 - 2012-09-22 16:18 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-08-24 02:13 - 2012-09-22 16:18 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2012-08-24 02:12 - 2012-09-22 16:18 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-08-24 02:11 - 2012-09-22 16:18 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-08-24 02:10 - 2012-09-22 16:18 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-08-24 02:09 - 2012-09-22 16:18 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-08-24 02:04 - 2012-09-22 16:18 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-08-23 23:27 - 2012-09-22 16:18 - 12319744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-08-23 23:03 - 2012-09-22 16:18 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-08-23 22:59 - 2012-09-22 16:18 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-08-23 22:51 - 2012-09-22 16:18 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-08-23 22:51 - 2012-09-22 16:18 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-08-23 22:51 - 2012-09-22 16:18 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-08-23 22:49 - 2012-09-22 16:18 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-08-23 22:48 - 2012-09-22 16:18 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-08-23 22:47 - 2012-09-22 16:18 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-08-23 22:47 - 2012-09-22 16:18 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2012-08-23 22:47 - 2012-09-22 16:18 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-08-23 22:45 - 2012-09-22 16:18 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2012-08-23 22:44 - 2012-09-22 16:18 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-08-23 22:44 - 2012-09-22 16:18 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-08-23 22:43 - 2012-09-22 16:18 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-08-23 22:40 - 2012-09-22 16:18 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-08-22 10:12 - 2012-09-16 03:03 - 01913200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-08-22 10:12 - 2012-09-16 03:03 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys 2012-08-22 10:12 - 2012-09-16 03:03 - 00376688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys 2012-08-22 10:12 - 2012-09-16 03:03 - 00288624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS 2012-08-22 02:07 - 2011-04-08 06:06 - 00407040 ____A (Samsung Electronics) C:\Windows\HotfixChecker.exe 2012-08-22 02:07 - 2011-04-08 05:57 - 00001474 ____A C:\Windows\HotFixList.ini 2012-08-22 02:05 - 2011-04-08 06:06 - 00345600 ____A (Samsung Electronics Co., Ltd.) C:\Windows\SetLCDStretchMode.exe 2012-08-22 02:04 - 2012-08-22 02:04 - 04633992 ____A (ELAN Microelectronics Corp.) C:\Windows\System32\ETDUI.cpl 2012-08-21 00:39 - 2012-02-02 14:30 - 00249736 ____A (ELAN Microelectronics Corp.) C:\Windows\ETDUninst.dll 2012-08-20 01:33 - 2012-01-19 06:21 - 00001974 ____A C:\Users\Public\Desktop\Adobe Reader 9.lnk 2012-08-02 09:58 - 2012-09-16 03:03 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll 2012-08-02 08:57 - 2012-09-16 03:03 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll 2012-08-01 01:55 - 2012-08-01 01:55 - 00001885 ____A C:\Users\Sharon\Desktop\e-tax 2012.lnk 2012-07-27 03:01 - 2012-07-27 03:00 - 00645729 ____A (WDS Team) C:\Users\Sharon\Downloads\windirstat1_1_2_setup.exe 2012-07-24 01:17 - 2012-07-24 01:17 - 09369600 ____A C:\Users\Sharon\Downloads\etax2012_1.msi 2012-07-18 23:01 - 2012-07-18 23:01 - 00033792 ____A C:\Users\Sharon\Downloads\2012 Get on a Husky Rebates paid 140612 - 280612 Factory.xls 2012-07-18 10:15 - 2012-08-15 06:37 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-07-06 12:07 - 2012-08-16 00:10 - 00552960 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bthport.sys 2012-07-04 14:16 - 2012-08-15 06:37 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll 2012-07-04 14:13 - 2012-08-15 06:37 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll 2012-07-04 14:13 - 2012-08-15 06:37 - 00059392 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll 2012-07-04 13:16 - 2012-08-15 06:37 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll 2012-07-04 13:14 - 2012-08-15 06:37 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll 2012-07-04 12:26 - 2012-09-16 03:03 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys 2012-06-29 19:46 - 2012-06-29 19:46 - 00001743 ____A C:\Users\Public\Desktop\iTunes.lnk 2012-06-29 19:15 - 2012-06-29 19:15 - 03889704 ____A (Piriform Ltd) C:\Users\Sharon\Downloads\ccsetup320.exe 2012-06-29 19:15 - 2011-11-23 04:37 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk 2012-06-28 20:03 - 2011-04-08 06:09 - 00018370 ____A C:\Windows\System32\results.xml ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Last Boot: 2012-09-15 07:34 ==================== End Of Log ============================= 2nd Scan: ListParts by Farbar Version: 25-09-2012 Ran by SYSTEM (administrator) on 25-09-2012 at 20:47:23 Windows 7 (X64) Running From: H:\ Language: 0409 ************************************************************ ========================= Memory info ====================== Percentage of memory in use: 8% Total physical RAM: 8103.12 MB Available physical RAM: 7397.47 MB Total Pagefile: 8101.32 MB Available Pagefile: 7400.85 MB Total Virtual: 8192 MB Available Virtual: 8191.91 MB ======================= Partitions ========================= 1 Drive c: () (Fixed) (Total:272 GB) (Free:226.39 GB) NTFS 3 Drive f: (SAMSUNG_REC) (Fixed) (Total:20.01 GB) (Free:1.02 GB) NTFS ==>[System with boot components (obtained from reading drive)] 5 Drive h: () (Removable) (Total:1.97 GB) (Free:1.97 GB) FAT 6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 7 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 698 GB 1024 KB Disk 1 Online 2018 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 100 MB 1024 KB Partition 2 Primary 272 GB 101 MB Partition 0 Extended 406 GB 272 GB Partition 4 Logical 406 GB 272 GB Partition 3 Recovery 20 GB 678 GB ================================================================================ ====================== Disk: 0 Partition 1 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 Y SYSTEM NTFS Partition 100 MB Healthy ================================================================================ ====================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 C NTFS Partition 272 GB Healthy ================================================================================ ====================== Disk: 0 Partition 4 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 D RAW Partition 406 GB Healthy ================================================================================ ====================== Disk: 0 Partition 3 Type : 27 Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 4 F SAMSUNG_REC NTFS Partition 20 GB Healthy Hidden ================================================================================ ====================== Partitions of Disk 1: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 2017 MB 16 KB ================================================================================ ====================== Disk: 1 Partition 1 Type : 06 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 5 H FAT Removable 2017 MB Healthy ================================================================================ ====================== ****** End Of Log ****** Thanks sharon

