In the last post you had asked:
BRAMSDELL,
Rooter is a tool I had asked you to run:
Download
Rooter.exe to your desktop
Then doubleclick it to start the tool A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here
Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully …
.
Windows XP Home Edition (5.1.2600) Service Pack 3
[32_bits] - x86 Family 6 Model 8 Stepping 0, AuthenticAMD
.
[wscsvc] (Security Center) RUNNING (state:4)
[SharedAccess] RUNNING (state:4)
Windows Firewall -> Enabled
.
Internet Explorer 8.0.6001.18702
Mozilla Firefox 3.0.10 (en-US)
.
A:\ [Removable]
C:\ [Fixed-NTFS] .. ( Total:149 Go - Free:97 Go )
D:\ [CD_Rom]
E:\ [CD_Rom]
G:\ [Removable]
H:\ [Removable]
I:\ [Removable]
J:\ [Removable]
.
Scan : 13:34.15
Path : C:\Documents and Settings\Owner\My Documents\Downloads\Rooter.exe
User : Owner ( Administrator -> YES )
.
———————-\\ Processes
.
Locked [System Process] (0)
______ System (4)
______ \SystemRoot\System32\smss.exe (588)
______ \??\C:\WINDOWS\system32\csrss.exe (660)
______ \??\C:\WINDOWS\system32\winlogon.exe (684)
______ C:\WINDOWS\system32\services.exe (728)
______ C:\WINDOWS\system32\lsass.exe (740)
______ C:\WINDOWS\system32\svchost.exe (896)
______ C:\WINDOWS\system32\svchost.exe (952)
______ C:\WINDOWS\System32\svchost.exe (1044)
______ C:\WINDOWS\system32\svchost.exe (1084)
______ C:\WINDOWS\system32\svchost.exe (1264)
______ C:\WINDOWS\system32\svchost.exe (1420)
______ C:\WINDOWS\Explorer.EXE (1624)
______ C:\WINDOWS\system32\spoolsv.exe (1724)
______ C:\Program Files\QuickTime\qttask.exe (1952)
______ C:\Program Files\McAfee\Common Framework\udaterui.exe (1968)
______ C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (1976)
______ C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (2004)
______ C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (2012)
______ C:\Program Files\Java\jre6\bin\jusched.exe (2028)
______ C:\WINDOWS\system32\ctfmon.exe (168)
______ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (216)
______ C:\Program Files\TomTom HOME 2\HOMERunner.exe (240)
______ C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (224)
______ C:\WINDOWS\system32\svchost.exe (560)
______ C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (624)
______ C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe (640)
______ C:\Program Files\Java\jre6\bin\jqs.exe (992)
______ C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe (1020)
______ C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe (1152)
______ C:\Program Files\McAfee\Common Framework\FrameworkService.exe (776)
______ C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (1356)
______ C:\WINDOWS\system32\mfevtps.exe (1172)
______ C:\Program Files\McAfee\Common Framework\naPrdMgr.exe (1592)
______ C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (1440)
______ C:\WINDOWS\system32\HPZipm12.exe (1936)
______ C:\Program Files\McAfee\Common Framework\McTray.exe (2056)
______ C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (2104)
______ C:\WINDOWS\system32\slserv.exe (2192)
______ C:\WINDOWS\system32\svchost.exe (2232)
______ C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (2296)
______ C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe (2388)
______ C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (2960)
______ C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (3252)
______ C:\WINDOWS\System32\alg.exe (3516)
______ C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (3276)
______ C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (156)
______ C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (1328)
______ C:\Documents and Settings\Owner\My Documents\Downloads\Rooter.exe (3644)
.
———————-\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:32256 | Length:160031015424)
.
———————-\\ Scheduled Tasks
.
C:\WINDOWS\Tasks\desktop.ini
C:\WINDOWS\Tasks\Google Software Updater.job
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-602162358-682003330-1003Core.job
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-602162358-682003330-1003UA.job
C:\WINDOWS\Tasks\Norton Security Scan.job
C:\WINDOWS\Tasks\SA.DAT
.
———————-\\ Registry
.
.
———————-\\ Files & Folders
.
———————-\\ Scan completed at 13:34.42
.
C:\Rooter$\Rooter_1.txt - (26/07/2009 | 13:34.42)
BRAMSDELL,
I'm not seeing the problem. Let's get a deeper scan.
Please download DDS by sUBs from one of the following links and save it to your desktop.
Disable any script blocking protection (How to Disable your Security Programs ) Double click DDS icon to run the tool (may take up to 3 minutes to run) When done, DDS.txt will open. After a few moments, attach.txt will open in a second window. Save both reports to your desktop. —————————————————
Post DDS.txt report in your next replyAttach Attach.txt Attachments area and then clicking Browse . Browse to where you saved the file, and click Open and the click UPLOAD .
Ver_09-06-26.01) - NTFSx86
Run by [removed] at 21:03:26.85 on Mon 07/27/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.63 [GMT -4:00]
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
svchost.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\My Documents\Downloads\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.myspace.com/
uInternet Connection Wizard,ShellNext = iexplore
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {0EA5B5F4-8567-44C3-8C44-394EBC33C63F} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptsn.dll
BHO: {A87383E8-2E11-41E4-9E84-CC5926832665} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {F5640306-5124-4114-A970-B9C31018827D} - No File
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
TB: Foxit Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: Groove Folder Synchronization: {2a541ae1-5bf6-4665-a8a3-cfa9672e4291} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\HOMERunner.exe"
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMBgMonitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [VTTimer] VTTimer.exe
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\udaterui.exe" /StartedFromRunKey
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert link target to existing PDF
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {95D88B35-A521-472B-A182-BB1A98356421} - hxxp://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} - hxxp://asp.mathxl.com/books/_Players/MathPlayer.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\zim92s92.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=
FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\zim92s92.default\extensions\{463f6ca5-ee3c-4be1-b7e6-7fee11953374}\platform\winnt\components\FoxyTunes.dll
FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\zim92s92.default\extensions\[removed]\components\coolirisstub.dll
FF - component: c:\program files\mozilla firefox\components\Scriptff.dll
FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
============= SERVICES / DRIVERS ===============
P2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2008-9-29 143088]
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-2-17 340592]
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2008-12-1 4064]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\mcafee\virusscan enterprise\EngineServer.exe [2008-9-29 19456]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2008-3-14 103744]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2008-9-29 62800]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2009-2-17 67904]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-2-17 90360]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-2-17 42424]
S3 1001;Siemens SpeedStream USB 10/100 Ethernet Adapter;c:\windows\system32\drivers\1001.SYS [2006-4-3 24114]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2009-2-17 64432]
S3 V90drv;v90drv;c:\windows\system32\drivers\v90drv.sys [2001-11-29 1432836]
=============== Created Last 30 ================
2009-07-26 13:34 –d—– C:\Rooter$
2009-07-20 08:29 –d—– c:\docume~1\alluse~1\applic~1\Wal-Mart
2009-07-20 08:29 –d—– c:\program files\Wal-Mart
2009-07-20 08:29 –d—– c:\docume~1\owner\applic~1\Wal-Mart
2009-07-16 15:46 –d—– C:\_OTM
2009-07-14 12:16 -cd—– c:\windows\system32\dllcache\cache
2009-07-14 11:40 a-dshr– C:\cmdcons
2009-07-14 11:31 219,648 a——- c:\windows\PEV.exe
2009-07-14 11:31 161,792 a——- c:\windows\SWREG.exe
2009-07-14 11:31 98,816 a——- c:\windows\sed.exe
2009-07-12 16:16 –d—– c:\docume~1\owner\applic~1\Malwarebytes
2009-07-12 16:11 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-12 16:11 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-07-12 16:11 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-07-11 22:10 –d—– c:\docume~1\alluse~1\applic~1\NortonInstaller
2009-06-29 08:47 –dsh— c:\documents and settings\owner\PrivacIE
==================== Find3M ====================
2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll
2009-06-03 15:09 1,291,264 a——- c:\windows\system32\quartz.dll
2009-05-13 01:15 915,456 a——- c:\windows\system32\wininet.dll
2009-05-07 11:32 345,600 a——- c:\windows\system32\localspl.dll
2009-05-05 22:37 410,984 a——- c:\windows\system32\deploytk.dll
2008-11-29 21:25 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008112920081130\index.dat
============= FINISH: 21:05:02.34 ===============
BRAMSDELL,
JavaRa …by: Paul McLain and Fred de Vries
Please download
JavaRa (Copyright © 2008 RaProducts.org) and
unzip it to your desktop .
***Please close any instances of Internet Explorer before continuing!*** Double-click on JavaRa.exe to start the program. From the drop-down menu, choose English or the appropriate language…and click on Select . JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer. Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK . A logfile will pop up. Please save it to a convenient location. Copy and paste the contents of the JavaRa log, in your next reply.
Then please post me a new HijackThis log.
JavaRa 1.15 Removal Log.
BRAMSDELL,
Please open HijackThis and run Do a system scan only Check the boxes next to ONLY the entries listed below(if present):O2 - BHO: (no name) - {0EA5B5F4-8567-44C3-8C44-394EBC33C63F} - (no file) Close all programs except for HijackThis. Click on Fix checked A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.
Then let me know how things are running and give me one more HijackThis log please.
Hi TomK
BRAMSDELL,
That's all I see for malware. You should consider updating your firewall. Information can be found in the links at the bottom of this post.
Log looks good
Now to remove most of the tools that we have used in fixing your machine: Make sure you have an Internet Connection. Download OTC A list of tool components used in the cleanup of malware will be downloaded. If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so. Click Yes to begin the cleanup process and remove these components, including this application. You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes. You need to create a new Clean restore point:
Click
Start Menu > Run > copy and paste
%SystemRoot%\System32\restore\rstrui.exe
Press
OK. Choose
Create a Restore Point then click
Next. Name it (something you'll remember) and click
Create , when the confirmation screen shows the restore point has been created click
Close.
Remove all previous Restore Points
Click
Start Menu > Run > copy and paste
cleanmgr
You may be asked to choose drive. Choose C: At top, click on
More Options tab. Click
Clean up… button in the System Restore box. Click on
Yes button. When finished, click on
Cancel button to exit.
Double-click
My Computer .
Click the
Tools menu , and then click
Folder Options .
Click the
View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder,
Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click
Apply , and then click
OK .
The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.
Please take time to read
Preventing Malware - Tools and Practices for Safe Computing . Very important information for your consideration is contained therein.
I would also suggest you read
this:
So how did I get infected in the first place?
by Tony Klein
Also:
"How to prevent malware"
by miekiemoes
Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
