Spyware / Malware / Virus Removal

[Closed] Annoying pop-up won't go away

11 min read

Looking for the outcome? Ask AI

sirens007 Topic Starter

Post #1July 8, 2009, 8:01 AM UTC

Hi,

If anyone can help me, I would appreciate it a lot. I am not tech savvy, but I know more than most and less than the proud few. My brother came to visit me from his Army Base in Alabama and stayed for a couple of days in my apartment. While I was working during the day, I made the mistake of giving a horny single white male the use of my computer. Now that he's gone I have problems that I cannot fix.

I keep getting a pop-up, no matter where I go or what I click on. After clicking ok, it reappears five more times. When I start the computer, it appears. If I go to a server it appears and if I click on a new or existing site (even switiching between tabs, it appears always.

This is the following message:

Header: ForceField.exe - Bad Image
Box Message: C:\Windows\system32\napinsp.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.

My computer runs using Windows Vista Home Premium 2007. The programs I have installed to keep it running smoothly are: ZoneAlarm (paid for), Advanced System Care (free), Iobit Security 360 (free), and I recently installed Super AntiSpyware Free Edition. I also have HiJack This. Here is my log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-07-08 00:55:36
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 103 GB (75%) free of 138 GB
Total RAM: 3034 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:55:55 AM, on 7/8/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Users\Jackie\AppData\Local\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\CheckPoint\ZAForceField\forcefield.exe
C:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe
C:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jackie\AppData\Local\Temp\IswTmp\DwlRun\RSIT.exe
C:\Program Files\trend micro\Jackie.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: ForceField Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: ForceField Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IStray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ZAFFRegisterTrustChecker] "C:\Windows\system32\regsvr32.exe" -s "C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustChecker.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ZAFFRegisterTrustChecker] "C:\Windows\system32\regsvr32.exe" -s "C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustChecker.dll" (User 'Default user')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: Google Update Service (gupdate1c9faf61065dde0) (gupdate1c9faf61065dde0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: ISservice - Unknown owner - C:\Program Files\IObit\IObit Security 360\ISsrv.exe
O23 - Service: ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

–
End of file - 9433 bytes

======Scheduled tasks folder======

C:\Windows\tasks\AWC Startup.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-783231216-1778500054-4282995654-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-783231216-1778500054-4282995654-1000UA.job
C:\Windows\tasks\SmartDefrag.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-04-03 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}]
ForceField Toolbar Registrar - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2009-04-17 451976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-04-03 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]
{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - ForceField Toolbar - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2009-04-17 451976]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-20 1008184]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2008-09-03 200704]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-12-14 483420]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-12-08 150040]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-12-08 178712]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-12-08 154136]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2008-12-22 3810304]
"QuickSet"=C:\Program Files\Dell\QuickSet\QuickSet.exe [2009-01-09 1735760]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2008-05-07 178712]
"dellsupportcenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2008-10-04 206064]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2009-03-31 982408]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"IObit Security 360"=C:\Program Files\IObit\IObit Security 360\IStray.exe [2009-06-08 773392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-20 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-20 125952]
"SmartRAM"=C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe [2009-02-19 202064]
"Messenger (Yahoo!)"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2009-05-26 4351216]
"Google Update"=C:\Users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-16 133104]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-20 202240]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-06-23 1830128]

C:\Users\Jackie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dell Dock.lnk - C:\Program Files\Dell\DellDock\DellDock.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-12-08 221184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{000112e7-333f-11de-bb23-0023ae2989e2}]
shell\AutoRun\command - G:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{437d5166-2045-11de-b921-806e6f6e6963}]
shell\AutoRun\command - F:\RunGame.exe

======List of files/folders created in the last 1 months======

2009-07-08 00:55:36 —-D—- C:\rsit
2009-07-07 23:06:25 —-D—- C:\ProgramData\SUPERAntiSpyware.com
2009-07-07 23:05:40 —-D—- C:\Users\Jackie\AppData\Roaming\SUPERAntiSpyware.com
2009-07-07 23:05:40 —-D—- C:\Program Files\SUPERAntiSpyware
2009-07-07 23:05:13 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2009-07-02 02:17:22 —-D—- C:\Program Files\Google
2009-06-29 11:41:37 —-A—- C:\Windows\system32\sc4_patchlog.txt
2009-06-27 09:04:10 —-D—- C:\Program Files\Trend Micro
2009-06-24 14:36:11 —-D—- C:\Users\Jackie\AppData\Roaming\Yahoo!
2009-06-24 14:35:18 —-D—- C:\ProgramData\Yahoo!
2009-06-24 14:35:14 —-D—- C:\Program Files\Yahoo!
2009-06-22 16:04:32 —-D—- C:\Users\Jackie\AppData\Roaming\PeerNetworking
2009-06-21 23:33:43 —-D—- C:\Users\Jackie\AppData\Roaming\dvdcss
2009-06-14 13:59:49 —-A—- C:\Windows\system32\psisdecd.dll
2009-06-14 13:59:49 —-A—- C:\Windows\system32\EncDec.dll
2009-06-14 01:13:03 —-D—- C:\Users\Jackie\AppData\Roaming\WinRAR
2009-06-14 00:52:56 —-D—- C:\Graboid
2009-06-14 00:39:00 —-D—- C:\Users\Jackie\AppData\Roaming\vlc
2009-06-14 00:37:39 —-D—- C:\Users\Jackie\AppData\Roaming\MozillaControl
2009-06-14 00:37:28 —-D—- C:\Program Files\Mozilla ActiveX Control v1.7.12
2009-06-14 00:37:02 —-D—- C:\Program Files\VideoLAN
2009-06-14 00:36:43 —-D—- C:\Program Files\Graboid
2009-06-10 22:29:41 —-A—- C:\Windows\system32\localspl.dll
2009-06-10 22:29:32 —-A—- C:\Windows\system32\rpcrt4.dll
2009-06-10 22:29:25 —-A—- C:\Windows\system32\mshtml.dll
2009-06-10 22:29:23 —-A—- C:\Windows\system32\ieframe.dll
2009-06-10 22:29:22 —-A—- C:\Windows\system32\wininet.dll
2009-06-10 22:29:22 —-A—- C:\Windows\system32\urlmon.dll
2009-06-10 22:29:22 —-A—- C:\Windows\system32\iertutil.dll
2009-06-10 22:29:21 —-A—- C:\Windows\system32\msfeeds.dll
2009-06-10 22:29:21 —-A—- C:\Windows\system32\iedkcs32.dll
2009-06-10 22:29:20 —-A—- C:\Windows\system32\occache.dll
2009-06-10 22:29:20 —-A—- C:\Windows\system32\ieUnatt.exe
2009-06-10 22:29:20 —-A—- C:\Windows\system32\ieencode.dll
2009-06-10 22:29:20 —-A—- C:\Windows\system32\ieaksie.dll
2009-06-10 22:29:19 —-A—- C:\Windows\system32\mstime.dll
2009-06-10 22:29:19 —-A—- C:\Windows\system32\jsproxy.dll
2009-06-10 08:49:54 —-D—- C:\ProgramData\IObit
2009-06-10 08:45:31 —-AD—- C:\ProgramData\TEMP

