What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Cow Survey/ Cant update windows

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Ok I have a custom built cpu.
Xp Service pack 3
Been having alot of troubles with Ie just going to some Cow Survey page asking what the picture is of.
Also I cant update windows


Heres a copy of my Hijack

http://forums.whatthetech.com/Updates_will…on_t101524.html

i found a similair topic but some of the files he was told to check and fix are a little different just in the I.p. addresses.
Any tips would be great!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:18:55 PM, on 4/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Razer\DeathAdder\razerhid.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\Program Files\Logitech\G-series Software\LGDCore.exe
D:\Program Files\Logitech\G-series Software\LCDMon.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
D:\Program Files\Razer\DeathAdder\razertra.exe
D:\WINDOWS\system32\dumprep.exe
D:\program files\steam\steam.exe
D:\Program Files\DNA\btdna.exe
D:\Program Files\Razer\DeathAdder\razerofa.exe
D:\WINDOWS\system32\SearchIndexer.exe
D:\WINDOWS\system32\dwwin.exe
D:\WINDOWS\system32\SearchProtocolHost.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdrgaming.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [nTrayFw] D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeathAdder] D:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Launch LGDCore] "D:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "D:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent DNA] "D:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: MagicDisc.lnk = D:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Windows Search.lnk = D:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1235937068921
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1238075721875
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{64FFF040-EA37-42AB-97B9-1F5F3BDC1247}: NameServer = 85.255.112.125,85.255.112.159
O17 - HKLM\System\CCS\Services\Tcpip\..\{6577B64E-91F2-4EAF-905B-B9CCE7E20A62}: NameServer = 85.255.112.125,85.255.112.159
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.125,85.255.112.159
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.125,85.255.112.159
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - D:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - D:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

–
End of file - 8231 bytes
Post #2
Hi and :welcome:

Please do the following:

  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below (if still present):

O17 - HKLM\System\CCS\Services\Tcpip\..\{64FFF040-EA37-42AB-97B9-1F5F3BDC1247}: NameServer = 85.255.112.125,85.255.112.159
O17 - HKLM\System\CCS\Services\Tcpip\..\{6577B64E-91F2-4EAF-905B-B9CCE7E20A62}: NameServer = 85.255.112.125,85.255.112.159
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.125,85.255.112.159
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.125,85.255.112.159

  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.




NEXT

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]
  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #5
Heres the new Hijackthis Copy

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:05:42 PM, on 4/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Razer\DeathAdder\razerhid.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Logitech\G-series Software\LGDCore.exe
D:\Program Files\Logitech\G-series Software\LCDMon.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\program files\steam\steam.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\SearchIndexer.exe
D:\Program Files\Razer\DeathAdder\razertra.exe
D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
D:\Program Files\Razer\DeathAdder\razerofa.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdrgaming.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [nTrayFw] D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeathAdder] D:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Launch LGDCore] "D:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "D:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent DNA] "D:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: MagicDisc.lnk = D:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Windows Search.lnk = D:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1235937068921
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1238075721875
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - D:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

–
End of file - 7344 bytes




And the combofix log


ComboFix 09-04-04.01 - Aaron 2009-04-06 18:33:52.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2713 [GMT -5:00]
Running from: d:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: NVIDIA Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\recycler\S-9-9-60-100023946-100013665-100019200-8377.com
d:\windows\system32\drivers\gaopdxmppfmkurtrlqhhboyijoenuaijwirqtl.sys
d:\windows\system32\gaopdxcounter
d:\windows\system32\gaopdxoqordlxyapujeyarmkkfhvdxggimtbwk.dll
E:\Autorun.inf
e:\recycler\S-9-9-60-100023946-100013665-100019200-8377.com
F:\Autorun.inf
f:\recycler\S-9-9-60-100023946-100013665-100019200-8377.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_gaopdxserv.sys


((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-06 18:18 . 2009-04-06 18:18 d——– d:\program files\Trend Micro
2009-04-05 23:02 . 2009-04-05 23:02 d——– d:\program files\MagicDisc
2009-04-05 23:02 . 2009-02-24 18:42 116,736 –a—— d:\windows\system32\drivers\mcdbus.sys
2009-04-05 22:52 . 2009-04-05 22:52 d——– d:\program files\DAEMON Tools Lite
2009-04-05 22:40 . 2009-04-05 22:59 d——– d:\program files\MagicISO
2009-04-05 14:58 . 2009-04-05 14:58 d——– d:\program files\ImTOO
2009-04-05 13:34 . 2009-04-05 13:34 d——– d:\program files\ZC DivX to DVD Creator
2009-04-04 17:12 . 2009-04-04 17:12 d——– d:\documents and settings\All Users\Application Data\Arcadetown Ashtons Family Resort
2009-04-04 17:12 . 2009-04-04 17:12 d——– d:\documents and settings\Aaron\Application Data\Arcadetown Ashtons Family Resort
2009-04-04 10:55 . 2009-04-04 10:55 d——– d:\documents and settings\All Users\Application Data\nView_Profiles
2009-04-03 17:11 . 2009-04-03 17:11 d——– d:\program files\AshtonsFamilyResort_at
2009-04-02 18:51 . 2009-04-02 18:51 d——– d:\documents and settings\Aaron\Application Data\DAEMON Tools
2009-04-02 18:50 . 2009-04-02 18:50 d——– d:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-04-02 18:50 . 2009-04-02 18:50 d——– d:\documents and settings\Aaron\Application Data\DAEMON Tools Lite
2009-04-01 07:49 . 2009-04-01 11:49 d——– d:\documents and settings\Aaron\Application Data\AVS4YOU
2009-04-01 07:48 . 2009-04-01 07:48 d——– d:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-31 15:50 . 2009-04-05 13:50 d——– d:\program files\Common Files\AVSMedia
2009-03-31 15:50 . 2009-04-05 13:50 d——– d:\program files\AVS4YOU
2009-03-31 15:50 . 2009-01-28 20:49 1,700,352 –a—— d:\windows\system32\GdiPlus.dll
2009-03-31 15:50 . 2009-01-28 20:49 974,848 –a—— d:\windows\system32\mfc70.dll
2009-03-31 15:50 . 2009-01-28 20:49 487,424 –a—— d:\windows\system32\msvcp70.dll
2009-03-31 15:50 . 2009-01-28 20:49 24,576 –a—— d:\windows\system32\msxml3a.dll
2009-03-31 08:02 . 2009-03-31 08:02 d——– d:\documents and settings\Aaron\Application Data\Sony
2009-03-31 08:02 . 2009-03-31 08:02 d——– d:\documents and settings\Aaron\Application Data\Publish Providers
2009-03-31 07:56 . 2009-03-31 07:56 d——– d:\program files\Vstplugins
2009-03-31 07:56 . 2009-03-31 07:56 d——– d:\program files\Sony
2009-03-31 07:56 . 2009-03-31 07:56 d——– d:\documents and settings\All Users\Application Data\Sony
2009-03-31 07:54 . 2009-03-31 07:54 d——– d:\program files\Sony Setup
2009-03-30 14:01 . 2009-03-30 14:01 d——– d:\documents and settings\All Users\Application Data\blg
2009-03-30 14:01 . 2009-03-30 14:01 d——– d:\documents and settings\Aaron\Application Data\blg
2009-03-29 09:48 . 2009-03-29 09:48 d——– d:\windows\Sun
2009-03-27 20:24 . 2009-03-27 20:24 d–h—– d:\windows\PIF
2009-03-27 16:11 . 2009-03-27 16:11 d——– d:\documents and settings\Aaron\Application Data\ViquaSoft
2009-03-26 13:09 . 2009-01-09 14:19 1,089,593 —–c— d:\windows\system32\dllcache\ntprint.cat
2009-03-26 13:07 . 2008-10-16 14:06 268,648 –a—— d:\windows\system32\mucltui.dll
2009-03-26 13:07 . 2008-10-16 14:06 27,496 –a—— d:\windows\system32\mucltui.dll.mui