[jeffce]

Hi,

Looks pretty good.

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 9.5.2 first. Be sure to move any PDF documents to another folder first though.
----------


Java

Please go to Start > Control Panel > Programs and Features > uninstall all the Java Programs you see, now download the latest Java from the following link and install it:

http://java.com/en/download/index.jsp
----------

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

• Under Temporary Internet Files, click the Delete Files button.
• There are three options in the window to clear the cache - Leave ALL 3 Checked
  • Downloaded Applets
    Downloaded Applications
    Other Files
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Java Control Panel.

----------

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
----------

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

• Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
• Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
• Close the ESET online scan, and let me know how things are now.

----------

[55shazzie55]

Hi, I have completed everything you have advised. There were no threats via ESET and the MBAM log is as follows. Just to let you know though, the system has not quickened up at all despite eveything we have done. It took more than 20 minutes to have the laptop in a workable state (from reboot to everything loaded) before I could even begin to do the things you asked for! It works quickly while browsing the internet, working within a program, even downloading but trying to open a program, unistall, or boot up is what takes forever????? I am wondering if its best or even worthwhile to backup my docs and reset the computer back to factory settings. I don't know if this even works? What do you think? Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Database version: v2012.09.26.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Sharon :: SHARON-PC [administrator] 27/09/2012 12:06:51 AM mbam-log-2012-09-27 (00-06-51).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 216488 Time elapsed: 3 minute(s), 35 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

[jeffce]

Well a format and reinstall is certainly an option if you want to go that route. I am not seeing anything that is malware related in the logs. Let's give the following a go and see what we can find.

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

----------

[55shazzie55]

Hi, Here you go: Farbar Service Scanner Version: 19-09-2012 Ran by Sharon (administrator) on 27-09-2012 at 23:53:35 Running from "C:\Users\Sharon\Desktop" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys => MD5 is legit C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\mpssvc.dll => MD5 is legit C:\Windows\System32\bfe.dll => MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe => MD5 is legit C:\Windows\System32\wscsvc.dll => MD5 is legit C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll => MD5 is legit C:\Windows\System32\es.dll => MD5 is legit C:\Windows\System32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log ****

[jeffce]

Hi, That looks good as well. I think you might want to go ahead and post a new topic in the Windows forum here at What the Tech. The techs there are fantastic and may be better able to help you with this problem now than I. I am not seeing anything that is malware related just so you know. When you post the new topic, please be sure to post the link to this topic so that they are able to see what we have done. When they have completed be sure to come back and we can remove the tools that we have used.

[55shazzie55]

Hi, I actually did post this topic in the windows section first! When I logged back in to see if there had been any replies, I found that the topic had moved to here! Thankyou so much for all your help and patience over the last week, and I'm happy to know that it's not an infection at least! Cheers Sharon

[jeffce]

Providing there are no other malware related problems...

SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
-------

The following will implement some cleanup procedures as well as reset System Restore points:

Press the Windows key + R and this will open the Run box. Copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the ..X and the /U that needs to be there.)


----------

Clean up with OTL:

• Right-click and Run as Administrator OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

----------

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.
If you didn't already have it I would keep Malwarebytes AntiMalware though.

Here are some tips to reduce the potential for spyware infection in the future:

1. Internet Explorer. Even if you don't use it as your main browser it should be kept up-to-date because that is the browser Windows uses for updates.
Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. FireFox. If you use Firefox, I recommend installing the following add-ons to help make your Firefox browser more secure:
NoScript
AdBlock Plus

3. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

• Open Internet Explorer
• Click on Tools > Internet Options
• Press Security tab
• Select Internet zone then place check next to Enable Protected Mode if not already done
• Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
• Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

4. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

5. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

6. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read How to Prevent Malware found here and also PC Safety and Security - What Do I Need?.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

[jeffce]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatth...ed_t106388.html
and start a New Topic.