======List of files/folders modified in the last 1 months======

2009-07-08 00:55:51 —-D—- C:\Windows\Temp
2009-07-08 00:55:34 —-D—- C:\Windows\Internet Logs
2009-07-08 00:54:28 —-HD—- C:\ProgramData
2009-07-08 00:54:26 —-D—- C:\Windows\Tasks
2009-07-07 23:57:55 —-D—- C:\Windows\System32
2009-07-07 23:57:55 —-D—- C:\Windows\inf
2009-07-07 23:57:55 —-A—- C:\Windows\system32\PerfStringBackup.INI
2009-07-07 23:05:58 —-SHD—- C:\Windows\Installer
2009-07-07 23:05:40 —-RD—- C:\Program Files
2009-07-07 23:05:36 —-SHD—- C:\System Volume Information
2009-07-07 23:05:13 —-D—- C:\Program Files\Common Files
2009-07-07 22:04:47 —-D—- C:\Windows\system32\Tasks
2009-07-07 22:03:13 —-D—- C:\Program Files\Mozilla Firefox
2009-07-07 21:49:28 —-A—- C:\rollback.ini
2009-07-07 14:44:00 —-D—- C:\Users\Jackie\AppData\Roaming\Skype
2009-07-07 12:56:05 —-D—- C:\Users\Jackie\AppData\Roaming\skypePM
2009-07-07 02:44:14 —-D—- C:\Windows\Prefetch
2009-07-07 02:44:11 —-D—- C:\Windows\system32\drivers
2009-07-06 13:11:35 —-D—- C:\Windows\system32\ZoneLabs
2009-07-01 08:50:44 —-D—- C:\Windows\LiveKernelReports
2009-06-29 16:30:43 —-D—- C:\Windows\system32\catroot2
2009-06-29 03:14:11 —-D—- C:\Program Files\DivX
2009-06-23 13:15:13 —-SD—- C:\Users\Jackie\AppData\Roaming\Microsoft
2009-06-16 23:05:06 —-D—- C:\Users\Jackie\AppData\Roaming\Apple Computer
2009-06-15 19:05:56 —-D—- C:\Windows\system32\WDI
2009-06-14 14:21:48 —-D—- C:\Windows\winsxs
2009-06-14 14:21:44 —-D—- C:\Windows\ehome
2009-06-14 13:58:58 —-D—- C:\Windows\system32\catroot
2009-06-11 03:09:56 —-D—- C:\Program Files\Internet Explorer
2009-06-11 03:04:27 —-D—- C:\Program Files\Microsoft Works
2009-06-10 10:08:58 —-D—- C:\Program Files\Winamp
2009-06-10 09:52:52 —-D—- C:\Program Files\Common Files\Adobe
2009-06-10 09:52:52 —-D—- C:\Program Files\Adobe
2009-06-10 08:49:52 —-D—- C:\Program Files\IObit

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2009-03-31 150544]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2009-06-23 9968]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2009-06-23 72944]
R1 Vsdatant;Zone Alarm Firewall Driver; C:\Windows\system32\DRIVERS\vsdatant.sys [2009-03-31 293528]
R2 ISWKL;ForceField ISWKL; \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2009-04-17 21136]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2008-09-03 170032]
R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2008-12-22 18424]
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2008-12-17 1331192]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-20 14208]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-12-08 2473472]
R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-09-02 69664]
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2009-06-23 7408]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2008-12-14 393216]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-20 11264]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2008-09-01 304128]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2009-04-03 5632]
S3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-20 220672]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-20 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-20 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-20 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-20 6016]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 2028032]
S3 RimUsb;BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb.sys [2008-04-16 22784]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-20 35328]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-20 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-20 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-20 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\aestsrv.exe [2008-12-14 81920]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-09-23 155648]
R2 IAANTMON;Intel® Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2008-05-07 354840]
R2 IswSvc;ForceField IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [2009-04-17 394632]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
R2 sprtsvc_DellSupportCenter;SupportSoft Sprocket Service (DellSupportCenter); C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-10-04 201968]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\STacSV.exe [2008-12-14 241746]
R2 vsmon;TrueVector Internet Monitor; C:\Windows\System32\ZoneLabs\vsmon.exe [2009-03-31 2404232]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2008-12-22 26112]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
R2 yksvc;Marvell Yukon Service; ykx32coinst,serviceStartProc []
S2 gupdate1c9faf61065dde0;Google Update Service (gupdate1c9faf61065dde0); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-02 133104]
S3 ISservice;ISservice; C:\Program Files\IObit\IObit Security 360\ISsrv.exe [2009-06-08 214800]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2008-03-24 74384]

—————–EOF—————–

info.txt logfile of random's system information tool 1.06 2009-07-08 00:55:59

======Uninstall list======

–>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
Acrobat.com–>MsiExec.exe /X{6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Adobe AIR–>c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR–>MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 Plugin–>C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1.2–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Advanced SystemCare 3–>"C:\Program Files\IObit\Advanced SystemCare 3\unins000.exe"
Apple Mobile Device Support–>MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Bonjour–>MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Catan Online World–>C:\Program Files\Catan GmbH\Catan Online World 2\uninst.exe
Choice Guard–>MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Cisco EAP-FAST Module–>MsiExec.exe /I{415B2719-AD3A-4944-B404-C472DB6085B3}
Cisco LEAP Module–>MsiExec.exe /I{83770D14-21B9-44B3-8689-F7B523F94560}
Cisco PEAP Module–>MsiExec.exe /I{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}
Compatibility Pack for the 2007 Office system–>MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Consumer In-Home Service Agreement–>MsiExec.exe /I{F47C37A4-7189-430A-B81D-739FF8A7A554}
Dell Dock–>MsiExec.exe /I{F6CB42B9-F033-4152-8813-FF11DA8E6A78}
Dell Edoc Viewer–>MsiExec.exe /I{3138EAD3-700B-4A10-B617-B3F8096EE30D}
Dell Getting Started Guide–>MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}
Dell Support Center (Support Software)–>MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
Dell Touchpad–>C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE
Dell Wireless WLAN Card Utility–>"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card"
DELL0604–>MsiExec.exe /I{3D8F9830-D6A3-413A-9A54-993827A73E47}
DivX Codec–>C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter–>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player–>C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters–>C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
Google Earth–>MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
Google Update Helper–>MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Graboid Video 1.65–>C:\Program Files\Graboid\uninst.exe
HijackThis 2.0.2–>"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)–>C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)–>C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Product Detection–>MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
Intel® Matrix Storage Manager–>C:\Windows\system32\imsmudlg.exe -uninstall
IObit Security 360 Beta 1–>"C:\Program Files\IObit\IObit Security 360\unins000.exe"
Java™ 6 Update 11–>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Junk Mail filter update–>MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}
kSolo Recorder–>C:\Program Files\kSolo\uninstall.exe
Microsoft .NET Framework 3.5 SP1–>c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1–>MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office PowerPoint Viewer 2007 (English)–>MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Search Enhancement Pack–>MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight–>MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]–>MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)–>MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)–>MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17–>MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Works–>MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
Mozilla Firefox (3.0.11)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT–>MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
PowerDVD–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -l0x9 -cluninstall
QuickSet–>MsiExec.exe /I{C4972073-2BFE-475D-8441-564EA97DA161}
QuickTime–>MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Roxio Creator Audio–>MsiExec.exe /I{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}
Roxio Creator Copy–>MsiExec.exe /I{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}
Roxio Creator Data–>MsiExec.exe /I{08E81ABD-79F7-49C2-881F-FD6CB0975693}
Roxio Creator DE–>C:\ProgramData\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe /x {09760D42-E223-42AD-8C3E-55B47D0DDAC3}
Roxio Creator DE–>MsiExec.exe /I{ED439A64-F018-4DD4-8BA5-328D85AB09AB}
Roxio Creator Tools–>MsiExec.exe /I{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}
Roxio Express Labeler 3–>MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio Update Manager–>MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
SimCity 4 Deluxe–>C:\Program Files\Maxis\SimCity 4 Deluxe\EAUninstall.exe
Skype™ 4.0–>MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Smart Defrag 1.20–>"C:\Program Files\IObit\IObit SmartDefrag\unins000.exe"
SUPERAntiSpyware Free Edition–>MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
VC 9.0 Runtime–>MsiExec.exe /I{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}
VC80CRTRedist - 8.0.50727.762–>MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VideoLAN VLC media player 0.8.6d–>C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Call–>MsiExec.exe /I{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}
Windows Live Communications Platform–>MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
Windows Live Essentials–>C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials–>MsiExec.exe /I{D9D754A1-EAC5-406C-A28B-C49B1E846711}
Windows Live Mail–>MsiExec.exe /I{63C1109E-D977-49ED-BCE3-D00D0BF187D6}
Windows Live Messenger–>MsiExec.exe /X{0AAA9C97-74D4-47CE-B089-0B147EF3553C}
Windows Live Photo Gallery–>MsiExec.exe /X{F73A5B18-EB75-4B2C-B32D-9457576E2417}
Windows Live Sign-in Assistant–>MsiExec.exe /I{9422C8EA-B0C6-4197-B8FC-DC797658CA00}
Windows Live Sync–>MsiExec.exe /X{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}
Windows Live Toolbar–>MsiExec.exe /X{2B4C7E1E-E446-4740-ADB5-9842E742EE8A}
Windows Live Upload Tool–>MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Live Writer–>MsiExec.exe /X{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}
Yahoo! Messenger–>C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Software Update–>C:\PROGRA~1\Yahoo!\SOFTWA~1\UNINST~1.EXE
ZoneAlarm Extreme Security–>C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe

======Security center information======

AV: ZoneAlarm Extreme Security Antivirus
FW: ZoneAlarm Extreme Security Firewall
AS: ZoneAlarm Extreme Security Anti-Spyware
AS: Windows Defender
AS: SUPERAntiSpyware

======System event log======

Computer Name: Jackie-PC
Event Code: 3004
Message: Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow.
For more information please see the following:
Not Applicable
Scan ID: {7D407661-629F-4DB6-B10D-15D3893673F5}
User: Jackie-PC\Jackie
Name: Unknown
ID:
Severity ID:
Category ID:
Path Found: service:SRESCAN
Alert Type: Unclassified software
Detection Type:
Record Number: 43504
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20090708065337.000000-000
Event Type: Warning
User:

Computer Name: Jackie-PC
Event Code: 7000
Message: The Intel® PRO/1000 PCI Express Network Connection Driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
Record Number: 43528
Source Name: Service Control Manager
Time Written: 20090708065349.000000-000
Event Type: Error
User:

Computer Name: Jackie-PC
Event Code: 7000
Message: The Intel® PRO/1000 NDIS 6 Adapter Driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
Record Number: 43529
Source Name: Service Control Manager
Time Written: 20090708065349.000000-000
Event Type: Error
User:

Computer Name: Jackie-PC
Event Code: 8021
Message: The browser service was unable to retrieve a list of servers from the browser master \\FBOX360 on the network \Device\NetBT_Tcpip_{C91AB3A9-E8A0-4CDD-ACB3-5B46186758B6}.

Browser master: \\FBOX360
Network: \Device\NetBT_Tcpip_{C91AB3A9-E8A0-4CDD-ACB3-5B46186758B6}

This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.
Record Number: 43608
Source Name: BROWSER
Time Written: 20090708070147.000000-000
Event Type: Warning
User:

Computer Name: Jackie-PC
Event Code: 8032
Message: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{C91AB3A9-E8A0-4CDD-ACB3-5B46186758B6}. The backup browser is stopping.
Record Number: 43752
Source Name: BROWSER
Time Written: 20090708071029.000000-000
Event Type: Error
User:

=====Application event log=====

Computer Name: Jackie-PC
Event Code: 1002
Message: The program GoogleUpdater.exe version 2.4.1636.7222 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 4e8 Start Time: 01c9ff90c2738405 Termination Time: 0
Record Number: 8025
Source Name: Application Hang
Time Written: 20090708061148.000000-000
Event Type: Error
User:

Computer Name: Jackie-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-783231216-1778500054-4282995654-1000:
Process 876 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-783231216-1778500054-4282995654-1000

Record Number: 8029
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090708065136.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Jackie-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-783231216-1778500054-4282995654-1000_Classes:
Process 876 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-783231216-1778500054-4282995654-1000_CLASSES

Record Number: 8030
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090708065137.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Jackie-PC
Event Code: 10
Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 8050
Source Name: Microsoft-Windows-WMI
Time Written: 20090708065348.000000-000
Event Type: Error
User:

Computer Name: Jackie-PC
Event Code: 1002
Message: The program chrome.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 14f0 Start Time: 01c9ff9a5f30f622 Termination Time: 24
Record Number: 8062
Source Name: Application Hang
Time Written: 20090708070624.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: Jackie-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys
Record Number: 8289
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090708075555.329800-000
Event Type: Audit Failure
User:

Computer Name: Jackie-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys
Record Number: 8290
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090708075555.361000-000
Event Type: Audit Failure
User:

Computer Name: Jackie-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys
Record Number: 8291
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090708075555.407800-000
Event Type: Audit Failure
User:

Computer Name: Jackie-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys
Record Number: 8292
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090708075555.454600-000
Event Type: Audit Failure
User:

Computer Name: Jackie-PC
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys
Record Number: 8293
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090708075555.485800-000
Event Type: Audit Failure
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files\Common Files\DivX Shared\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE
"RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\10.0\Roxio Central36\
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"tvdumpflags"=8

—————–EOF—————–

CatByte

Post #2July 8, 2009, 12:43 PM UTC

Hi,

Please do the following:

1. Click on Start button.
2. Type Cmd in the Start Search text box.
3. Press Ctrl-Shift-Enter keyboard shortcut to run Command Prompt as Administrator. Allow elevation request.
4. Type netsh winsock reset in the Command Prompt shell, and then press the Enter key.
5. Restart the computer.

NEXT

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

It's normal after running TFC cleaner that the PC will be slower to boot the first time.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

In your next reply please include

MBAM Log
Kaspersky report

sirens007

Post #3July 8, 2009, 11:06 PM UTC

Hi and thanks for your time. I started working on the list you gave me since 9am (It is now 4pm). I met some problems along the way though. I attempted to run the TLC three times. The first two times, the program did not respond, and instead froze my computer. I had to restart it twice. Keep in mind, that incessant pop-up kept popping-up throughout everything. If I didn't click "ok" on it, my computer would not continue doing what it was doing. You can imagine the frustration. After finally getting the TLC to run I began the anti-malware download. You directed me to run the quick scan. I did, and no infections were found. I then ran the full scan. Also, no infections were found. I have both of them logged for you to read. Finally, I downloaded the Kaspersky online scanner. It was taking forever to download, and I had to run errands, that I left it downloading, and when I returned, my computer was shut off. I had to start over. After I was able to download the program and scan my computer, it found no viruses. And I have included that report for you to review. The pop-ups are still at it as I type to you now. QUICK SCAN Malwarebytes' Anti-Malware 1.38 Database version: 2393 Windows 6.0.6001 Service Pack 1 7/8/2009 9:33:50 AM mbam-log-2009-07-08 (09-33-50).txt Scan type: Quick Scan Objects scanned: 76675 Time elapsed: 4 minute(s), 5 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) FULL SCAN Malwarebytes' Anti-Malware 1.38 Database version: 2393 Windows 6.0.6001 Service Pack 1 7/8/2009 10:31:06 AM mbam-log-2009-07-08 (10-31-06).txt Scan type: Full Scan (C:\|E:\|) Objects scanned: 193364 Time elapsed: 56 minute(s), 40 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) KASPERSKY REPORT ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, July 8, 2009 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Wednesday, July 08, 2009 21:44:31 Records in database: 2445619 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ E:\ F:\ Scan statistics: Files scanned: 105871 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:02:57 No malware has been detected. The scan area is clean. The selected area was scanned.

CatByte

Post #4July 8, 2009, 11:35 PM UTC

Download Combofix from any of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
Tools->Options->Main tab
Set to "Always ask me where to Save the files".

