What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] "PassCapture" has my computer feeling blue

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Progress continues. Let me know how you system is running on completion of this

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

Driver::
ati6ahxx
ati6wgxx
ati1krxx
ati3nuxx
ati0iqxx
ati4nuxx
ati5qxxx
ati5raxx
ati6emxx
ati8ryxx
ati7raxx

File::
C:\iivopso.exe
C:\lwvjuv.exe
c:\windows\axehejoz.dll
c:\windows\system32\1025o.sys
c:\windows\system32\$winnt$w.dll
c:\windows\system32\$winnt$wg.dll
C:\mfvse.exe
c:\windows\system32\909338939.dat
C:\1823729539
c:\windows\system32\drivers\c377109c.sys
c:\windows\system32\afobeyurq.exe
C:\tcrnwc.exe
C:\ucpdcu.exe
c:\windows\instsp1.exe
c:\windows\system32\gilefede.dll
c:\windows\system32\tigifofi.dll
c:\windows\system32\dafirulo.dll
c:\windows\system32\tohagugu.dll
c:\windows\system32\loganini.dll
c:\windows\system32\Drivers\ati0iqxx.sys
c:\windows\system32\Drivers\ati1krxx.sys 
c:\windows\system32\Drivers\ati3nuxx.sys 
c:\windows\system32\Drivers\ati4nuxx.sys 
c:\windows\system32\Drivers\ati5qxxx.sys 
c:\windows\system32\Drivers\ati5raxx.sys 
c:\windows\system32\Drivers\ati6emxx.sys 
c:\windows\system32\Drivers\ati7raxx.sys 
c:\windows\system32\Drivers\ati8ryxx.sys 
c:\windows\System32\drivers\ati6ahxx.sys 
c:\windows\System32\drivers\ati6wgxx.sys 
c:\windows\Tasks\Antispyware Scheduled Scan.job

Folder::
c:\windows\system32\Adobe

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #17
System is running very smoothly. Programs are no longer 'not responding' and everything is overall running very quickly. Desktop is back to normal. Startup is faster than it's ever been. :notworthy:

Here is the new Combo-Fix log:


ComboFix 09-03-23.01 - Owner 2009-03-25 22:06:49.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1589 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Trend Micro AntiVirus *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\1823729539
C:\iivopso.exe
C:\lwvjuv.exe
C:\mfvse.exe
C:\tcrnwc.exe
C:\ucpdcu.exe
c:\windows\axehejoz.dll
c:\windows\instsp1.exe
c:\windows\system32\$winnt$w.dll
c:\windows\system32\$winnt$wg.dll
c:\windows\system32\1025o.sys
c:\windows\system32\909338939.dat
c:\windows\system32\afobeyurq.exe
c:\windows\system32\dafirulo.dll
c:\windows\system32\Drivers\ati0iqxx.sys
c:\windows\system32\Drivers\ati1krxx.sys
c:\windows\system32\Drivers\ati3nuxx.sys
c:\windows\system32\Drivers\ati4nuxx.sys
c:\windows\system32\Drivers\ati5qxxx.sys
c:\windows\system32\Drivers\ati5raxx.sys
c:\windows\System32\drivers\ati6ahxx.sys
c:\windows\system32\Drivers\ati6emxx.sys
c:\windows\System32\drivers\ati6wgxx.sys
c:\windows\system32\Drivers\ati7raxx.sys
c:\windows\system32\Drivers\ati8ryxx.sys
c:\windows\system32\drivers\c377109c.sys
c:\windows\system32\gilefede.dll
c:\windows\system32\loganini.dll
c:\windows\system32\tigifofi.dll
c:\windows\system32\tohagugu.dll
c:\windows\Tasks\Antispyware Scheduled Scan.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\1823729539
C:\iivopso.exe
C:\lwvjuv.exe
C:\mfvse.exe
C:\tcrnwc.exe
C:\ucpdcu.exe
c:\windows\axehejoz.dll
c:\windows\instsp1.exe
c:\windows\system32\$winnt$w.dll
c:\windows\system32\$winnt$wg.dll
c:\windows\system32\1025o.sys
c:\windows\system32\909338939.dat
c:\windows\system32\Adobe
c:\windows\system32\Adobe\Director\M5drvr32.exe
c:\windows\system32\Adobe\Director\M5if32.dll
c:\windows\system32\Adobe\Director\np32dsw.dll
c:\windows\system32\Adobe\Director\SwDir.dll
c:\windows\system32\Adobe\Shockwave 11\Control.dll
c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
c:\windows\system32\Adobe\Shockwave 11\gi.dll
c:\windows\system32\Adobe\Shockwave 11\gt.exe
c:\windows\system32\Adobe\Shockwave 11\gtapi.dll
c:\windows\system32\Adobe\Shockwave 11\iml32.dll
c:\windows\system32\Adobe\Shockwave 11\Install.log
c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
c:\windows\system32\Adobe\Shockwave 11\Proj.dll
c:\windows\system32\Adobe\Shockwave 11\shockwave_Projector_Loader.dcr
c:\windows\system32\Adobe\Shockwave 11\SwHelper_1103472.exe
c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
c:\windows\system32\Adobe\Shockwave 11\SwLogo.bmp
c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
c:\windows\system32\Adobe\Shockwave 11\SYMCCHECKER.DLL
c:\windows\system32\Adobe\Shockwave 11\UNWISE.EXE
c:\windows\system32\Adobe\Shockwave 11\Xtras\autodownload.txt
c:\windows\system32\Adobe\Shockwave 11\Xtras\CBrowser.x32
c:\windows\system32\Adobe\Shockwave 11\Xtras\INetURL.x32
c:\windows\system32\Adobe\Shockwave 11\Xtras\Multiusr.x32
c:\windows\system32\Adobe\Shockwave 11\Xtras\Netfile.x32
c:\windows\system32\Adobe\Shockwave 11\Xtras\Netlingo.x32
c:\windows\system32\Adobe\Shockwave 11\Xtras\Speech.x32
c:\windows\system32\afobeyurq.exe
c:\windows\system32\dafirulo.dll
c:\windows\system32\drivers\c377109c.sys
c:\windows\system32\gilefede.dll
c:\windows\system32\loganini.dll
c:\windows\system32\tigifofi.dll
c:\windows\system32\tohagugu.dll
c:\windows\system32\win32hlp.cnf
c:\windows\Tasks\Antispyware Scheduled Scan.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ati0iqxx
——-\Service_ati1krxx
——-\Service_ati3nuxx
——-\Service_ati4nuxx
——-\Service_ati5qxxx
——-\Service_ati5raxx
——-\Service_ati6ahxx
——-\Service_ati6emxx
——-\Service_ati6wgxx
——-\Service_ati7raxx
——-\Service_ati8ryxx


((((((((((((((((((((((((( Files Created from 2009-02-26 to 2009-03-26 )))))))))))))))))))))))))))))))
.

2009-03-20 13:00 . 2009-03-20 13:00 d——– C:\_OTListIt
2009-03-13 17:40 . 2009-03-13 17:41 d——– c:\program files\ERUNT
2009-03-13 17:14 . 2009-03-19 17:15 10,240 –a—— c:\windows\instsp2.exe
2009-03-12 03:24 . 2009-03-14 18:30 104,960 –a—— c:\windows\system32\dllcache\userinit.exe
2009-03-12 03:24 . 2009-03-12 03:24 95,232 –a—— c:\windows\system32\QoS.dll
2009-03-11 16:00 . 2009-03-11 16:00 26 –a—— c:\windows\system32\advapi32a.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 02:00 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-20 17:35 ——— d—–w c:\documents and settings\Owner\Application Data\Antispyware
2009-03-13 21:32 ——— d—–w c:\program files\Trend Micro
2009-03-13 02:53 ——— d—–w c:\documents and settings\All Users\Application Data\avg8
2009-03-11 07:00 16,384 —-a-w c:\windows\DCEBoot.exe
2009-03-06 02:17 36,368 —-a-w c:\windows\system32\drivers\tmpreflt.sys
2009-03-06 02:17 205,328 —-a-w c:\windows\system32\drivers\tmxpflt.sys
2009-03-06 02:17 1,195,512 —-a-w c:\windows\system32\drivers\vsapint.sys
2009-03-03 23:12 80,400 —-a-w c:\windows\system32\drivers\tmtdi.sys
2009-03-03 08:34 50,192 —-a-w c:\windows\system32\drivers\tmevtmgr.sys
2009-03-03 08:34 50,192 —-a-w c:\windows\system32\drivers\tmactmon.sys
2009-03-03 08:34 150,032 —-a-w c:\windows\system32\drivers\tmcomm.sys
2009-02-24 21:27 ——— d—–w c:\program files\Google
2009-02-17 02:17 ——— d—–w c:\documents and settings\Owner\Application Data\Move Networks
2009-02-13 07:00 ——— d—–w c:\documents and settings\Owner\Application Data\Amazon
2009-02-13 06:58 ——— d—–w c:\program files\Amazon
2009-02-04 21:03 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-02-04 21:03 ——— d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-04 20:57 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-05 21:17 81,920 —-a-w c:\documents and settings\Owner\Application Data\ezpinst.exe
2009-01-05 21:17 47,360 —-a-w c:\documents and settings\Owner\Application Data\pcouffin.sys
2007-06-21 04:19 604 —ha-w c:\program files\STLL Notifier
2008-09-23 03:17 57,344 –sha-w c:\windows\system32\vidohosi.dll
.

——- Sigcheck ——-

2005-05-25 23:07 359936 63fdfea54eb53de2d863ee454937ce1e c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 21:07 360448 5562cc0a47b2aef06d3417b733f3c195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 08:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 12:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 06:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 07:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 07:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2006-03-16 00:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB893066$\tcpip.sys
2005-05-25 23:04 359808 88763a98a4c26c409741b4aa162720c9 c:\windows\$NtUninstallKB913446$\tcpip.sys
2006-04-20 07:51 359808 1dbf125862891817f374f407626967f4 c:\windows\$NtUninstallKB941644$\tcpip.sys
2007-10-30 13:20 360064 90caff4b094573449a0872a0f919b178 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-04-13 15:20 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\ServicePackFiles\i386\tcpip.sys
2008-04-13 15:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\tcpip.sys
2008-04-13 15:20 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\system32\drivers\tcpip.sys

2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
2009-03-12 03:23 264704 9aae01609c3060b79b58e3b085caf4bf c:\windows\system32\userinit.exe
2009-03-14 18:30 104960 1463c159a718b86444e146bf0c5c3381 c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-03-13 995528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi5"= xgusb.cpl

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
–a—— 2008-12-15 23:20 342848 c:\program files\BitTorrent_DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
–a—— 2005-08-06 00:56 64512 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-17 02:11 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
–a—— 2006-05-04 01:58 458752 c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
–a—— 2006-03-22 16:13 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
–a—— 2006-03-22 16:17 118784 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
–a—— 2006-03-22 16:17 94208 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2005-08-11 19:30 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2005-08-11 19:30 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
–a—— 2008-03-17 17:59 2289664 c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
–a—— 2006-06-19 14:33 163840 c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
–a—— 2006-07-19 18:14 102400 c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 10:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]
–a—— 2005-10-11 13:23 1187840 c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-11-11 00:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
–a—— 2006-06-17 01:22 794713 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
–a—— 2007-11-15 22:51 166304 c:\program files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
–a—— 2006-06-02 11:02 61952 c:\windows\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsmqIntCert]
–a—— 2008-04-13 20:11 177152 c:\windows\system32\mqrt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"hpqwmiex"=2 (0x2)
"IDriverT"=3 (0x3)
"LightScribeService"=2 (0x2)
"Vongo Service"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"btwdins"=2 (0x2)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\BitTorrent_DNA\\dna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\BitTorrent_DNA\\btdna.exe"=
"c:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe"=
"c:\\Program Files\\Viewpoint\\Common\\ViewpointService.exe"=
"c:\\Program Files\\WIDCOMM\\Bluetooth Software\\bin\\btwdins.exe"=
"c:\\Program Files\\AIM6\\aolsoftware.exe"=
"c:\\WINDOWS\\system32\\ZuneBusEnum.exe"=

R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2008-07-30 36368]
S1 c377109c;c377109c;c:\windows\system32\drivers\c377109c.sys –> c:\windows\system32\drivers\c377109c.sys [?]
S1 vdmzmty5;AVZ-BC Kernel Driver;\??\c:\windows\system32\Drivers\vdmzmty5.sys –> c:\windows\system32\Drivers\vdmzmty5.sys [?]
S2 gupdate1c996c6aaa1b06b;Google Update Service (gupdate1c996c6aaa1b06b);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-24 133104]
S2 kjtahoyq;kjtahoyq;c:\windows\System32\svchost.exe -k netsvcs [2006-03-16 14336]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-01-12 50192]
S2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2009-01-12 677128]
S3 iComp;HP Analog TV Tuner;c:\windows\system32\drivers\p2usbwdm.sys [2006-03-17 1544704]
S4 5U870CAP_VID_1262&PID;_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys –> c:\windows\system32\Drivers\5U870CAP.sys [?]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-03-02 24652]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Kjtahoyq

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c98f1c48-4f29-11dc-a9b0-0019154db70f}]
\Shell\AutoRun\command - F:\LapNetWizard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c98f1c4b-4f29-11dc-a9b0-0019154db70f}]
\Shell\AutoRun\command - F:\LapNetWizard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da50e292-cba1-11db-a91f-0018de311df1}]
\Shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-03-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2009-03-26 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 17:30]

2009-03-26 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-24 17:27]

2009-03-26 c:\windows\Tasks\User_Feed_Synchronization-{093592A9-671E-4241-9C3D-A7D7146614B6}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 13:58]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-ati0iqxx.sys
SafeBoot-ati1krxx.sys
SafeBoot-ati3nuxx.sys
SafeBoot-ati4nuxx.sys
SafeBoot-ati5qxxx.sys
SafeBoot-ati5raxx.sys
SafeBoot-ati6ahxx.sys
SafeBoot-ati6emxx.sys
SafeBoot-ati6wgxx.sys
SafeBoot-ati7raxx.sys
SafeBoot-ati8ryxx.sys


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.weather.com/weather/map/interactive/?from=hp_main_maps
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\7t1ert72.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/findfriends.php#/home.php?ref=home
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\7t1ert72.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\program files\BitTorrent_DNA\plugins\npbtdna.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-25 22:10:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(964)
c:\windows\system32\xgusb.cpl

- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\xgusb.cpl
.
———————— Other Running Processes ————————
.
c:\windows\system32\msdtc.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\ZuneBusEnum.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-03-25 22:14:17 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-26 02:14:14
ComboFix2.txt 2009-03-25 00:23:13

Pre-Run: 62,592,741,376 bytes free
Post-Run: 62,558,633,984 bytes free

367 — E O F — 2008-11-23 06:38:19





And here is the new HJT log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:02 PM, on 3/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weather.com/weather/map/interac…om=hp_main_maps
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=64&bd;=pavilion&pf;=laptop
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Update Service (gupdate1c996c6aaa1b06b) (gupdate1c996c6aaa1b06b) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

–
End of file - 5576 bytes
Post #18
Looking good now - one final run to clear any orphans :thumbup:

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
Post #19
Malwarebytes' Anti-Malware 1.34 Database version: 1902 Windows 5.1.2600 Service Pack 2 3/26/2009 1:33:34 PM mbam-log-2009-03-26 (13-33-34).txt Scan type: Quick Scan Objects scanned: 74856 Time elapsed: 5 minute(s), 30 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 6 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 1 Files Infected: 38 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{44b71ad2-4f42-4312-bff3-9b68a41de078} (Rogue.Antivirus2008) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c5bf40a2-94f3-42bd-f434-1604812c8955} (Trojan.Ertfor) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Installer\UpgradeCodes\e20d6ec50a67ec04083b1251f2935d09 (Rogue.Antivirus2008) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5bf40a2-94f3-42bd-f434-1604812c8955} (Trojan.Ertfor) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\e20d6ec50a67ec04083b1251f2935d09 (Rogue.Antivirus2008) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{44b71ad2-4f42-4312-bff3-9b68a41de078} (Rogue.Antivirus2008) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware (Rogue.Antispyware) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\fatenuva.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\fefihoha.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\gugomuba.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jizejuwe.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\melasora.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\muwesoli.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nomadani.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nurorawu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\pusunovi.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\QoS.dll (Adware.BHO) -> Quarantined and deleted successfully. C:\WINDOWS\system32\saperiho.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tatunulo.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\telonapi.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vetujavo.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vidohosi.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\volemuta.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vonojamo.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hediwovi.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hilemebu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\zolekare.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Local Settings\Temp\mousehook.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Local Settings\Temp\ntdll64.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Local Settings\Temp\ok6prj.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Local Settings\Temp\s8zkwn2iusq.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\07LGZ5E1\730f[1].exe (Backdoor.KeyStart) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\07LGZ5E1\730f[2].exe (Backdoor.KeyStart) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2DCJUP1O\730f[1].exe (Backdoor.KeyStart) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware\Antispyware on the Web.lnk (Rogue.Antispyware) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware\Antispyware.lnk (Rogue.Antispyware) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\Macromedia\Common\8b2600321.dll (Hijack.Sound) -> Quarantined and deleted successfully. C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\8b2600321.dll (Hijack.Sound) -> Quarantined and deleted successfully. C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\8b2600321.dll (Hijack.Sound) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Desktop\Antispyware.lnk (Rogue.Antispyware) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mopidozu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\fevihife.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\zavuvuhi.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\win32hlp.cnf (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jefotumo.dll (Trojan.Vundo) -> Quarantined and deleted successfully. A little note popped up at the bottom right saying my firewall is turned off and automatic updates are turned off. Should I leave them off for now or should I turn them back on?
Post #20
Yes turn them back on. To ensure I have killed all the respawning drivers I will need one more MBAM run. Run MBAM and update first then run a full scan. On completion post the new log. I think that then we will be at the tidying up stage :thumbup:
Post #21
Awesome! Here is the MBAM log: Malwarebytes' Anti-Malware 1.34 Database version: 1902 Windows 5.1.2600 Service Pack 2 3/26/2009 6:02:50 PM mbam-log-2009-03-26 (18-02-50).txt Scan type: Quick Scan Objects scanned: 74780 Time elapsed: 5 minute(s), 25 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #22
In the words of the immoral bard young sir …………..

Now the best part of the day —– Your log now appears clean :thumbup:

A good workman always cleans up after himself so..Run OTListit and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove along with ERUNT. But they may be useful tools to keep. For AVZ just delete the folder

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.

XP
Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:
  • Select Start > All Programs > Accessories > System tools > System Restore.
  • On the dialogue box that appears select Create a Restore Point
  • Click NEXT
  • Enter a name e.g. Clean
  • Click CREATE
You now have a clean restore point, to get rid of the bad ones:
  • Select Start > All Programs > Accessories > System tools > Disk Cleanup.
  • In the Drop down box that appears select your main drive e.g. C
  • Click OK
  • The System will do some calculation and the display a dialogue box with TABS
  • Select the More Options Tab.
  • At the bottom will be a system restore box with a CLEANUP button click this
  • Accept the Warning and select OK again, the program will close and you are done


Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
  • SpywareBlaster to help prevent spyware from installing in the first place.
  • SuperAntispyware Run weekly to keep your system clean
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe :wavey:
Post #23
Great! Thank you soooooooooooooooo much for all your help! I really thought this computer was done for so I can't thank you enough for all the time and patience with helping me. Cheers my friend! B)
Post #25
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI