Spyware / Malware / Virus Removal

[Resolved] my windows defender says everything is fine

52 min read

Looking for the outcome? Ask AI

HMH22 Topic Starter

Post #1August 8, 2009, 1:21 AM UTC last edited August 8, 2009, 9:43 AM UTC

Hi, I am having problems with the internet. When I go to put something in the search engine it never goes to where I wanted it to go something will pop-up. I know this is a sign of spyware but, when my windows defender scans my computer it says everything is fine yet, im still having problems. My pop-up blocker is at medium and when i put it on high something still pops-up. I dont know what to do but i did a Hijackthis log and here is the results- P.S. thanks in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:13:55 PM, on 8/7/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Windows\sySTEM32\SvchoSt.ExE
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\FreezeScreenSaver.exe
C:\Windows\system32\svchost.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\iolo\System Shield 3\IoloSGCtrl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Program Files\iWin Games\iWinTrusted.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Norton PC Checkup\executables\mrHealthy\MrHealthy.exe
C:\Program Files\iolo\System Shield 3\SystemGuardAlerter.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Windows\pp10.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\ProgramData\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\WUDFHost.exe
C:\Users\Judy\Documents\RCA Detective\RCADetective.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\iolo\System Shield 3\Personal Firewall\ioloFW.exe
C:\Program Files\iolo\System Shield 3\AntiVirus\ioloAV.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
c:\program files\aol\aim toolbar 5.0\AolTbServer.exe
C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
R3 - URLSearchHook: (no name) - EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - 0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
R3 - URLSearchHook: (no name) - ce0c2586-da36-452b-acdb-320d9bcb19bf} - (no file)
R3 - URLSearchHook: (no name) - 00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (file missing)
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: PCCBHO.CPCCBHO - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - C:\Program Files\Winferno\PC Confidential\PCCBHO.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Accelerator Plugin - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\PROGRA~1\PEOPLE~1\PRPL_I~1.DLL (file missing)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\Program Files\iWin Games\iWinGamesHookIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: iWin Toolbar - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - C:\Program Files\iWin\tbiWi1.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: iWin Toolbar - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - C:\Program Files\iWin\tbiWi1.dll
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [SystemGuardAlerter] C:\Program Files\iolo\System Shield 3\SystemGuardAlerter.exe
O4 - HKLM\..\Run: [iolo Startup] "C:\Program Files\iolo\Common\Lib\ioloLManager.exe"
O4 - HKLM\..\Run: [iolo Personal Firewall] "C:\Program Files\iolo\System Shield 3\Personal Firewall\ioloFW.exe" rstrq
O4 - HKLM\..\Run: [iolo AntiVirus] "C:\Program Files\iolo\System Shield 3\AntiVirus\ioloAV.exe" rstrq
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [sysldtray] c:\windows\ld12.exe
O4 - HKLM\..\Run: [pp] c:\windows\pp10.exe
O4 - HKLM\..\Run: [sysfbtray] c:\windows\freddy56.exe
O4 - HKLM\..\Run: [Sysmstray] c:\windows\mstre19.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [?????????] ??????????????e
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [RegPowerClean] "C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe"
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; FunWebProducts; GTB6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; PeoplePal 6.6; .NET CLR 1.1.4322; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30618)" -"http://edits.zwinky.com/zwinky-world/GamePlayer/play.jhtml?gameID=34"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: IMVU.lnk = C:\Users\Judy\Desktop\IMVU\IMVUClient.exe
O4 - Startup: iWin Desktop Alerts.lnk = C:\ProgramData\iWin Games\DesktopAlerts\DesktopAlerts.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: RCA Detective.lnk = C:\Users\Judy\Documents\RCA Detective\RCADetective.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Gamerlog.lnk = C:\Program Files\GamerLog\GamerLog.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZJxdm035YYUS
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll (file missing)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll (file missing)
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
O9 - Extra 'Tools' menuitem: PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Judy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\iolo\common\firewall\ifw_xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\iolo\common\firewall\ifw_xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\iolo\common\firewall\ifw_xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\iolo\common\firewall\ifw_xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\iolo\common\firewall\ifw_xfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O13 - Gopher Prefix:
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} (ZPA_WheelOfFortune Object) - http://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {C6E9F0B8-AFEA-46F3-831B-612E97381ABA} (imvustreamer Control) - http://www.imvu.com/activex/imvustreamer.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames/Check…PA.cab55579.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: FreezeScreenSaver - Unknown owner - C:\Windows\system32\FreezeScreenSaver.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Update Service (gupdate1c9dd44c9cdecca) (gupdate1c9dd44c9cdecca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo Product Update Service (ioloProductUpdate) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Shield 3\IoloSGCtrl.exe
O23 - Service: iWinTrusted - iWin Inc. - C:\Program Files\iWin Games\iWinTrusted.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MrHealthy (MrHealthyService) - Symantec Corporation - C:\Program Files\Norton PC Checkup\executables\mrHealthy\MrHealthy.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 24013 bytes

Hey, I dont know if this is the spyware but about an hour after i did a Hijackthis log a message came up saying that my computer was on high alert and it would not let me exit out of anything. The program that it said could fix it was Internet Antivirus Pro something (srry, I didnt right it down). I did not hit ok an I tried to cancel it but it would not let me so I just logged off and logged back on to my computer. I hope this helps.

CatByte

Post #2August 8, 2009, 3:24 PM UTC

Hi and Welcome,

NOTE:

Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
Absence of symptoms does not always mean the computer is clean
Kindly follow my instructions in the order posted.
Please DO NOT run any scans or fix items without my direction.

Please do the following:

STEP #1

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

STEP #2

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

HMH22

Post #3August 8, 2009, 8:06 PM UTC

Here is the dds report

DDS (Ver_09-07-30.01) - NTFSx86
Run by [removed] at 15:47:17.24 on Sat 08/08/2009
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.244 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\sySTEM32\SvchoSt.ExE -k browserctl
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
C:\Windows\system32\FreezeScreenSaver.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\iolo\System Shield 3\IoloSGCtrl.exe
C:\Program Files\iWin Games\iWinTrusted.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Norton PC Checkup\executables\mrHealthy\MrHealthy.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iolo\System Shield 3\SystemGuardAlerter.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\pp10.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\ProgramData\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Users\Judy\Documents\RCA Detective\RCADetective.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\iolo\System Shield 3\Personal Firewall\ioloFW.exe
C:\Program Files\iolo\System Shield 3\AntiVirus\ioloAV.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Program Files\MyWebSearch\bar\1.bin\m3IMPipe.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
c:\program files\aol\aim toolbar 5.0\AolTbServer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Judy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPP2FEXA\dds[1].pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uSEARCH PAGE = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uSearch Bar = hxxp://www.yahoo.com/search/ie.html
mStart Page = hxxp://en.us.acer.yahoo.com
mDefault_Page_URL = hxxp://en.us.acer.yahoo.com
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
uURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
mURLSearchHooks: AOLTBSearch Class: {ea756889-2338-43db-8f07-d1ca6fb9c90d} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
mURLSearchHooks: iWin Toolbar: {ce0c2586-da36-452b-acdb-320d9bcb19bf} - c:\program files\iwin\tbiWi1.dll
mURLSearchHooks: H - No File
BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Ask Search Assistant BHO: {0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: mwsBar BHO: {07b18ea1-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: PCCBHO.CPCCBHO: {22fc6ce8-7d47-479f-b74a-bfbb04adb9af} - c:\program files\winferno\pc confidential\PCCBHO.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: Accelerator Plugin: {656ec4b7-072b-4698-b504-2a414c1f0037} - c:\progra~1\people~1\PRPL_I~1.DLL
BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
BHO: IEHlprObj Class: {8ca5ed52-f3fb-4414-a105-2e3491156990} - c:\program files\iwin games\iWinGamesHookIE.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: iWin Toolbar: {ce0c2586-da36-452b-acdb-320d9bcb19bf} - c:\program files\iwin\tbiWi1.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Ask Toolbar BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
TB: Ask Toolbar: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
TB: AIM Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
TB: iWin Toolbar: {ce0c2586-da36-452b-acdb-320d9bcb19bf} - c:\program files\iwin\tbiWi1.dll
TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: SmartShopper: {137e6e5e-a205-4657-a49f-1ab865787089} - c:\program files\smartshopper\bin\2.5.0\SmrtShpr.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [????r]
uRun: [?????????] ??????????????e
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_0_0
uRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -startup
uRun: [RegPowerClean] "c:\program files\winferno\registrypowercleaner\RegPowerClean.exe"
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~3.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; FunWebProducts; GTB6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; PeoplePal 6.6; .NET CLR 1.1.4322; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30618)" -"http://edits.zwinky.com/zwinky-world/GamePlayer/play.jhtml?gameID=34"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Acer Tour]
mRun: [Acer Empowering Technology Monitor] c:\windows\system32\SysMonitor.exe
mRun: [Acer Product Registration] "c:\program files\acer registration\ACE1.exe" /startup
mRun: [Acer Assist Launcher] c:\program files\acer assist\launcher.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [eRecoveryService]
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [SystemGuardAlerter] c:\program files\iolo\system shield 3\SystemGuardAlerter.exe
mRun: [iolo Startup] "c:\program files\iolo\common\lib\ioloLManager.exe"
mRun: [iolo Personal Firewall] "c:\program files\iolo\system shield 3\personal firewall\ioloFW.exe" rstrq
mRun: [iolo AntiVirus] "c:\program files\iolo\system shield 3\antivirus\ioloAV.exe" rstrq
mRun: [MyWebSearch Plugin] rundll32 c:\progra~1\mywebs~1\bar\1.bin\M3PLUGIN.DLL,UPF
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [sysldtray] c:\windows\ld12.exe
mRun: [pp] c:\windows\pp10.exe
mRun: [sysfbtray] c:\windows\freddy56.exe
mRun: [Sysmstray] c:\windows\mstre19.exe
mRun: [My Web Search Bar Search Scope Monitor] "c:\progra~1\mywebs~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\users\judy\appdata\roaming\micros~1\windows\startm~1\programs\startup\imvu.lnk - c:\users\judy\desktop\imvu\IMVUClient.exe
StartupFolder: c:\users\judy\appdata\roaming\micros~1\windows\startm~1\programs\startup\iwinde~1.lnk - c:\programdata\iwin games\desktopalerts\DesktopAlerts.exe
StartupFolder: c:\users\judy\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\users\judy\appdata\roaming\micros~1\windows\startm~1\programs\startup\rcadet~1.lnk - c:\users\judy\documents\rca detective\RCADetective.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\gamerlog.lnk - c:\program files\gamerlog\GamerLog.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZJxdm070YYUS
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\iespell\wikipedia.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - c:\program files\winferno\pc confidential\PCConfidential.exe
IE: {925DAB62-F9AC-4221-806A-057BFB1014AA} - c:\program files\winferno\pc confidential\PCConfidential.exe
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\judy\appdata\roaming\microsoft\windows\start menu\programs\imvu\Run IMVU.lnk
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aim toolbar 5.0\aoltb.dll
IE: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - {2260D608-C844-435d-90FD-DC16CFA577F2} - c:\program files\smartshopper\bin\2.5.0\SmrtShpr.dll
IE: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - {BCEB373D-A35A-4200-BD43-8586CD9DFAE7} - c:\program files\smartshopper\bin\2.5.0\SmrtShpr.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: c:\windows\system32\iavlsp.dll
LSP: c:\program files\iolo\common\firewall\iFW_Xfilter.dll
DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} - hxxp://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} - hxxp://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/OnlineScanner.cab
DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} - hxxp://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} - hxxp://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} - hxxp://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} - hxxp://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} - hxxp://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {C6E9F0B8-AFEA-46F3-831B-612E97381ABA} - hxxp://www.imvu.com/activex/imvustreamer.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} - hxxp://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} - hxxp://zone.msn.com/binframework/v10/StProxy.cab55579.cab
DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} - hxxp://zone.msn.com/bingame/zpagames/CheckersZPA.cab55579.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

============= SERVICES / DRIVERS ===============

R?2 browserctl;browserctl;c:\windows\system32\SvchoSt.ExE -k browserctl [2008-6-14 21504]
R0 XPacket;iolo Personal Firewall Driver;c:\windows\system32\xpacket.sys [2008-8-24 39424]
R1 browserctldrv;browserctldrv;c:\program files\browserctl\BrowserCtl.sys [2009-8-5 9472]
R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [2008-8-24 12800]
R2 FreezeScreenSaver;FreezeScreenSaver;c:\windows\system32\FreezeScreenSaver.exe [2008-8-1 69632]
R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-8-24 628584]
R2 ioloProductUpdate;iolo Product Update Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-8-24 628584]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-8-24 628584]
R2 iWinTrusted;iWinTrusted;c:\program files\iwin games\iWinTrusted.exe [2009-6-4 78104]
R2 MrHealthyService;MrHealthy;c:\program files\norton pc checkup\executables\mrhealthy\mrhealthy.exe -service –> c:\program files\norton pc checkup\executables\mrhealthy\MrHealthy.exe -service [?]
R2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe [2009-8-8 28762]
R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
S2 gupdate1c9dd44c9cdecca;Google Update Service (gupdate1c9dd44c9cdecca);c:\program files\google\update\GoogleUpdate.exe [2009-5-25 133104]
S3 getPlus® Helper;getPlus® Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-11-2 33752]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-8-22 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-8-22 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-6-18 23680]

============== File Associations ===============

JSEFile=NOTEPAD.EXE %1
regfile=NOTEPAD.EXE %1
scrfile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-08-05 14:41 1 a——- c:\windows\ckms134.dat
2009-08-05 14:41 0 a——- c:\windows\jm567890.dat
2009-08-05 14:29 1 a——- c:\windows\934fdfg34fgjf23
2009-08-05 14:29 15,872 —-h— c:\windows\pp10.exe
2009-08-05 14:29 –d—– c:\program files\BrowserCtl
2009-08-05 14:29 2 a——- c:\windows\010112010146120114.dat
2009-08-05 14:29 2 a——- c:\windows\0535251103110107106.xry
2009-08-05 14:29 86,016 a——- c:\windows\mstre19.exe
2009-08-05 14:29 2 a——- c:\windows\0101120101465749.dat
2009-08-05 14:29 1 —-h— c:\windows\jmmark2.dat
2009-08-05 14:28 1 —-h— c:\windows\th823567.dat
2009-08-05 14:28 37,376 a——- c:\windows\freddy56.exe
2009-08-05 14:28 2 a——- c:\windows\0101120101465453.dat
2009-08-05 14:28 16,384 a——- c:\windows\ld12.exe
2009-08-05 14:28 247 a——- c:\windows\prxid93ps.dat
2009-08-04 08:10 97,800 a——- c:\windows\system32\infocardapi.dll
2009-08-04 08:10 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-04 08:10 37,384 a——- c:\windows\system32\infocardcpl.cpl
2009-08-04 08:10 622,080 a——- c:\windows\system32\icardagt.exe
2009-08-04 08:10 11,264 a——- c:\windows\system32\icardres.dll
2009-08-04 08:10 43,544 a——- c:\windows\system32\PresentationHostProxy.dll
2009-08-04 08:10 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll
2009-08-04 08:10 326,160 a——- c:\windows\system32\PresentationHost.exe
2009-08-04 07:56 96,760 a——- c:\windows\system32\dfshim.dll
2009-08-04 07:56 282,112 a——- c:\windows\system32\mscoree.dll
2009-08-04 07:56 41,984 a——- c:\windows\system32\netfxperf.dll
2009-08-04 07:54 158,720 a——- c:\windows\system32\mscorier.dll
2009-08-04 07:53 83,968 a——- c:\windows\system32\mscories.dll
2009-07-23 11:23 –d—– c:\users\judy\appdata\roaming\MySpace
2009-07-23 11:20 –d—– c:\users\judy\Roaming
2009-07-23 11:20 –d—– C:\Roaming
2009-07-23 11:20 –d—– c:\program files\MySpace
2009-07-15 09:36 289,792 a——- c:\windows\system32\atmfd.dll
2009-07-15 09:36 156,672 a——- c:\windows\system32\t2embed.dll
2009-07-15 09:36 72,704 a——- c:\windows\system32\fontsub.dll
2009-07-15 09:36 10,240 a——- c:\windows\system32\dciman32.dll

==================== Find3M ====================

2009-08-08 10:53 28,672 a——- c:\windows\system32\f3PSSavr.scr
2009-07-18 12:06 827,904 a——- c:\windows\system32\wininet.dll
2009-07-18 12:01 78,336 a——- c:\windows\system32\ieencode.dll
2009-07-18 05:46 26,624 a——- c:\windows\system32\ieUnatt.exe
2009-02-27 18:40 86,016 a——- c:\windows\inf\infstrng.dat
2009-02-27 18:40 51,200 a——- c:\windows\inf\infpub.dat
2009-02-27 18:40 86,016 a——- c:\windows\inf\infstor.dat
2008-08-10 12:37 174 a–sh— c:\program files\desktop.ini
2008-08-10 10:53 665,600 a——- c:\windows\inf\drvindex.dat
2008-06-11 10:31 1,506,742 a——- c:\users\judy\PotC-setup.exe
2008-05-02 16:51 48 a—h— c:\programdata\ezsidmv.dat
2008-05-02 16:51 48 a—h— c:\progra~2\ezsidmv.dat
2008-04-29 18:10 774,144 a——- c:\program files\RngInterstitial.dll
2008-04-16 11:32 470,640 a——- c:\users\judy\ScanReport.dat
2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 15:52:10.29 ===============

Attachments:

📎Attach.txt2.txt

CatByte

Post #4August 8, 2009, 8:20 PM UTC

Hi,

Any luck running the GMER program?

In the meantime, please do the following:

Hold down the Windows key and press R to open a run box
type the following text into the run box

appwiz.cpl
This will open your Programs And Features
A list of installed programs will populate
Remove the following programs:

Ask Toolbar
Java™ 6 Update 5
Java™ 6 Update 7
LimeWire 5.1.3
My Web Search (Zwinky)
WeatherBug

HMH22

Post #5August 9, 2009, 3:13 AM UTC

Hi srry im having no luck with gmer program it will get to the point of me unchecking the thing you said to uncheck and then it will close out and a couple of times it did that a blue screen popped up and shutdown the computer and restarted it. I also tried doing the other thing you wanted me to do but, everytime i click ok a microsoft windows window pops up and says that the windows host rundell32 has been closed and i exit out and try again but that same message pops back up. Do you want me to just uninstall them by doing it from the control panel or will i not be able to do so.

CatByte

Post #6August 9, 2009, 3:18 AM UTC

Hi, You probably wont be able to.

Please try the following program:

Please download Sysprot Antirootkit from >>>HERE<<<

Unzip it into a folder on your desktop.

Double click Sysprot.exe to start the program.
Click on the Log tab.
In the Write to log box select ALL ITEMS
Look near the bottom left, and Check Hidden Objects Only
Click on the Create Log button on the bottom right.
After a few seconds a new window should appear.
Select Scan Root Drive. Click on the Start button.
When it is complete a new window will appear to indicate that the scan is finished.
The log will be saved automatically in the same folder Sysprot.exe was extracted to.
Open the text file and copy/paste the log here.

HMH22

Post #7August 9, 2009, 4:04 AM UTC

SysProt AntiRootkit v1.0.1.0 by swatkat ******************************************************************************** ********** ******************************************************************************** ********** No Hidden Processes found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Modules: Module Name: \SystemRoot\System32\Drivers\dump_dumpata.sys Service Name: — Module Base: 8BBAB000 Module End: 8BBB6000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys Service Name: — Module Base: 8BBB6000 Module End: 8BBBE000 Hidden: Yes Module Name: \??\C:\Windows\system32\Drivers\mchInjDrv.sys Service Name: — Module Base: A6DDA000 Module End: A6DDB000 Hidden: Yes ******************************************************************************** ********** ******************************************************************************** ********** No SSDT Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Hooks: Hooked Function: ZwWriteFile At Address: 820411C3 Jump To: 85E8D2A4 Module Name: _unknown_ Hooked Function: ZwSetSystemInformation At Address: 82011372 Jump To: 85E8D7FC Module Name: _unknown_ Hooked Function: ZwSetInformationFile At Address: 8200E817 Jump To: 85E8D174 Module Name: _unknown_ Hooked Function: ZwDuplicateObject At Address: 82013E81 Jump To: 85E45444 Module Name: _unknown_ Hooked Function: ZwCreateSection At Address: 82063127 Jump To: 85E45AFC Module Name: _unknown_ ******************************************************************************** ********** ******************************************************************************** ********** No IRP Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Ports: Local Address: FINALLY-PC.NORTHSTATE.NET:61390 Remote Address: 63.135.85.157:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:60691 Remote Address: 8.12.226.77:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:60665 Remote Address: 63.135.80.83:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:60488 Remote Address: 216.178.38.222:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:60007 Remote Address: 63.135.88.184:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:59969 Remote Address: 63.135.88.184:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:59958 Remote Address: DF-136.IACCAP.COM:5222 Type: TCP Process: C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:59785 Remote Address: 8.12.226.77:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:59708 Remote Address: A96-17-75-194.DEPLOY.AKAMAITECHNOLOGIES.COM:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:59447 Remote Address: 63.135.85.157:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:58483 Remote Address: 66.161.95.210:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:51573 Remote Address: 63.135.85.157:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:51424 Remote Address: 8.12.226.77:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:51394 Remote Address: 8.12.226.77:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:50220 Remote Address: 208.71.159.145:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:49930 Remote Address: 208.71.159.147:HTTP Type: TCP Process: C:\Windows\System32\svchost.exe State: ESTABLISHED Local Address: FINALLY-PC.NORTHSTATE.NET:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: FINALLY-PC:60474 Remote Address: LOCALHOST:8085 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:60470 Remote Address: LOCALHOST:8085 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60503 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60501 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60499 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60497 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60495 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60493 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60491 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60489 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60486 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60484 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60482 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60480 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60478 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60476 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60472 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:8085 Remote Address: LOCALHOST:60470 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FINALLY-PC:7110 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe State: LISTENING Local Address: FINALLY-PC:7025 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe State: LISTENING Local Address: FINALLY-PC:49157 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\services.exe State: LISTENING Local Address: FINALLY-PC:49155 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\lsass.exe State: LISTENING Local Address: FINALLY-PC:49154 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: FINALLY-PC:49153 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: FINALLY-PC:49152 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\wininit.exe State: LISTENING Local Address: FINALLY-PC:8085 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: FINALLY-PC:5357 Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: FINALLY-PC:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: FINALLY-PC:EPMAP Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: FINALLY-PC:HTTP Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: FINALLY-PC.NORTHSTATE.NET:52072 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC.NORTHSTATE.NET:SSDP Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC.NORTHSTATE.NET:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: FINALLY-PC.NORTHSTATE.NET:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: FINALLY-PC:65410 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC:61655 Remote Address: NA Type: UDP Process: C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe State: NA Local Address: FINALLY-PC:61327 Remote Address: NA Type: UDP Process: C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe State: NA Local Address: FINALLY-PC:60204 Remote Address: NA Type: UDP Process: C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe State: NA Local Address: FINALLY-PC:52073 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC:51331 Remote Address: NA Type: UDP Process: C:\Program Files\AWS\WeatherBug\Weather.exe State: NA Local Address: FINALLY-PC:49799 Remote Address: NA Type: UDP Process: C:\Program Files\Internet Explorer\iexplore.exe State: NA Local Address: FINALLY-PC:SSDP Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC:LLMNR Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC:IPSEC-MSFT Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC:500 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: FINALLY-PC:123 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA ******************************************************************************** ********** ******************************************************************************** ********** Hidden files/folders: Object: C:\System Volume Information\DFSR Status: Access denied Object: C:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: C:\System Volume Information\SPP Status: Access denied Object: C:\System Volume Information\SystemRestore Status: Access denied Object: C:\System Volume Information\tracking.log Status: Access denied Object: C:\System Volume Information\Windows Backup Status: Access denied Object: C:\System Volume Information\{1ac67275-81b6-11de-aa48-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{30e0d795-826d-11de-b9eb-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{30e0d7b9-826d-11de-b9eb-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{3f46ada5-8039-11de-ac7e-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{4ead1cff-7aac-11de-b916-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{5638f9cf-7dd0-11de-8a88-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{5b6d8616-837c-11de-966b-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{5b6d863a-837c-11de-966b-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{5dc6d2d2-7c44-11de-912c-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{a4fbd045-7e9d-11de-a665-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{ac0eb195-829e-11de-a5d2-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{b0e19689-80eb-11de-ab48-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{f275169b-8359-11de-ac25-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{f27516b7-8359-11de-ac25-00192154d656}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTAdmin_PS_Provider.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTkerberos.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl Status: Access denied

CatByte

Post #8August 9, 2009, 4:19 AM UTC last edited August 10, 2009, 1:26 AM UTC

Hi,

Please do the following:

Please download OTM by OldTimer.

Save it to your desktop.
Please click OTM and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe
MSASCui.exe

:Services
FreezeScreenSaver
My Web Search Service
browserctl
browserctldrv

:Reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{00a6faf6-072e-44cf-8957-5838f569a31d}"=-
"{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00a6faf1-072e-44cf-8957-5838f569a31d}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{07b18ea1-a523-4961-b6bb-170de4475cca}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
"{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}"=-
"{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}"=- 
"{07b18ea9-a523-4961-b6bb-170de4475cca}"=-
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"=-
"{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"=-
"MyWebSearch Email Plugin"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MyWebSearch Plugin"=-
"sysldtray"=-
"pp"=-
"sysfbtray"=-
"Sysmstray"=-
"My Web Search Bar Search Scope Monitor"=-
"MyWebSearch Email Plugin"=-

:Files
C:\Windows\system32\FreezeScreenSaver.exe
C:\Windows\pp10.exe
C:\Program Files\AWS\WeatherBug
c:\program files\mywebsearch
c:\program files\asksbar
c:\windows\freddy56.exe
c:\windows\mstre19.exe
c:\windows\ckms134.dat
c:\windows\jm567890.dat
c:\windows\934fdfg34fgjf23
c:\program files\browserctl\BrowserCtl.sys
c:\windows\system32\SvchoSt.ExE
c:\program files\BrowserCtl
c:\windows\010112010146120114.dat
c:\windows\0535251103110107106.xry
c:\windows\0101120101465749.dat
c:\windows\jmmark2.dat
c:\windows\th823567.dat
c:\windows\freddy56.exe
c:\windows\0101120101465453.dat
c:\windows\ld12.exe
c:\windows\prxid93ps.dat


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

HMH22

Post #9August 10, 2009, 12:12 AM UTC

Hi, I'm having problems downloading the oldtimer program, it keeps freezing up and then closes out. Is there a different way for me to download it is there a website where I can go.

CatByte

Post #10August 10, 2009, 1:36 AM UTC

Hi,

Lets try it a different way, so you don't have to download any programs:

Please do the following:

Open Notepad

Click Start >Run type notepad into the run box click OK
Click Format and make certain that Word Wrap is NOT checked.

Copy the text inside of the code box, put your mouse cursor at the very beginning of the text and then hold down the left button and drag your mouse so that all of the text is highlighted. Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Now paste the copied text into the open notepad. To do this click in the blank page so that your cursor is flashing there and press CTRL+V (or right click and choose 'paste')

Note: There must be NO blank lines in front of the pasted text, but ensure that there is a blank line at the end of the text, otherwise the registry merge will not work.

Windows Registry Editor version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{00a6faf6-072e-44cf-8957-5838f569a31d}"=-
"{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00a6faf1-072e-44cf-8957-5838f569a31d}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{07b18ea1-a523-4961-b6bb-170de4475cca}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
"{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}"=-
"{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}"=-
"{07b18ea9-a523-4961-b6bb-170de4475cca}"=-
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"=-
"{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"=-
"MyWebSearch Email Plugin"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MyWebSearch Plugin"=-
"sysldtray"=-
"pp"=-
"sysfbtray"=-
"Sysmstray"=-
"My Web Search Bar Search Scope Monitor"=-
"MyWebSearch Email Plugin"=-

Now go to File > and click Save As,
From the drop down menu at the top of the box choose Desktop as the location to save this file.
Go down to the File Name box and type in fixme.reg as the file name, then choose All Files as the save as file type.
Then click the save button.
Once you have clicked the save button, close Notepad.

You should now see a file on your desktop that looks like this:

[external image: Posted Image]

Locate the fixme.reg icon on your desktop and double click it, an information box will pop up asking if you want to merge the information in the file into the registry, click YES.

Once the file has run, the information will have merged with your registry so you can delete fixme.reg from your desktop as you won't be needing it any more.

NEXT

Go to Start->Run and type in notepad and hit OK.

Then copy and paste the content of the following codebox into Notepad:

@echo off
if exist results.txt del results.txt
SC stop FreezeScreenSaver  >> results.txt 2>>&1
SC delete FreezeScreenSaver >> results.txt 2>>&1
SC stop "My Web Search Service" >> results.txt 2>>&1
SC delete "My Web Search Service" >> results.txt 2>>&1
SC stop browserctl >> results.txt 2>>&1
SC delete browserctl >> results.txt 2>>&1
SC stop browserctldrv >> results.txt 2>>&1
SC delete browserctldrv >> results.txt 2>>&1
FOR %%H IN (
"C:\Windows\system32\FreezeScreenSaver.exe"
"C:\Windows\pp10.exe"
"C:\Program Files\AWS\WeatherBug"
"c:\program files\mywebsearch"
"c:\program files\asksbar"
"c:\windows\freddy56.exe"
"c:\windows\mstre19.exe"
"c:\windows\ckms134.dat"
"c:\windows\jm567890.dat"
"c:\windows\934fdfg34fgjf23"
"c:\program files\browserctl\BrowserCtl.sys"
"c:\windows\system32\SvchoSt.ExE"
"c:\program files\BrowserCtl"
"c:\windows\010112010146120114.dat"
"c:\windows\0535251103110107106.xry"
"c:\windows\0101120101465749.dat"
"c:\windows\jmmark2.dat"
"c:\windows\th823567.dat"
"c:\windows\freddy56.exe"
"c:\windows\0101120101465453.dat"
"c:\windows\ld12.exe"
"c:\windows\prxid93ps.dat"
) DO (
attrib -r -h -s %%H
del /q /f %%H >> results.txt 2>>&1
)
del %0

Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes.
Once saved, the icon to click should look like this on your desktop:

[external image: Posted Image]
Double click find.bat. to run it. A small black box should open and close - this is normal.

A notepad called results.txt will open on your desktop, please copy/paste the contents in your next reply.

HMH22

Post #11August 10, 2009, 3:04 AM UTC

Im srry but it still wont let me do anything. I did whay you said and tried to save it to the desktop but nothing shows up and I went to control panel to change the settings and everytime I tried to add the icons to my desktop it says rundell32 is closed and wont let me do anything.

CatByte

Post #12August 10, 2009, 3:26 AM UTC

Hi,

can you see if you can get this program to run - try it in safe mode:

Download RootRepeal from the following location and save it to your desktop.
- Zip Mirrors (Recommended)
  - Primary Mirror
  - Secondary Mirror
  - Secondary Mirror
- Rar Mirrors - Only if you know what a RAR is and can extract it.
Extract RootRepeal.exe from the archive.
Open [external image: Posted Image] on your desktop.
Click the [external image: Posted Image] tab.
Click the [external image: Posted Image] button.
Check all seven boxes: [external image: Posted Image]
Push Ok
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

CatByte

Post #13August 10, 2009, 10:10 AM UTC

Hi,

Please do this for me as well

Please press the Windows Key + R which will bting up a run box, copy/paste the following command from inside the quote box (it's one long command) into the runbox and press OK:

cmd /c dir /a /s "C:\WINDOWS\scecli.dlll" "C:\WINDOWS\netlogon.dll" "C:\WINDOWS\ntelogon.dll" >> "%userprofile%\desktop\look.txt" 2>>&1

A black box will open and a file will appear on your Desktop called look.txt.

Please wait until the black box closes before opening it, and post the contents of look.txt in your next response.

HMH22

Post #14August 10, 2009, 3:00 PM UTC

I tried the first thing and it would not let me do anything it frooze and closed out but here is the look txt document: Volume in drive C is ACER Volume Serial Number is 0881-F80E Directory of C:\WINDOWS\System32 01/19/2008 03:35 AM 592,384 netlogon.dll 1 File(s) 592,384 bytes Directory of C:\WINDOWS\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783 11/02/2006 05:46 AM 559,616 netlogon.dll 1 File(s) 559,616 bytes Directory of C:\WINDOWS\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857 01/19/2008 03:35 AM 592,384 netlogon.dll 1 File(s) 592,384 bytes Total Files Listed: 3 File(s) 1,744,384 bytes 0 Dir(s) 59,355,471,872 bytes free

CatByte

Post #15August 10, 2009, 3:34 PM UTC

Sorry, can you please do that again,

(I had a typo in the first one)

Please press the Windows Key + R which will bring up a run box, copy/paste the following command from inside the quote box (it's one long command) into the runbox and press OK:

cmd /c dir /a /s "C:\WINDOWS\scecli.dll" >> "%userprofile%\desktop\lookagain.txt" 2>>&1

A black box will open and a file will appear on your Desktop called lookagain.txt.

Please wait until the black box closes before opening it, and post the contents of lookagain.txt in your next response.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] my windows defender says everything is fine

✨ Ask AI

Ask AI