Link 1
Link 2

During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
——————————————————————–

It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

Double click on Combo-Fix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\Combo-Fix.txt" for further review.
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

———————————————————–
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

———————————————————–

sirens007

Post #5July 9, 2009, 4:59 AM UTC

I don't know if what happened during the scan is relevant to the results on the log, but after I did the scan, I tried to get a window back up so I could forward the log. The computer denied me access and instead said Mozilla was marked for deletion. Not only that, it said everything was marked for deletion. I couldn't get online at all. So I saved the log and restarted the computer. I was able to get online again. Here is my log: ComboFix 09-07-08.04 - Jackie 07/08/2009 21:36.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3034.1922 [GMT -7:00] Running from: c:\users\[removed]\Desktop\Combo-Fix.exe AV: ZoneAlarm Extreme Security Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF} FW: ZoneAlarm Extreme Security Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: ZoneAlarm Extreme Security Anti-Spyware *disabled* (Updated) {F245A209-1085-48B4-B927-35D56015EC60} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-2773397201-2855733099-4214572315-500 c:\$recycle.bin\S-1-5-21-783231216-1778500054-4282995654-500 . ((((((((((((((((((((((((( Files Created from 2009-06-09 to 2009-07-09 ))))))))))))))))))))))))))))))) . 2009-07-09 04:22 . 2009-07-09 04:22 ——– d—–w- c:\users\Jackie\AppData\Roaming\vlc 2009-07-08 23:32 . 2009-07-08 23:32 ——– d—–w- c:\program files\Mozilla ActiveX Control v1.7.12 2009-07-08 16:28 . 2009-07-08 16:28 ——– d—–w- c:\users\Jackie\AppData\Roaming\Malwarebytes 2009-07-08 16:28 . 2009-06-17 18:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-08 16:28 . 2009-07-08 16:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2009-07-08 16:28 . 2009-07-08 16:28 ——– d—–w- c:\programdata\Malwarebytes 2009-07-08 16:28 . 2009-06-17 18:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys 2009-07-08 07:55 . 2009-07-08 07:55 ——– d—–w- C:\rsit 2009-07-08 06:06 . 2009-07-09 03:39 117760 —-a-w- c:\users\Jackie\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-07-08 06:06 . 2009-07-08 06:06 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2009-07-08 06:05 . 2009-07-08 06:05 ——– d—–w- c:\program files\SUPERAntiSpyware 2009-07-08 06:05 . 2009-07-08 06:05 ——– d—–w- c:\users\Jackie\AppData\Roaming\SUPERAntiSpyware.com 2009-07-08 06:05 . 2009-07-08 06:05 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard 2009-07-03 08:32 . 2009-07-03 08:47 ——– d—–w- c:\users\Jackie\AppData\Local\Microsoft Games 2009-07-02 09:17 . 2009-07-08 15:42 ——– d—–w- c:\program files\Google 2009-06-28 08:44 . 2009-06-28 08:44 746744 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2009-06-27 16:04 . 2009-07-08 07:55 ——– d—–w- c:\program files\Trend Micro 2009-06-24 21:37 . 2009-06-24 21:37 ——– d—–w- c:\users\Jackie\AppData\Local\Yahoo 2009-06-24 21:36 . 2009-06-24 21:36 ——– d—–w- c:\users\Jackie\AppData\Roaming\Yahoo! 2009-06-24 21:35 . 2009-06-24 21:37 ——– d—–w- c:\programdata\Yahoo! 2009-06-24 21:35 . 2009-05-27 02:50 607472 —-a-w- c:\programdata\Yahoo!\YUpdater\yupdater.exe 2009-06-24 21:35 . 2009-06-29 16:04 ——– d—–w- c:\program files\Yahoo! 2009-06-22 23:04 . 2009-06-22 23:04 ——– d—–w- c:\users\Jackie\AppData\Roaming\PeerNetworking 2009-06-22 06:33 . 2009-07-09 03:43 ——– d—–w- c:\users\Jackie\AppData\Roaming\dvdcss 2009-06-14 20:59 . 2009-04-30 12:19 293376 —-a-w- c:\windows\system32\psisdecd.dll 2009-06-14 20:59 . 2009-04-30 12:19 428544 —-a-w- c:\windows\system32\EncDec.dll 2009-06-14 07:52 . 2009-06-14 07:52 ——– d—–w- C:\Graboid 2009-06-14 07:37 . 2009-07-08 23:16 ——– d—–w- c:\users\Jackie\AppData\Local\Graboid_Inc 2009-06-14 07:37 . 2009-06-14 07:52 ——– d—–w- c:\users\Jackie\AppData\Local\Graboid 2009-06-14 07:37 . 2009-06-14 07:38 ——– d—–w- c:\users\Jackie\AppData\Roaming\MozillaControl 2009-06-14 07:37 . 2009-07-08 23:32 ——– d—–w- c:\program files\VideoLAN 2009-06-14 07:36 . 2009-07-08 23:32 ——– d—–w- c:\program files\Graboid 2009-06-10 15:49 . 2009-06-10 15:49 ——– d—–w- c:\programdata\IObit . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-09 03:39 . 2009-05-19 17:47 144 —-a-w- c:\windows\system32\pdfl.dat 2009-07-09 03:38 . 2009-05-19 17:45 351219 —ha-w- c:\windows\system32\drivers\vsconfig.xml 2009-07-09 03:13 . 2009-05-19 17:55 157115424 –sha-w- c:\windows\system32\drivers\fidbox.dat 2009-07-08 21:38 . 2009-05-02 19:00 ——– d—–w- c:\users\Jackie\AppData\Roaming\Skype 2009-07-08 17:23 . 2009-07-08 17:23 137435 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_07_08_10_18_32_small.dmp.zip 2009-07-08 17:18 . 2009-07-08 17:18 967680 —-a-w- c:\windows\Internet Logs\xDB4C9C.tmp 2009-07-08 16:18 . 2009-05-19 17:55 2035640 –sha-w- c:\windows\system32\drivers\fidbox.idx 2009-07-07 19:56 . 2009-05-02 19:01 ——– d—–w- c:\users\Jackie\AppData\Roaming\skypePM 2009-07-06 22:46 . 2009-07-06 22:47 2422784 —-a-w- c:\windows\Internet Logs\xDBA90C.tmp 2009-07-02 00:36 . 2009-05-15 01:38 730 —-a-w- c:\users\Jackie\AppData\Roaming\wklnhst.dat 2009-06-29 10:14 . 2009-04-28 02:58 ——– d—–w- c:\program files\DivX 2009-06-27 14:36 . 2009-06-27 15:51 587776 —-a-w- c:\windows\Internet Logs\xDB5E37.tmp 2009-06-24 09:23 . 2009-06-24 09:23 189456 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_24_02_18_01_small.dmp.zip 2009-06-21 10:16 . 2009-06-21 10:16 167872 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_21_03_11_33_small.dmp.zip 2009-06-19 04:45 . 2009-06-19 04:45 169688 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_18_21_40_12_small.dmp.zip 2009-06-18 14:39 . 2009-06-18 14:40 291328 —-a-w- c:\windows\Internet Logs\xDBA610.tmp 2009-06-17 06:05 . 2009-05-14 08:51 ——– d—–w- c:\users\Jackie\AppData\Roaming\Apple Computer 2009-06-15 15:29 . 2009-06-15 15:29 182580 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_15_08_23_57_small.dmp.zip 2009-06-15 01:16 . 2009-06-15 01:15 41049897 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_14_18_10_19_full.dmp.zip 2009-06-15 01:05 . 2009-06-15 01:04 183942 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_14_14_21_55_small.dmp.zip 2009-06-14 21:21 . 2009-06-15 00:59 615424 —-a-w- c:\windows\Internet Logs\xDB895C.tmp 2009-06-14 21:21 . 2009-06-15 00:59 2250240 —-a-w- c:\windows\Internet Logs\xDB8B02.tmp 2009-06-14 21:02 . 2009-06-14 21:02 173079 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_14_13_56_56_small.dmp.zip 2009-06-14 20:56 . 2009-06-14 20:57 2249728 —-a-w- c:\windows\Internet Logs\xDB4490.tmp 2009-06-13 07:22 . 2009-06-13 07:22 182230 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_13_00_17_18_small.dmp.zip 2009-06-12 02:41 . 2009-06-12 02:41 173988 —-a-w- c:\windows\Internet Logs\vsmon_2nd_2009_06_11_19_36_03_small.dmp.zip 2009-06-11 10:04 . 2009-04-03 17:16 ——– d—–w- c:\program files\Microsoft Works 2009-06-10 17:08 . 2009-05-21 22:37 ——– d—–w- c:\program files\Winamp 2009-06-10 16:52 . 2009-04-03 17:15 ——– d—–w- c:\program files\Common Files\Adobe 2009-06-10 15:49 . 2009-04-29 14:24 ——– d—–w- c:\program files\IObit 2009-06-08 16:34 . 2009-05-21 21:39 ——– d—–w- c:\users\Jackie\AppData\Roaming\LimeWire 2009-06-06 22:06 . 2009-06-06 22:06 680 —-a-w- c:\users\Jackie\AppData\Local\d3d9caps.dat 2009-06-06 06:17 . 2009-06-06 06:17 2159616 —-a-w- c:\windows\Internet Logs\xDB7081.tmp 2009-06-06 06:17 . 2009-06-06 06:17 330240 —-a-w- c:\windows\Internet Logs\xDB6FC4.tmp 2009-05-31 08:49 . 2009-05-31 19:25 365056 —-a-w- c:\windows\Internet Logs\xDB6308.tmp 2009-05-28 01:10 . 2009-05-28 04:10 847360 —-a-w- c:\windows\Internet Logs\xDB67B9.tmp 2009-05-26 22:27 . 2009-05-26 22:27 ——– d—–w- c:\program files\Catan GmbH 2009-05-21 22:23 . 2009-05-21 22:23 ——– d—–w- c:\program files\Conduit 2009-05-20 16:15 . 2009-05-03 06:26 ——– d—–w- c:\program files\OpenOffice.org 3 2009-05-20 16:05 . 2009-04-03 17:21 ——– d—–w- c:\programdata\WildTangent 2009-05-19 21:00 . 2009-05-19 21:00 ——– d—–w- c:\programdata\Kaspersky SDK 2009-05-19 20:59 . 2009-04-03 17:20 ——– d—–w- c:\programdata\Trend Micro 2009-05-19 18:25 . 2009-05-19 18:25 ——– d—–w- c:\users\Jackie\AppData\Roaming\#ISW.FS# 2009-05-19 18:25 . 2009-05-19 18:25 ——– d—–w- c:\users\Jackie\AppData\Roaming\CheckPoint 2009-05-19 18:25 . 2009-05-19 18:25 ——– d—–w- c:\users\Jackie\AppData\Roaming\MailFrontier 2009-05-19 17:47 . 2009-05-19 17:47 80 —-a-w- c:\windows\system32\ibfl.dat 2009-05-19 17:47 . 2009-05-19 17:47 144 —-a-w- c:\windows\system32\lkfl.dat 2009-05-19 17:46 . 2009-05-19 17:46 ——– d—–w- c:\program files\CheckPoint 2009-05-19 17:45 . 2009-05-19 17:45 ——– d—–w- c:\program files\Zone Labs 2009-05-19 17:43 . 2009-05-19 17:43 ——– d—–w- c:\programdata\CheckPoint 2009-05-15 21:11 . 2009-05-15 21:11 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll 2009-05-15 01:38 . 2009-05-15 01:38 ——– d—–w- c:\users\Jackie\AppData\Roaming\Template 2009-05-14 15:38 . 2009-05-14 08:48 ——– d—–w- c:\program files\Common Files\Apple 2009-05-14 14:56 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail 2009-05-14 08:50 . 2009-05-14 08:50 ——– d—–w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-05-14 08:50 . 2009-04-28 04:09 ——– d—–w- c:\programdata\Apple Computer 2009-05-14 08:49 . 2009-05-14 08:49 ——– d—–w- c:\program files\Bonjour 2009-05-14 05:44 . 2009-05-03 06:36 1 —-a-w- c:\users\Jackie\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2009-05-14 02:17 . 2009-05-28 04:17 22016 —-a-w- c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\extensions\[removed]\components\firetray.dll 2009-05-12 07:09 . 2009-05-12 07:09 529 —-a-w- c:\windows\eReg.dat 2009-05-12 07:09 . 2009-05-12 07:09 ——– d—–w- c:\program files\Maxis 2009-05-11 07:56 . 2009-05-11 07:56 ——– d—–w- c:\program files\Common Files\Adobe AIR 2009-05-11 07:45 . 2009-05-11 07:45 ——– d—–w- c:\users\Jackie\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 2009-05-05 23:21 . 2009-05-05 23:21 656 —ha-w- C:\os848618.bin 2009-05-04 21:35 . 2009-05-04 21:35 10134 —-a-r- c:\users\Jackie\AppData\Roaming\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe 2009-05-04 18:52 . 2009-05-04 18:52 652296 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2009-05-03 14:55 . 2009-04-26 00:59 69976 —-a-w- c:\users\Jackie\AppData\Local\GDIPFONTCACHEV1.DAT 2009-05-02 19:01 . 2009-05-02 19:01 56 —ha-w- c:\programdata\ezsidmv.dat 2009-04-24 16:05 . 2009-06-11 05:29 827904 —-a-w- c:\windows\system32\wininet.dll 2009-04-24 16:02 . 2009-06-11 05:29 78336 —-a-w- c:\windows\system32\ieencode.dll 2009-04-24 13:44 . 2009-06-11 05:29 26624 —-a-w- c:\windows\system32\ieUnatt.exe 2009-04-23 12:43 . 2009-06-11 05:29 784896 —-a-w- c:\windows\system32\rpcrt4.dll 2009-04-23 12:42 . 2009-06-11 05:29 636928 —-a-w- c:\windows\system32\localspl.dll 2009-04-21 11:55 . 2009-06-11 05:29 2033152 —-a-w- c:\windows\system32\win32k.sys 2009-04-15 20:24 . 2009-04-15 20:24 90112 —-a-w- c:\windows\system32\dpl100.dll 2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx0c.dll 2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx07.dll 2009-04-15 20:24 . 2009-04-15 20:24 815104 —-a-w- c:\windows\system32\divx_xx0a.dll 2009-04-15 20:24 . 2009-04-15 20:24 802816 —-a-w- c:\windows\system32\divx_xx11.dll 2009-04-15 20:24 . 2009-04-15 20:24 684032 —-a-w- c:\windows\system32\DivX.dll 2009-04-03 19:25 . 2009-04-03 19:20 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "SmartRAM"="c:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" [2009-02-19 202064] "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216] "Google Update"="c:\users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-05-16 133104] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-06-23 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-09-04 200704] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-12-15 483420] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-09 150040] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-09 178712] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-09 154136] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-22 3810304] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712] "dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-10-04 206064] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-04-01 982408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "IObit Security 360"="c:\program files\IObit\IObit Security 360\IStray.exe" [2009-06-08 773392] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ZAFFRegisterTrustChecker"="-s" [X] "ZAFFRegisterTrustCheckerIE"="-s" [X] c:\users\Jackie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-23 1295656] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 19:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{4BCCFF00-9BA7-41BE-A19F-9541F8B4B8A9}"= c:\program files\CyberLink\PowerDVD DX\PowerDVD.exe:CyberLink PowerDVD DX "{7113B104-5932-4B2A-82F5-455A1A50EE6C}"= c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe:CyberLink PowerDVD DX Resident Program "{39B30ED7-4A55-4D0F-9445-706D561EC74D}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{41A4ACD8-0216-4A87-A253-015D48E27241}"= c:\program files\Skype\Phone\Skype.exe:Skype "{D57A9AE1-4F0E-4A85-8924-87BB7E678239}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{00DC4CE9-E72C-4A8C-AF4F-71AD3968D196}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{A40C5376-D480-45C2-83A4-B9ACCF0600D7}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{A05CE76E-E27B-4388-AA0F-C4F4234B3301}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{48A8B1C8-AC7E-4994-9F52-179A83CCEDF8}"= UDP:c:\windows\System32\ZoneLabs\vsmon.exe:TrueVector Service "{818006AE-1DE8-4624-AFEB-10546CB1E3D5}"= TCP:c:\windows\System32\ZoneLabs\vsmon.exe:TrueVector Service "{DD383DDC-581B-4AB0-B565-44BF8AB706B1}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{655CB3F8-DDBA-4DBD-9C21-37767892E660}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 11:01 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 11:01 AM 72944] R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\AEstSrv.exe [4/3/2009 12:46 PM 81920] R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [9/23/2008 8:09 PM 155648] R2 ISWKL;ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2/12/2009 3:12 AM 21136] R2 IswSvc;ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [2/12/2009 3:12 AM 394632] R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc –> RUNDLL32.EXE ykx32coinst,serviceStartProc [?] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 11:01 AM 7408] S2 gupdate1c9faf61065dde0;Google Update Service (gupdate1c9faf61065dde0);c:\program files\Google\Update\GoogleUpdate.exe [7/2/2009 2:18 AM 133104] S3 ISservice;ISservice;c:\program files\IObit\IObit Security 360\ISsrv.exe [6/10/2009 8:49 AM 214800] . Contents of the 'Scheduled Tasks' folder 2009-07-09 c:\windows\Tasks\AWC Startup.job - c:\program files\IObit\Advanced SystemCare 3\AWC.exe [2009-07-06 16:55] 2009-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 09:18] 2009-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 09:18] 2009-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-783231216-1778500054-4282995654-1000Core.job - c:\users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-16 18:52] 2009-07-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-783231216-1778500054-4282995654-1000UA.job - c:\users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-16 18:52] 2009-07-08 c:\windows\Tasks\SmartDefrag.job - c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-07-08 16:22] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.facebook.com/ mStart Page = hxxp://www.facebook.com/ uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\ FF - prefs.js: browser.startup.homepage - www.facebook.com FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaExtensions.dll FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - component: c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\extensions\{ee1a404c-5714-451f-9365-a94936993d19}\components\FFAlert.dll FF - component: c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\extensions\[removed]\components\firetray.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\kSolo\npAVX.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: c:\users\Jackie\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll —- FIREFOX POLICIES —- FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: browser.chrome.favicons - fales FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autofill - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 750000 FF - user.js: content.notify.ontimer - true FF - user.js: content.switch.threshold - 750000 FF - user.js: google.toolbar.linkdoctor.enabled - false FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.firstrequest - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: nglayout.initialpaint.delay - 0 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'lsass.exe'(612) c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll c:\program files\CheckPoint\ZAForceField\AK\icsak.dll - - - - - - - > 'Explorer.exe'(5784) c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll c:\program files\CheckPoint\ZAForceField\AK\icsak.dll . Completion time: 2009-07-09 21:44 ComboFix-quarantined-files.txt 2009-07-09 04:44 Pre-Run: 95,377,891,328 bytes free Post-Run: 95,430,615,040 bytes free Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6 290 — E O F — 2009-07-06 20:12

CatByte

Post #6July 9, 2009, 7:19 AM UTC

Hi,

From what I can find out, the messages appear to be from your Zone Alarm program. There may be a conflict with one your other programs or the installation has become corrupted.

You may want to consider uninstalling then reinstalling this software.

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::

file::
c:\windows\Internet Logs\vsmon_2nd_2009_07_08_10_18_32_small.dmp.zip
c:\windows\Internet Logs\xDB4C9C.tmp
c:\windows\Internet Logs\xDBA90C.tmp
c:\windows\Internet Logs\xDB5E37.tmp
c:\windows\Internet Logs\vsmon_2nd_2009_06_24_02_18_01_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_21_03_11_33_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_18_21_40_12_small.dmp.zip
c:\windows\Internet Logs\xDBA610.tmp
c:\windows\Internet Logs\vsmon_2nd_2009_06_15_08_23_57_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_14_18_10_19_full.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_14_14_21_55_small.dmp.zip
c:\windows\Internet Logs\xDB895C.tmp
c:\windows\Internet Logs\xDB8B02.tmp
c:\windows\Internet Logs\vsmon_2nd_2009_06_14_13_56_56_small.dmp.zip
c:\windows\Internet Logs\xDB4490.tmp
c:\windows\Internet Logs\vsmon_2nd_2009_06_13_00_17_18_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_11_19_36_03_small.dmp.zip
c:\windows\Internet Logs\xDB7081.tmp
c:\windows\Internet Logs\xDB6FC4.tmp
c:\windows\Internet Logs\xDB6308.tmp
c:\windows\Internet Logs\xDB67B9.tmp

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Please advise how your computer is running now and what issues still remain.

sirens007

Post #7July 9, 2009, 9:45 AM UTC

I did exactly as you directed. The pop-ups were still appearing up until the scan officially started. After the scan finished, the pop-ups still haven't appeared and I haven't been bugged by one yet. I didn't have to reboot my computer and I put my anti-virus and anti-spyware back on. So far… no pop-ups. Do you think I may be in the clear? Here is my log:

ComboFix 09-07-08.06 - Jackie 07/09/2009 2:30.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3034.2124 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\users\Jackie\Documents\CFScript.txt
AV: ZoneAlarm Extreme Security Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Extreme Security Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: ZoneAlarm Extreme Security Anti-Spyware *disabled* (Updated) {F245A209-1085-48B4-B927-35D56015EC60}

FILE ::
"c:\windows\Internet Logs\vsmon_2nd_2009_06_11_19_36_03_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_13_00_17_18_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_14_13_56_56_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_14_14_21_55_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_14_18_10_19_full.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_15_08_23_57_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_18_21_40_12_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_21_03_11_33_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_06_24_02_18_01_small.dmp.zip"
"c:\windows\Internet Logs\vsmon_2nd_2009_07_08_10_18_32_small.dmp.zip"
"c:\windows\Internet Logs\xDB4490.tmp"
"c:\windows\Internet Logs\xDB4C9C.tmp"
"c:\windows\Internet Logs\xDB5E37.tmp"
"c:\windows\Internet Logs\xDB6308.tmp"
"c:\windows\Internet Logs\xDB67B9.tmp"
"c:\windows\Internet Logs\xDB6FC4.tmp"
"c:\windows\Internet Logs\xDB7081.tmp"
"c:\windows\Internet Logs\xDB895C.tmp"
"c:\windows\Internet Logs\xDB8B02.tmp"
"c:\windows\Internet Logs\xDBA610.tmp"
"c:\windows\Internet Logs\xDBA90C.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Internet Logs\vsmon_2nd_2009_06_11_19_36_03_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_13_00_17_18_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_14_13_56_56_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_14_14_21_55_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_14_18_10_19_full.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_15_08_23_57_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_18_21_40_12_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_21_03_11_33_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_06_24_02_18_01_small.dmp.zip
c:\windows\Internet Logs\vsmon_2nd_2009_07_08_10_18_32_small.dmp.zip
c:\windows\Internet Logs\xDB4490.tmp
c:\windows\Internet Logs\xDB4C9C.tmp
c:\windows\Internet Logs\xDB5E37.tmp
c:\windows\Internet Logs\xDB6308.tmp
c:\windows\Internet Logs\xDB67B9.tmp
c:\windows\Internet Logs\xDB6FC4.tmp
c:\windows\Internet Logs\xDB7081.tmp
c:\windows\Internet Logs\xDB895C.tmp
c:\windows\Internet Logs\xDB8B02.tmp
c:\windows\Internet Logs\xDBA610.tmp
c:\windows\Internet Logs\xDBA90C.tmp

.
((((((((((((((((((((((((( Files Created from 2009-06-09 to 2009-07-09 )))))))))))))))))))))))))))))))
.

2009-07-09 04:22 . 2009-07-09 04:22 ——– d—–w- c:\users\Jackie\AppData\Roaming\vlc
2009-07-08 23:32 . 2009-07-08 23:32 ——– d—–w- c:\program files\Mozilla ActiveX Control v1.7.12
2009-07-08 16:28 . 2009-07-08 16:28 ——– d—–w- c:\users\Jackie\AppData\Roaming\Malwarebytes
2009-07-08 16:28 . 2009-06-17 18:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-08 16:28 . 2009-07-08 16:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-08 16:28 . 2009-07-08 16:28 ——– d—–w- c:\programdata\Malwarebytes
2009-07-08 16:28 . 2009-06-17 18:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-08 07:55 . 2009-07-08 07:55 ——– d—–w- C:\rsit
2009-07-08 06:06 . 2009-07-09 08:42 117760 —-a-w- c:\users\Jackie\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-08 06:06 . 2009-07-08 06:06 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2009-07-08 06:05 . 2009-07-08 06:05 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-08 06:05 . 2009-07-08 06:05 ——– d—–w- c:\users\Jackie\AppData\Roaming\SUPERAntiSpyware.com
2009-07-08 06:05 . 2009-07-08 06:05 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-03 08:32 . 2009-07-03 08:47 ——– d—–w- c:\users\Jackie\AppData\Local\Microsoft Games
2009-07-02 09:17 . 2009-07-08 15:42 ——– d—–w- c:\program files\Google
2009-06-28 08:44 . 2009-06-28 08:44 746744 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-06-27 16:04 . 2009-07-08 07:55 ——– d—–w- c:\program files\Trend Micro
2009-06-24 21:37 . 2009-06-24 21:37 ——– d—–w- c:\users\Jackie\AppData\Local\Yahoo
2009-06-24 21:36 . 2009-06-24 21:36 ——– d—–w- c:\users\Jackie\AppData\Roaming\Yahoo!
2009-06-24 21:35 . 2009-06-24 21:37 ——– d—–w- c:\programdata\Yahoo!
2009-06-24 21:35 . 2009-05-27 02:50 607472 —-a-w- c:\programdata\Yahoo!\YUpdater\yupdater.exe
2009-06-24 21:35 . 2009-06-29 16:04 ——– d—–w- c:\program files\Yahoo!
2009-06-22 23:04 . 2009-06-22 23:04 ——– d—–w- c:\users\Jackie\AppData\Roaming\PeerNetworking
2009-06-22 06:33 . 2009-07-09 03:43 ——– d—–w- c:\users\Jackie\AppData\Roaming\dvdcss
2009-06-14 20:59 . 2009-04-30 12:19 293376 —-a-w- c:\windows\system32\psisdecd.dll
2009-06-14 20:59 . 2009-04-30 12:19 428544 —-a-w- c:\windows\system32\EncDec.dll
2009-06-14 07:52 . 2009-06-14 07:52 ——– d—–w- C:\Graboid
2009-06-14 07:37 . 2009-07-08 23:16 ——– d—–w- c:\users\Jackie\AppData\Local\Graboid_Inc
2009-06-14 07:37 . 2009-06-14 07:52 ——– d—–w- c:\users\Jackie\AppData\Local\Graboid
2009-06-14 07:37 . 2009-06-14 07:38 ——– d—–w- c:\users\Jackie\AppData\Roaming\MozillaControl
2009-06-14 07:37 . 2009-07-08 23:32 ——– d—–w- c:\program files\VideoLAN
2009-06-14 07:36 . 2009-07-08 23:32 ——– d—–w- c:\program files\Graboid
2009-06-10 15:49 . 2009-06-10 15:49 ——– d—–w- c:\programdata\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-09 08:42 . 2009-05-19 17:47 144 —-a-w- c:\windows\system32\pdfl.dat
2009-07-09 08:41 . 2009-05-19 17:45 351219 —ha-w- c:\windows\system32\drivers\vsconfig.xml
2009-07-09 05:06 . 2009-05-19 17:55 2049992 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-09 05:06 . 2009-05-19 17:55 157115424 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-08 21:38 . 2009-05-02 19:00 ——– d—–w- c:\users\Jackie\AppData\Roaming\Skype
2009-07-07 19:56 . 2009-05-02 19:01 ——– d—–w- c:\users\Jackie\AppData\Roaming\skypePM
2009-07-02 00:36 . 2009-05-15 01:38 730 —-a-w- c:\users\Jackie\AppData\Roaming\wklnhst.dat
2009-06-29 10:14 . 2009-04-28 02:58 ——– d—–w- c:\program files\DivX
2009-06-17 06:05 . 2009-05-14 08:51 ——– d—–w- c:\users\Jackie\AppData\Roaming\Apple Computer
2009-06-11 10:04 . 2009-04-03 17:16 ——– d—–w- c:\program files\Microsoft Works
2009-06-10 17:08 . 2009-05-21 22:37 ——– d—–w- c:\program files\Winamp
2009-06-10 16:52 . 2009-04-03 17:15 ——– d—–w- c:\program files\Common Files\Adobe
2009-06-10 15:49 . 2009-04-29 14:24 ——– d—–w- c:\program files\IObit
2009-06-08 16:34 . 2009-05-21 21:39 ——– d—–w- c:\users\Jackie\AppData\Roaming\LimeWire
2009-06-06 22:06 . 2009-06-06 22:06 680 —-a-w- c:\users\Jackie\AppData\Local\d3d9caps.dat
2009-05-26 22:27 . 2009-05-26 22:27 ——– d—–w- c:\program files\Catan GmbH
2009-05-21 22:23 . 2009-05-21 22:23 ——– d—–w- c:\program files\Conduit
2009-05-20 16:15 . 2009-05-03 06:26 ——– d—–w- c:\program files\OpenOffice.org 3
2009-05-20 16:05 . 2009-04-03 17:21 ——– d—–w- c:\programdata\WildTangent
2009-05-19 21:00 . 2009-05-19 21:00 ——– d—–w- c:\programdata\Kaspersky SDK
2009-05-19 20:59 . 2009-04-03 17:20 ——– d—–w- c:\programdata\Trend Micro
2009-05-19 18:25 . 2009-05-19 18:25 ——– d—–w- c:\users\Jackie\AppData\Roaming\#ISW.FS#
2009-05-19 18:25 . 2009-05-19 18:25 ——– d—–w- c:\users\Jackie\AppData\Roaming\CheckPoint
2009-05-19 18:25 . 2009-05-19 18:25 ——– d—–w- c:\users\Jackie\AppData\Roaming\MailFrontier
2009-05-19 17:47 . 2009-05-19 17:47 80 —-a-w- c:\windows\system32\ibfl.dat
2009-05-19 17:47 . 2009-05-19 17:47 144 —-a-w- c:\windows\system32\lkfl.dat
2009-05-19 17:46 . 2009-05-19 17:46 ——– d—–w- c:\program files\CheckPoint
2009-05-19 17:45 . 2009-05-19 17:45 ——– d—–w- c:\program files\Zone Labs
2009-05-19 17:43 . 2009-05-19 17:43 ——– d—–w- c:\programdata\CheckPoint
2009-05-15 21:11 . 2009-05-15 21:11 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2009-05-15 01:38 . 2009-05-15 01:38 ——– d—–w- c:\users\Jackie\AppData\Roaming\Template
2009-05-14 15:38 . 2009-05-14 08:48 ——– d—–w- c:\program files\Common Files\Apple
2009-05-14 14:56 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-05-14 08:50 . 2009-05-14 08:50 ——– d—–w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-14 08:50 . 2009-04-28 04:09 ——– d—–w- c:\programdata\Apple Computer
2009-05-14 08:49 . 2009-05-14 08:49 ——– d—–w- c:\program files\Bonjour
2009-05-14 05:44 . 2009-05-03 06:36 1 —-a-w- c:\users\Jackie\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-05-14 02:17 . 2009-05-28 04:17 22016 —-a-w- c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\extensions\[removed]\components\firetray.dll
2009-05-12 07:09 . 2009-05-12 07:09 529 —-a-w- c:\windows\eReg.dat
2009-05-12 07:09 . 2009-05-12 07:09 ——– d—–w- c:\program files\Maxis
2009-05-11 07:56 . 2009-05-11 07:56 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-05-11 07:45 . 2009-05-11 07:45 ——– d—–w- c:\users\Jackie\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-05-05 23:21 . 2009-05-05 23:21 656 —ha-w- C:\os848618.bin
2009-05-04 21:35 . 2009-05-04 21:35 10134 —-a-r- c:\users\Jackie\AppData\Roaming\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe
2009-05-04 18:52 . 2009-05-04 18:52 652296 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2009-05-03 14:55 . 2009-04-26 00:59 69976 —-a-w- c:\users\Jackie\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-02 19:01 . 2009-05-02 19:01 56 —ha-w- c:\programdata\ezsidmv.dat
2009-04-24 16:05 . 2009-06-11 05:29 827904 —-a-w- c:\windows\system32\wininet.dll
2009-04-24 16:02 . 2009-06-11 05:29 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-24 13:44 . 2009-06-11 05:29 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2009-04-23 12:43 . 2009-06-11 05:29 784896 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 05:29 636928 —-a-w- c:\windows\system32\localspl.dll
2009-04-21 11:55 . 2009-06-11 05:29 2033152 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 20:24 . 2009-04-15 20:24 90112 —-a-w- c:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24 823296 —-a-w- c:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24 815104 —-a-w- c:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24 802816 —-a-w- c:\windows\system32\divx_xx11.dll
2009-04-15 20:24 . 2009-04-15 20:24 684032 —-a-w- c:\windows\system32\DivX.dll
2009-04-03 19:25 . 2009-04-03 19:20 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-07-09_04.42.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-07-09 08:43 47944 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-07-09 08:43 64764 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-02-03 15:16 . 2009-07-09 08:47 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-02-03 15:16 . 2009-07-09 03:43 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-02-03 15:16 . 2009-07-09 08:47 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-02-03 15:16 . 2009-07-09 03:43 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-02-03 15:16 . 2009-07-09 03:43 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-02-03 15:16 . 2009-07-09 08:47 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-04-26 01:00 . 2009-07-09 04:53 6662 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-783231216-1778500054-4282995654-1000_UserData.bin
+ 2009-07-09 08:41 . 2009-07-09 08:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-07-08 16:18 . 2009-07-09 03:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-07-08 16:18 . 2009-07-09 03:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-09 08:41 . 2009-07-09 08:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-05-19 21:00 . 2009-07-09 09:27 647120 c:\windows\System32\ZoneLabs\avsys\bases\sfdb.dat
- 2006-11-02 10:33 . 2009-07-09 03:45 595684 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-07-09 08:47 595684 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-07-09 03:45 101350 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-07-09 08:47 101350 c:\windows\System32\perfc009.dat
+ 2009-05-19 17:46 . 2009-07-09 08:48 12895393 c:\windows\System32\ZoneLabs\spyware.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"SmartRAM"="c:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" [2009-02-19 202064]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"Google Update"="c:\users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-05-16 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-06-23 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-09-04 200704]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-12-15 483420]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-09 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-09 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-09 154136]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-22 3810304]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-10-04 206064]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-04-01 982408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IStray.exe" [2009-06-08 773392]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ZAFFRegisterTrustChecker"="-s" [X]
"ZAFFRegisterTrustCheckerIE"="-s" [X]

c:\users\Jackie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-23 1295656]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{4BCCFF00-9BA7-41BE-A19F-9541F8B4B8A9}"= c:\program files\CyberLink\PowerDVD DX\PowerDVD.exe:CyberLink PowerDVD DX
"{7113B104-5932-4B2A-82F5-455A1A50EE6C}"= c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe:CyberLink PowerDVD DX Resident Program
"{39B30ED7-4A55-4D0F-9445-706D561EC74D}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{41A4ACD8-0216-4A87-A253-015D48E27241}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D57A9AE1-4F0E-4A85-8924-87BB7E678239}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{00DC4CE9-E72C-4A8C-AF4F-71AD3968D196}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{A40C5376-D480-45C2-83A4-B9ACCF0600D7}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{A05CE76E-E27B-4388-AA0F-C4F4234B3301}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{48A8B1C8-AC7E-4994-9F52-179A83CCEDF8}"= UDP:c:\windows\System32\ZoneLabs\vsmon.exe:TrueVector Service
"{818006AE-1DE8-4624-AFEB-10546CB1E3D5}"= TCP:c:\windows\System32\ZoneLabs\vsmon.exe:TrueVector Service
"{DD383DDC-581B-4AB0-B565-44BF8AB706B1}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{655CB3F8-DDBA-4DBD-9C21-37767892E660}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 11:01 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 11:01 AM 72944]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_ae0b52e0\AEstSrv.exe [4/3/2009 12:46 PM 81920]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [9/23/2008 8:09 PM 155648]
R2 ISWKL;ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2/12/2009 3:12 AM 21136]
R2 IswSvc;ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [2/12/2009 3:12 AM 394632]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 11:01 AM 7408]
S2 gupdate1c9faf61065dde0;Google Update Service (gupdate1c9faf61065dde0);c:\program files\Google\Update\GoogleUpdate.exe [7/2/2009 2:18 AM 133104]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc –> RUNDLL32.EXE ykx32coinst,serviceStartProc [?]
S3 ISservice;ISservice;c:\program files\IObit\IObit Security 360\ISsrv.exe [6/10/2009 8:49 AM 214800]
.
Contents of the 'Scheduled Tasks' folder

2009-07-09 c:\windows\Tasks\AWC Startup.job
- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [2009-07-06 16:55]

2009-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 09:18]

2009-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 09:18]

2009-07-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-783231216-1778500054-4282995654-1000Core.job
- c:\users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-16 18:52]

2009-07-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-783231216-1778500054-4282995654-1000UA.job
- c:\users\Jackie\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-16 18:52]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.facebook.com/
mStart Page = hxxp://www.facebook.com/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\
FF - prefs.js: browser.startup.homepage - www.facebook.com
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaExtensions.dll
FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\extensions\{ee1a404c-5714-451f-9365-a94936993d19}\components\FFAlert.dll
FF - component: c:\users\Jackie\AppData\Roaming\Mozilla\Firefox\Profiles\9w4o7f0d.default\extensions\[removed]\components\firetray.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\kSolo\npAVX.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Jackie\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: google.toolbar.linkdoctor.enabled - false
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-09 02:34
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(624)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
.
Completion time: 2009-07-09 2:36
ComboFix-quarantined-files.txt 2009-07-09 09:36
ComboFix2.txt 2009-07-09 04:44

Pre-Run: 95,325,458,432 bytes free
Post-Run: 95,303,401,472 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
332 — E O F — 2009-07-06 20:12

sirens007

Post #8July 9, 2009, 10:02 AM UTC

On a sad note: I tried to open some programs that would cause the pop-ups to become more aggressive. One such program was my Google Chrome. As soon as I tried to open the application, the pop-ups came back in twenties instead of fives. I rebooted my computer, and as soon as my desktop loaded… the pop-ups appeared (fives only). One other program that was being affected was my graboid video. Sure enough, after clicking on it, the pop-ups reappeared. They are not gone yet. They are not as aggressive but they are not gone. :-(

CatByte

Post #9July 9, 2009, 12:30 PM UTC

can you please describe what these popups are:

what are the messages.

the initial ones from your first post indicated an issue with zone alarm. Are these different.

Please do the following:

Please download HostsXpert

Unzip HostsXpert to it's own folder in a convenient place such as C:\HostsXpert
Run: HostsXpert.exe
Click: Make Writable? in the upper left corner.
Click: Restore MS Hosts File
Click: Replace
Click: OK
Click: Make ReadOnly
Close HostsXpert.

NEXT

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Ensure all Firefox windows are closed.
To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
When prompted to run the scan, click Yes.
GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

sirens007

Post #10July 10, 2009, 2:21 AM UTC

I was able to do what you directed concerning HostsXpert… but when it came to GooredFix, I only got as far as the beginning of the scan and then the program stops working. I tried the better part of the day and it still wouldn't do it. The pop-ups remain saying the same thing as I mentioned at the beginning, only that in the header, instead of it saying ForceField.exe - Bad Image it might say GoogleUpdate - Bad Image or Graboid.exe - Bad Image… and a hosts of others. Secondly, since you think it might be the Zone Alarm affecting it. I removed Zone Alarm and instead installed AVG for now to see if the problem would disappear. The pop-ups are still there.

CatByte

Post #11July 10, 2009, 2:33 AM UTC

OK

Please delete the copy of ComboFix that you have on your desktop - download the latest version from either of the links provided below and run the program again>

Be sure to disable your antivirus prior to running.

Did you get any kind of message with GooredFix?

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

sirens007

Post #12July 11, 2009, 7:49 AM UTC

I did as you asked, unfortunately it still won't scan. Nothing appears, no pop-ups telling me the program has stopped working, and no screen to indicate it is scanning either. The annoying pop-ups are still at it and they are casually random as usual. What do you think I should do next?

CatByte

Post #13July 11, 2009, 11:25 AM UTC last edited July 11, 2009, 11:26 AM UTC

If you are using Firefox, make sure that your download settings are as follows:
Tools->Options->Main tab
Set to "Always ask me where to Save the files".

It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

Press the windows key + R to open a run box
Copy/paste this command (with quotation marks) "%userprofile%/Desktop/Combo-Fix.exe" /killall into the run box
Press OK to start ComboFix
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

———————————————————–
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

———————————————————–

If this still will not work - try it in safe mode.

To Enter Safemode

Go to Start> Shut off your Computer> Restart
As the computer starts to boot-up, Tap the F8 KEY repeatedly,
this will bring up a menu.
Use the Up and Down Arrow Keys to scroll up to Safemode
Then press the Enter Key on your Keyboard
go into your usual account

CatByte

Post #14July 16, 2009, 3:48 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Annoying pop-up won't go away

✨ Ask AI

Ask AI