2009-03-26 09:26 . 2009-03-26 09:26 d——– d:\windows\system32\XPSViewer
2009-03-26 09:25 . 2009-03-26 09:25 d——– d:\program files\Reference Assemblies
2009-03-26 09:25 . 2009-03-26 09:25 d——– D:\fbe504b3b815c741e5af9d13
2009-03-26 09:25 . 2008-07-06 07:06 1,676,288 ——— d:\windows\system32\xpssvcs.dll
2009-03-26 09:25 . 2008-07-06 07:06 1,676,288 —–c— d:\windows\system32\dllcache\xpssvcs.dll
2009-03-26 09:25 . 2008-07-06 05:50 597,504 —–c— d:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-26 09:25 . 2008-07-06 07:06 575,488 ——— d:\windows\system32\xpsshhdr.dll
2009-03-26 09:25 . 2008-07-06 07:06 575,488 —–c— d:\windows\system32\dllcache\xpsshhdr.dll
2009-03-26 09:25 . 2008-07-06 07:06 117,760 ——— d:\windows\system32\prntvpt.dll
2009-03-26 09:25 . 2008-07-06 07:06 89,088 —–c— d:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-26 09:17 . 2009-03-26 09:17 d——– d:\program files\Windows Media Connect 2
2009-03-26 09:17 . 2008-04-13 19:12 221,184 –a—— d:\windows\system32\wmpns.dll
2009-03-26 09:16 . 2009-03-26 09:16 d——– d:\windows\system32\LogFiles
2009-03-26 09:16 . 2009-03-26 09:16 d——– d:\windows\system32\drivers\UMDF
2009-03-26 09:16 . 2009-03-26 09:16 d——– D:\d566beb5829ce54a52a0f4f0d37d
2009-03-26 09:15 . 2009-03-26 09:16 d——– D:\c559dc12d5a99aa9ae4cda982307
2009-03-25 21:03 . 2006-06-12 18:06 662,288 –a—— d:\windows\system32\MSComCt2.ocx
2009-03-25 20:58 . 2009-03-25 20:58 d——– d:\documents and settings\All Users\Application Data\161D4
2009-03-25 20:57 . 2008-09-25 08:20 483,328 –a—— d:\windows\system32\actskn45.ocx
2009-03-25 20:53 . 2009-03-25 21:05 d——– d:\documents and settings\Aaron\Application Data\LimeWire
2009-03-25 20:52 . 2009-03-25 20:52 d——– d:\program files\Java
2009-03-25 20:52 . 2009-03-25 20:52 410,984 –a—— d:\windows\system32\deploytk.dll
2009-03-25 20:52 . 2009-03-25 20:52 73,728 –a—— d:\windows\system32\javacpl.cpl
2009-03-25 20:51 . 2009-03-25 20:55 d——– d:\program files\LimeWire
2009-03-23 17:46 . 2009-03-29 19:50 d——– d:\program files\Blubster
2009-03-23 08:08 . 2009-04-05 22:50 d——– d:\program files\DAEMON Tools Pro
2009-03-23 08:08 . 2009-03-23 08:08 d——– d:\documents and settings\All Users\Application Data\DAEMON Tools Pro
2009-03-22 20:45 . 2006-10-26 19:56 32,592 –a—— d:\windows\system32\msonpmon.dll
2009-03-22 20:44 . 2009-03-26 09:26 d——– d:\program files\MSBuild
2009-03-22 20:44 . 2009-03-22 20:44 d——– d:\program files\Microsoft Works
2009-03-22 20:44 . 2009-04-02 18:51 d——– d:\documents and settings\Aaron\Application Data\DAEMON Tools Pro
2009-03-22 20:44 . 2009-03-22 20:44 717,296 –a—— d:\windows\system32\drivers\sptd.sys
2009-03-22 20:43 . 2009-03-22 20:43 d——– d:\program files\Microsoft.NET
2009-03-22 20:41 . 2009-03-22 20:41 d——– d:\windows\SHELLNEW
2009-03-22 20:41 . 2009-03-22 20:41 d——– d:\program files\Microsoft Visual Studio 8
2009-03-22 20:40 . 2009-03-22 20:40 dr-h—– D:\MSOCache
2009-03-22 20:40 . 2009-03-26 09:28 d——– d:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-22 11:42 . 2009-03-22 11:42 d——– d:\program files\Logitech
2009-03-22 11:42 . 2009-03-22 11:42 d——– d:\documents and settings\All Users\Application Data\Logitech
2009-03-20 21:49 . 2009-03-20 23:51 d——– d:\documents and settings\Aaron\Application Data\GetRightToGo
2009-03-17 20:11 . 2009-04-05 13:36 116 –a—— d:\windows\NeroDigital.ini
2009-03-17 20:10 . 2009-03-17 20:10 d——– d:\program files\Common Files\Ahead
2009-03-17 20:10 . 2009-03-17 20:10 d——– d:\program files\Ahead
2009-03-17 20:10 . 2004-07-26 17:16 1,568,768 ——— d:\windows\system32\ImagX7.dll
2009-03-17 20:10 . 2004-07-26 17:16 476,320 ——— d:\windows\system32\ImagXpr7.dll
2009-03-17 20:10 . 2004-07-26 17:16 471,040 ——— d:\windows\system32\ImagXRA7.dll
2009-03-17 20:10 . 2004-07-26 17:16 262,144 ——— d:\windows\system32\ImagXR7.dll
2009-03-17 20:10 . 2001-07-09 11:50 155,648 –a—— d:\windows\system32\NeroCheck.exe
2009-03-17 20:10 . 2004-03-02 17:37 125,184 ——— d:\windows\system32\drivers\imagesrv.sys
2009-03-17 20:10 . 2000-06-26 11:45 106,496 –a—— d:\windows\system32\TwnLib20.dll
2009-03-17 20:10 . 2004-03-02 17:37 5,504 ——— d:\windows\system32\drivers\imagedrv.sys
2009-03-17 19:53 . 2009-03-17 19:54 d——– d:\program files\SmartDVDCreator
2009-03-17 17:44 . 2009-04-05 13:46 d——– d:\program files\DivX
2009-03-15 19:08 . 2009-03-15 19:08 d——– D:\Seven.Pounds[2008]DvDrip-aXXo
2009-03-14 16:16 . 2009-03-14 16:16 d–hs—- d:\windows\ftpcache
2009-03-14 10:10 . 2009-04-01 17:35 d——– d:\program files\HospitalHustle_at
2009-03-14 10:10 . 2009-03-14 10:10 d——– d:\documents and settings\Aaron\Application Data\GameInvest
2009-03-13 23:41 . 2009-03-13 23:41 d——– d:\program files\ESEA
2009-03-13 15:45 . 2009-03-13 15:45 d——– d:\documents and settings\Aaron\Application Data\Windows Search
2009-03-13 08:06 . 2009-03-13 08:06 d——– d:\windows\system32\GroupPolicy
2009-03-13 08:06 . 2009-03-13 08:06 d——– d:\program files\Windows Desktop Search
2009-03-13 08:06 . 2009-03-13 08:06 d——– d:\documents and settings\Aaron\Application Data\Windows Desktop Search
2009-03-13 08:05 . 2008-03-07 12:02 192,000 —–c— d:\windows\system32\dllcache\offfilt.dll
2009-03-13 08:05 . 2008-03-07 12:02 98,304 —–c— d:\windows\system32\dllcache\nlhtml.dll
2009-03-13 08:05 . 2008-03-07 12:02 29,696 —–c— d:\windows\system32\dllcache\mimefilt.dll
2009-03-11 07:44 . 2009-03-11 07:44 0 –a—— d:\windows\nsreg.dat
2009-03-10 23:30 . 2009-04-05 23:02 d——– d:\windows\LastGood
2009-03-10 18:21 . 2009-03-10 18:21 d——– d:\windows\LastGood.Tmp
2009-03-10 17:11 . 2009-03-10 17:11 d——– d:\documents and settings\Aaron\Application Data\Boolat Games
2009-03-09 18:30 . 2008-04-13 18:12 53,760 –a—— d:\windows\system32\vfwwdm32.dll
2009-03-09 18:30 . 2008-04-13 18:12 53,760 –a–c— d:\windows\system32\dllcache\vfwwdm32.dll
2009-03-09 18:30 . 2008-04-13 18:12 20,992 –a—— d:\windows\system32\dshowext.ax
2009-03-09 18:30 . 2008-04-13 18:12 20,992 –a–c— d:\windows\system32\dllcache\dshowext.ax
2009-03-09 18:28 . 2006-04-11 03:49 118,784 ——— d:\windows\system32\PTTreeIcons.dll
2009-03-09 18:23 . 2009-03-09 18:23 0 –a—— d:\windows\PTWebCam.INI
2009-03-09 18:20 . 2009-04-01 17:21 d——– d:\program files\Speed Racer Image Lab

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 23:32 ——— d—–w d:\documents and settings\Aaron\Application Data\DNA
2009-04-06 23:15 ——— d—–w d:\program files\Steam
2009-04-06 23:15 ——— d—–w d:\program files\DNA
2009-04-05 21:16 ——— d—–w d:\documents and settings\Aaron\Application Data\BitTorrent
2009-04-05 19:34 ——— d—a-w d:\documents and settings\All Users\Application Data\TEMP
2009-04-03 00:02 ——— d—–w d:\program files\Alawar
2009-04-03 00:01 ——— d—–w d:\documents and settings\All Users\Application Data\AlawarWrapper
2009-04-02 23:58 ——— d–h–w d:\program files\InstallShield Installation Information
2009-03-05 19:16 ——— d—–w d:\documents and settings\All Users\Application Data\FarmFrenzy-PizzaParty
2009-03-05 15:46 ——— d—–w d:\documents and settings\All Users\Application Data\Ludia
2009-03-05 15:46 ——— d—–w d:\documents and settings\Aaron\Application Data\Ludia
2009-03-04 23:00 ——— d—–w d:\documents and settings\Aaron\Application Data\vlc
2009-03-04 22:59 ——— d—–w d:\program files\VideoLAN
2009-03-04 17:21 ——— d—–w d:\documents and settings\All Users\Application Data\PlayFirst
2009-03-04 17:21 ——— d—–w d:\documents and settings\Aaron\Application Data\PlayFirst
2009-03-04 14:41 ——— d—–w d:\program files\Common Files\Adobe AIR
2009-03-04 14:41 ——— d—–w d:\documents and settings\Aaron\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-03-04 14:40 ——— d—–w d:\program files\NOS
2009-03-04 14:40 ——— d—–w d:\program files\Common Files\Adobe
2009-03-04 14:40 ——— d—–w d:\documents and settings\All Users\Application Data\NOS
2009-03-04 14:07 ——— d—–w d:\program files\BitTorrent
2009-03-04 02:06 ——— d—–w d:\program files\Ventrilo
2009-03-04 02:06 ——— d—–w d:\program files\Common Files\Wise Installation Wizard
2009-03-04 02:06 ——— d—–w d:\documents and settings\Aaron\Application Data\Ventrilo
2009-03-04 01:49 ——— d—–w d:\program files\AGEIA Technologies
2009-03-04 01:46 ——— d—–w d:\program files\SystemRequirementsLab
2009-03-03 23:31 ——— d—–w d:\program files\Razer
2009-03-03 23:31 ——— d—–w d:\documents and settings\Aaron\Application Data\InstallShield
2009-03-03 03:00 ——— d—–w d:\program files\Maxis
2009-03-01 19:34 ——— d—–w d:\program files\NVIDIA Corporation
2009-03-01 19:33 ——— d—–w d:\program files\Common Files\InstallShield
2009-03-01 19:30 ——— d—–w d:\program files\Marvell
2009-03-01 19:23 ——— d—–w d:\program files\microsoft frontpage
2009-03-01 19:22 558,142 —-a-w d:\windows\java\Packages\Z575FLBJ.ZIP
2009-03-01 19:22 155,995 —-a-w d:\windows\java\Packages\N57FJ3JJ.ZIP
2009-02-17 05:17 453,152 —-a-w d:\windows\system32\NVUNINST.EXE
2009-02-09 11:13 1,846,784 —-a-w d:\windows\system32\win32k.sys
2009-01-17 00:24 70,936 —-a-w d:\windows\system32\PhysXLoader.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="d:\program files\Messenger\MSMSGS.EXE" [2008-04-13 1695232]
"Steam"="d:\program files\steam\steam.exe" [2009-03-10 1410296]
"BitTorrent DNA"="d:\program files\DNA\btdna.exe" [2009-03-04 321344]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="d:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2005-04-29 266240]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"DeathAdder"="d:\program files\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Launch LGDCore"="d:\program files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 1122304]
"Launch LCDMon"="d:\program files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 497152]
"GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-03-25 136600]
"nwiz"="nwiz.exe" [2009-02-18 d:\windows\system32\nwiz.exe]

d:\documents and settings\Aaron\Start Menu\Programs\Startup\
MagicDisc.lnk - d:\program files\MagicDisc\MagicDisc.exe [2009-04-05 576000]

d:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - d:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JDCT"= jl_jdct.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Steam\\steamapps\\aaronschoice\\counter-strike source\\hl2.exe"=
"d:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"d:\\Program Files\\DNA\\btdna.exe"=
"d:\\Program Files\\BitTorrent\\bittorrent.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R3 DAdderFltr;DeathAdder Mouse;d:\windows\system32\drivers\dadder.sys [2007-08-02 22784]
S3 getPlus® Helper;getPlus® Helper;d:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-04 33752]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://tdrgaming.com/
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: DirectAnimation Java Classes - file://d:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 18:36:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(756)
d:\windows\system32\nvappfilter.dll
.
Completion time: 2009-04-06 18:39:24
ComboFix-quarantined-files.txt 2009-04-06 23:39:22

Pre-Run: 130,591,969,280 bytes free
Post-Run: 131,555,680,256 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect

259 — E O F — 2009-03-26 20:53:16
Post #7
Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


NEXT

Go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Please include in your next reply

  • MBAM log
  • Kaspersky report
  • Fresh HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI