Ried
Do you recall the error message?
Do you see your desktop icons?
If no icons, can you bring up Task Manager? On your keyboard, press the following keys simultaneously
Ctrl Alt Del
Click 'Start Task Manager'
Spyware / Malware / Virus Removal
[Resolved] my windows defender says everything is fine
52 min read
HMH22
No I dont recall it was something about the program and yes the icons were still there but, it did finish and when it did it created the log. After that I tried to get back on the internet but it said there was an illegal attempt to delete the file or something like that and now nothing wont open up. Everytime I click on something it does not open I just keep seeing that message. I was on the Administrator accout and had to change the account back to where I was to be able to do anything.
Ried
Please reboot the machine into your usual account and let me know if it's back to normal.
If not, I need to know the exact error message you are seeing - what file?
HMH22
Ok i logged back on administrator and now its back here is the log report:
ComboFix 09-08-10.02 - Administrator 08/11/2009 0:12.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.229 [GMT -4:00]
Running from: C:\Combo-Fix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-799166915-711753516-749061224-1003
c:\$recycle.bin\S-1-5-21-799166915-711753516-749061224-1005
c:\$recycle.bin\S-1-5-21-799166915-711753516-749061224-1006
c:\program files\BrowserCtl
c:\program files\BrowserCtl\BrowserCtl.dll
c:\program files\BrowserCtl\BrowserCtl.sys
c:\program files\FunWebProducts
c:\program files\Internet Explorer\msimg32.dll
c:\program files\iWin Games\iWinGamesHookIE.dll
c:\program files\iWin\tbiWi1.dll
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL
c:\program files\MyWebSearch\bar\1.bin\M3DLGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\2.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\2.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\2.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\SmartShopper
c:\program files\Zumie
c:\program files\Zumie\home.js
c:\program files\Zumie\readme.html
c:\program files\Zumie\uninstall.exe
c:\program files\Zumie\zopt.exe
c:\users\Judy\AppData\Roaming\WeatherDPA
c:\users\Judy\AppData\Roaming\WeatherDPA\Weather\WeatherStartup.xml
c:\windows\010112010146120114.dat
c:\windows\0101120101464850.dat
c:\windows\0101120101465453.dat
c:\windows\0101120101465553.dat
c:\windows\0101120101465749.dat
c:\windows\934fdfg34fgjf23
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\freddy56.exe
c:\windows\freddy57.exe
c:\windows\Installer\WMEncoder.msi
c:\windows\jmmark2.dat
c:\windows\ld12.exe
c:\windows\mstre19.exe
c:\windows\mstre20.exe
c:\windows\pp10.exe
c:\windows\system32\f3PSSavr.scr
c:\windows\th823567.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_BROWSERCTLDRV
——-\Service_browserctl
——-\Service_browserctldrv
——-\Service_FreezeScreenSaver
——-\Service_MyWebSearchService
——-\Service_SfX
((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
.
2009-08-11 04:28 . 2009-08-11 04:28 ——– d—–w- c:\users\Kayla\AppData\Local\temp
2009-08-11 04:28 . 2009-08-11 04:28 ——– d—–w- c:\users\Judy\AppData\Local\temp
2009-08-11 04:26 . 2009-08-11 04:26 ——– d—–w- c:\users\Guest\AppData\Local\temp
2009-08-11 04:26 . 2009-08-11 04:26 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-08-11 03:34 . 2009-08-11 03:34 3123576 —-a-r- C:\Combo-Fix.exe
2009-08-11 03:24 . 2009-08-11 03:31 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Local\Microsoft Games
2009-08-11 03:24 . 2009-08-11 03:31 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Local\Microsoft Games
2009-08-10 19:22 . 2009-08-10 19:22 1 —h–w- c:\windows\mmsmark2.dat
2009-08-10 19:16 . 2009-08-10 19:16 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Local\KodakGallery
2009-08-10 19:16 . 2009-08-10 19:16 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Local\KodakGallery
2009-08-10 19:15 . 2009-08-10 19:15 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\Skinux
2009-08-10 19:15 . 2009-08-10 19:15 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\Skinux
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\Acer
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\Acer
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\Leadertech
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\Leadertech
2009-08-05 18:41 . 2009-08-05 18:41 1 —-a-w- c:\windows\ckms134.dat
2009-08-05 18:28 . 2009-08-05 18:28 247 —-a-w- c:\windows\prxid93ps.dat
2009-08-04 12:10 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2009-08-04 12:10 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-04 12:10 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2009-08-04 12:10 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2009-08-04 12:10 . 2008-06-20 01:14 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2009-08-04 12:10 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-08-04 12:10 . 2008-06-20 01:14 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2009-08-04 11:56 . 2008-07-27 18:03 96760 —-a-w- c:\windows\system32\dfshim.dll
2009-08-04 11:56 . 2008-07-27 18:03 282112 —-a-w- c:\windows\system32\mscoree.dll
2009-08-04 11:56 . 2008-07-27 18:03 41984 —-a-w- c:\windows\system32\netfxperf.dll
2009-08-04 11:54 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2009-08-04 11:53 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2009-07-23 23:26 . 2009-07-23 23:28 7040776 —-a-w- c:\users\Judy\AppData\Roaming\MySpace\IM\Install\MSIMClientSetup.1.0.789.0-static-A.exe
2009-07-23 15:23 . 2009-07-23 15:23 ——– d—–w- c:\users\Judy\AppData\Roaming\MySpace
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Kayla\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Judy\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Guest\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Default\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- C:\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Kayla\AppData\Roaming\MySpace
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\program files\MySpace
2009-07-23 15:18 . 2009-07-23 15:19 7040776 —-a-w- c:\users\Kayla\AppData\Roaming\MySpace\IM\Install\MSIMClientSetup.1.0.789.0-static-A.exe
2009-07-23 15:05 . 2009-07-23 15:05 ——– d—–w- c:\users\Kayla\AppData\Local\KodakGallery
2009-07-15 13:36 . 2009-06-15 15:24 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-07-15 13:36 . 2009-06-15 15:20 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-07-15 13:36 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-07-15 13:36 . 2009-06-15 12:52 289792 —-a-w- c:\windows\system32\atmfd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 04:23 . 2008-09-12 15:12 ——– d—–w- c:\program files\iWin
2009-08-11 04:23 . 2008-07-11 19:16 ——– d—–w- c:\program files\iWin Games
2009-08-11 03:48 . 2009-08-10 19:13 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\iolo
2009-08-11 03:48 . 2009-08-10 19:13 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\iolo
2009-08-11 01:18 . 2008-08-31 14:41 ——– d—–w- c:\progra~2\Google Updater
2009-08-10 19:20 . 2009-08-10 19:13 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\yahoo!
2009-08-10 19:20 . 2009-08-10 19:13 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\yahoo!
2009-08-10 19:14 . 2008-09-25 17:22 ——– d—–w- c:\program files\GamerLog
2009-08-10 19:13 . 2009-08-10 19:13 99864 —-a-w- c:\users\Administrator.Finally-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-10 19:13 . 2009-08-10 19:13 99864 —-a-w- c:\users\ADMINI~1.FIN\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-10 19:13 . 2009-08-10 19:13 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\MyWebSearch
2009-08-10 19:13 . 2009-08-10 19:13 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\MyWebSearch
2009-08-09 22:30 . 2006-12-13 03:39 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-08 21:11 . 2008-04-09 19:35 ——– d—–w- c:\users\Judy\AppData\Roaming\IMVU
2009-08-06 16:16 . 2008-08-11 16:04 ——– d—–w- c:\progra~2\HP Product Assistant
2009-08-06 11:29 . 2008-06-23 01:09 ——– d—–w- c:\users\Judy\AppData\Roaming\LimeWire
2009-08-06 09:58 . 2009-02-18 00:31 ——– d—–w- c:\progra~2\Microsoft Help
2009-08-04 12:54 . 2008-02-06 20:48 99864 —-a-w- c:\users\Judy\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-04 12:26 . 2009-02-18 00:39 ——– d—–w- c:\program files\Microsoft Works
2009-08-03 07:44 . 2008-06-12 01:18 ——– d—–w- c:\program files\Microsoft Silverlight
2009-07-18 16:06 . 2009-07-28 18:53 827904 —-a-w- c:\windows\system32\wininet.dll
2009-07-18 16:01 . 2009-07-28 18:53 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-07-18 09:46 . 2009-07-28 18:53 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2009-07-16 13:39 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-07-11 21:24 . 2008-07-11 19:21 ——– d—–w- c:\program files\iWin.com
2009-07-09 21:42 . 2009-07-09 21:42 ——– d—–w- c:\users\Kayla\AppData\Roaming\Skinux
2009-07-09 21:38 . 2008-10-10 20:17 99864 —-a-w- c:\users\Kayla\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-08 21:36 . 2009-06-07 15:54 ——– d—–w- c:\progra~2\avg8
2009-07-02 21:41 . 2009-07-02 21:41 ——– d—–w- c:\program files\bfgclient
2009-06-24 22:53 . 2009-06-24 22:53 680 —-a-w- c:\users\Judy\AppData\Local\d3d9caps.dat
2009-06-20 00:47 . 2009-06-20 00:47 ——– d—–w- c:\users\Judy\AppData\Roaming\GamesCafe
2009-06-12 16:07 . 2009-06-11 00:53 ——– d—–w- c:\users\Judy\AppData\Roaming\Flood Light Games
2009-06-12 16:07 . 2009-06-11 00:53 ——– d—–w- c:\progra~2\Flood Light Games
2009-06-12 15:09 . 2009-06-12 15:09 34062 —-a-w- c:\users\Judy\AppData\Roaming\Move Networks\ie_bin\Uninst.exe
2008-04-29 22:10 . 2008-04-29 22:10 774144 —-a-w- c:\program files\RngInterstitial.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-25 66912]
[HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-07-25 18:37 66912 —-a-w- c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-31 39408]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-19 2153472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-11-23 319488]
"Acer Product Registration"="c:\program files\Acer Registration\ACE1.exe" [2006-12-13 3166208]
"Acer Assist Launcher"="c:\program files\Acer Assist\launcher.exe" [2006-12-04 1261568]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-11-17 453120]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"iolo Startup"="c:\program files\iolo\Common\Lib\ioloLManager.exe" [2008-03-04 307056]
"iolo Personal Firewall"="c:\program files\iolo\System Shield 3\Personal Firewall\ioloFW.exe" [2008-03-05 1305440]
"iolo AntiVirus"="c:\program files\iolo\System Shield 3\AntiVirus\ioloAV.exe" [2008-03-05 1095520]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-02-01 385024]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2006-11-09 3784704]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2006-12-12 528384]
Gamerlog.lnk - c:\program files\GamerLog\GamerLog.exe [2008-8-22 1216512]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-5-10 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AD5C0732-F722-4859-AE16-B32CE74E0916}"= UDP:c:\program files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{642287D5-2E06-4A01-B33D-261440D83042}"= TCP:c:\program files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{89BBC071-8908-4460-A7B4-6F8A8F8BF845}"= UDP:c:\program files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{7601C2B2-0371-44AB-B77C-74222A7BCAA7}"= TCP:c:\program files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{C4694198-63D5-483E-A87C-87E8BEFEAE57}"= UDP:c:\program files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{CF99901E-C817-4C67-83BB-B096D8AF0CFD}"= TCP:c:\program files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{954E4407-A0BD-4F1A-9CF9-75487AED7AE1}"= UDP:c:\program files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{F83598BE-AC2A-4EED-A7F4-83C8E99DB965}"= TCP:c:\program files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{1D78E303-70E9-4943-A079-2F7E5DA36309}"= UDP:c:\program files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA
"{1F60CDE7-D481-44A4-98F0-A30C1862CC06}"= TCP:c:\program files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA
"{82C8D8D4-D9B4-44B6-A7FE-03CAC70AC3EA}"= UDP:c:\program files\CallWave\IAM.exe:CallWave
"{AD25995E-FBB2-4AC7-9184-09978D7DCA31}"= TCP:c:\program files\CallWave\IAM.exe:CallWave
"{1A632447-FB65-445F-B802-3B78E7A4C972}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{A23CDCCF-71EB-49BA-9058-16A38F9B3AF0}c:\\users\\judy\\appdata\\local\\temp\\ixp000.tmp\\smwinvnc.exe"= UDP:c:\users\judy\appdata\local\temp\ixp000.tmp\smwinvnc.exe:smwinvnc.exe
"UDP Query User{9F6EDE09-E61A-4342-AC02-135DAF150D17}c:\\users\\judy\\appdata\\local\\temp\\ixp000.tmp\\smwinvnc.exe"= TCP:c:\users\judy\appdata\local\temp\ixp000.tmp\smwinvnc.exe:smwinvnc.exe
"{89A6D4A5-DC85-460F-9D58-80A11A21097C}"= UDP:c:\program files\Microsoft Games\Zoo Tycoon 2 Trial Version\zt2demoretail.exe:Zoo Tycoon 2 Demo Executable
"{B343D3A6-736F-4D88-83E1-538DA1789B73}"= TCP:c:\program files\Microsoft Games\Zoo Tycoon 2 Trial Version\zt2demoretail.exe:Zoo Tycoon 2 Demo Executable
"{3D43AD31-7992-4A65-BC86-0564597E6F66}"= UDP:c:\users\Judy\Downloads\LimeWire\LimeWire.exe:LimeWire
"{0FCD10E3-73C8-404B-9843-2C54C15384F9}"= TCP:c:\users\Judy\Downloads\LimeWire\LimeWire.exe:LimeWire
"{30E6D005-B0BA-4D5F-B8E7-6816407E853A}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{C3B04A37-1C6D-47D8-8209-8B6BAE408FE2}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{A3FB2F95-13CD-4413-9756-D7844F8D764A}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{DF8398CD-AEB5-4767-88FC-B64941F6E822}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{02939F16-15CF-44D2-A88C-56830E3B3948}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{9EC9CFE8-985C-47F9-B54D-CFCE0DADB002}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{6198FBA6-8D46-47F3-8EBE-0D5A2299AE3B}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{E6C92F71-EDE5-4855-BCBD-A18DAC02CE8C}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{D9228AE2-17E9-4257-BE2B-EA17F60F6540}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{BFEC3500-4247-4F1E-90B6-E772500C7DC9}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{0B114AA3-5F80-4A34-A685-7BB288C4F9DF}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{14896EA4-0BFE-48F4-8976-72742DE2284A}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{D1C979EA-E5EB-4F08-897D-1AA79F56FD3D}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{0B6A602A-3B18-4B93-B5A8-748BB490CD8F}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{850938AA-685E-496C-A257-08AA1C84B6F7}"= UDP:c:\program files\iolo\System Shield 3\Personal Firewall\ioloFW.exe:iolo Firewall®
"{19461FAC-D788-472D-BE38-F7501C04534A}"= TCP:c:\program files\iolo\System Shield 3\Personal Firewall\ioloFW.exe:iolo Firewall®
"{4F2423AD-B8AE-42A8-99E9-582D2410FA7A}"= UDP:c:\program files\iolo\System Shield 3\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{3897B61B-0AD2-431A-A4B9-4ADB40E91905}"= TCP:c:\program files\iolo\System Shield 3\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{9B6900DE-0775-4E7F-B25D-362645534929}"= UDP:c:\program files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{6C2FC8B1-A23D-4D22-BDC1-BCE9F5C48392}"= TCP:c:\program files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{E2F7A70C-7BC7-4C8D-8819-C1688A307DBD}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{70B80C0B-7597-4F70-BA9C-2E28A668B2F8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{2BA29355-08D7-4B46-89E2-09B0D82FD728}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{6F04BE72-191F-47F5-88E3-7FA1F7002D71}"= UDP:c:\program files\iWin Games\iWinGames.exe:iWin Games application.
"{FE1FAB14-C8C6-43A3-AC9D-C85EF47BB3DB}"= TCP:c:\program files\iWin Games\iWinGames.exe:iWin Games application.
"{627CAD3B-2C33-4453-8AA5-53A0C9D66B54}"= UDP:c:\program files\iWin Games\WebUpdater.exe:iWin Games updater.
"{9D8D003C-6B2D-4E6E-AC95-07C6EF4D1505}"= TCP:c:\program files\iWin Games\WebUpdater.exe:iWin Games updater.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= c:\acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= c:\acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
"c:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= c:\acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption
R2 gupdate1c9dd44c9cdecca;Google Update Service (gupdate1c9dd44c9cdecca);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-25 133104]
R3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2008-08-22 18688]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2008-08-22 8320]
R3 motport;Motorola USB Diagnostic Port;c:\windows\system32\DRIVERS\motport.sys [2007-06-19 23680]
S0 XPacket;iolo Personal Firewall Driver;c:\windows\System32\xpacket.sys [2007-10-02 39424]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [2007-09-20 12800]
S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-02-26 628584]
S2 ioloProductUpdate;iolo Product Update Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-02-26 628584]
S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-02-26 628584]
S2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [2009-06-04 78104]
S2 MrHealthyService;MrHealthy;c:\program files\Norton PC Checkup\executables\mrHealthy\MrHealthy.exe [2009-01-29 578920]
— Other Services/Drivers In Memory —
*Deregistered* - mchInjDrv
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - ORPHANS REMOVED - - - -
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
HKLM-Run-sysfbtray - c:\windows\freddy57.exe
HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://en.us.acer.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZJxdm070YYUS
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\Judy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
LSP: c:\windows\system32\iavlsp.dll
LSP: c:\program files\iolo\Common\Firewall\iFW_Xfilter.dll
DPF: {C6E9F0B8-AFEA-46F3-831B-612E97381ABA} - hxxp://www.imvu.com/activex/imvustreamer.cab
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.
**************************************************************************
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files:
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(672)
c:\program files\iolo\Common\Firewall\iFW_Xfilter.dll
- - - - - - - > 'Explorer.exe'(4396)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\ShowErrMsg.dll
c:\program files\Common Files\Winferno\wse2007.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\audiodg.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\igfxsrvc.exe
c:\acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
c:\program files\AOL\AIM Toolbar 5.0\AolTbServer.exe
c:\program files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
c:\program files\MSN\Toolbar\3.0.0988.2\msntask.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Yahoo!\Companion\Installs\cpn1\ytbb.exe
.
**************************************************************************
.
Completion time: 2009-08-11 1:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-11 05:04
Pre-Run: 58,611,961,856 bytes free
Post-Run: 60,743,352,320 bytes free
456 — E O F — 2009-08-10 19:00
ComboFix 09-08-10.02 - Administrator 08/11/2009 0:12.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.229 [GMT -4:00]
Running from: C:\Combo-Fix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-799166915-711753516-749061224-1003
c:\$recycle.bin\S-1-5-21-799166915-711753516-749061224-1005
c:\$recycle.bin\S-1-5-21-799166915-711753516-749061224-1006
c:\program files\BrowserCtl
c:\program files\BrowserCtl\BrowserCtl.dll
c:\program files\BrowserCtl\BrowserCtl.sys
c:\program files\FunWebProducts
c:\program files\Internet Explorer\msimg32.dll
c:\program files\iWin Games\iWinGamesHookIE.dll
c:\program files\iWin\tbiWi1.dll
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL
c:\program files\MyWebSearch\bar\1.bin\M3DLGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\2.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\2.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\2.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\SmartShopper
c:\program files\Zumie
c:\program files\Zumie\home.js
c:\program files\Zumie\readme.html
c:\program files\Zumie\uninstall.exe
c:\program files\Zumie\zopt.exe
c:\users\Judy\AppData\Roaming\WeatherDPA
c:\users\Judy\AppData\Roaming\WeatherDPA\Weather\WeatherStartup.xml
c:\windows\010112010146120114.dat
c:\windows\0101120101464850.dat
c:\windows\0101120101465453.dat
c:\windows\0101120101465553.dat
c:\windows\0101120101465749.dat
c:\windows\934fdfg34fgjf23
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\freddy56.exe
c:\windows\freddy57.exe
c:\windows\Installer\WMEncoder.msi
c:\windows\jmmark2.dat
c:\windows\ld12.exe
c:\windows\mstre19.exe
c:\windows\mstre20.exe
c:\windows\pp10.exe
c:\windows\system32\f3PSSavr.scr
c:\windows\th823567.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_BROWSERCTLDRV
——-\Service_browserctl
——-\Service_browserctldrv
——-\Service_FreezeScreenSaver
——-\Service_MyWebSearchService
——-\Service_SfX
((((((((((((((((((((((((( Files Created from 2009-07-11 to 2009-08-11 )))))))))))))))))))))))))))))))
.
2009-08-11 04:28 . 2009-08-11 04:28 ——– d—–w- c:\users\Kayla\AppData\Local\temp
2009-08-11 04:28 . 2009-08-11 04:28 ——– d—–w- c:\users\Judy\AppData\Local\temp
2009-08-11 04:26 . 2009-08-11 04:26 ——– d—–w- c:\users\Guest\AppData\Local\temp
2009-08-11 04:26 . 2009-08-11 04:26 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-08-11 03:34 . 2009-08-11 03:34 3123576 —-a-r- C:\Combo-Fix.exe
2009-08-11 03:24 . 2009-08-11 03:31 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Local\Microsoft Games
2009-08-11 03:24 . 2009-08-11 03:31 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Local\Microsoft Games
2009-08-10 19:22 . 2009-08-10 19:22 1 —h–w- c:\windows\mmsmark2.dat
2009-08-10 19:16 . 2009-08-10 19:16 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Local\KodakGallery
2009-08-10 19:16 . 2009-08-10 19:16 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Local\KodakGallery
2009-08-10 19:15 . 2009-08-10 19:15 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\Skinux
2009-08-10 19:15 . 2009-08-10 19:15 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\Skinux
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\Acer
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\Acer
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\Leadertech
2009-08-10 19:14 . 2009-08-10 19:14 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\Leadertech
2009-08-05 18:41 . 2009-08-05 18:41 1 —-a-w- c:\windows\ckms134.dat
2009-08-05 18:28 . 2009-08-05 18:28 247 —-a-w- c:\windows\prxid93ps.dat
2009-08-04 12:10 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2009-08-04 12:10 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-04 12:10 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2009-08-04 12:10 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2009-08-04 12:10 . 2008-06-20 01:14 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2009-08-04 12:10 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-08-04 12:10 . 2008-06-20 01:14 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2009-08-04 11:56 . 2008-07-27 18:03 96760 —-a-w- c:\windows\system32\dfshim.dll
2009-08-04 11:56 . 2008-07-27 18:03 282112 —-a-w- c:\windows\system32\mscoree.dll
2009-08-04 11:56 . 2008-07-27 18:03 41984 —-a-w- c:\windows\system32\netfxperf.dll
2009-08-04 11:54 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2009-08-04 11:53 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2009-07-23 23:26 . 2009-07-23 23:28 7040776 —-a-w- c:\users\Judy\AppData\Roaming\MySpace\IM\Install\MSIMClientSetup.1.0.789.0-static-A.exe
2009-07-23 15:23 . 2009-07-23 15:23 ——– d—–w- c:\users\Judy\AppData\Roaming\MySpace
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Kayla\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Judy\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Guest\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Default\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- C:\Roaming
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\users\Kayla\AppData\Roaming\MySpace
2009-07-23 15:20 . 2009-07-23 15:20 ——– d—–w- c:\program files\MySpace
2009-07-23 15:18 . 2009-07-23 15:19 7040776 —-a-w- c:\users\Kayla\AppData\Roaming\MySpace\IM\Install\MSIMClientSetup.1.0.789.0-static-A.exe
2009-07-23 15:05 . 2009-07-23 15:05 ——– d—–w- c:\users\Kayla\AppData\Local\KodakGallery
2009-07-15 13:36 . 2009-06-15 15:24 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-07-15 13:36 . 2009-06-15 15:20 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-07-15 13:36 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-07-15 13:36 . 2009-06-15 12:52 289792 —-a-w- c:\windows\system32\atmfd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-11 04:23 . 2008-09-12 15:12 ——– d—–w- c:\program files\iWin
2009-08-11 04:23 . 2008-07-11 19:16 ——– d—–w- c:\program files\iWin Games
2009-08-11 03:48 . 2009-08-10 19:13 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\iolo
2009-08-11 03:48 . 2009-08-10 19:13 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\iolo
2009-08-11 01:18 . 2008-08-31 14:41 ——– d—–w- c:\progra~2\Google Updater
2009-08-10 19:20 . 2009-08-10 19:13 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\yahoo!
2009-08-10 19:20 . 2009-08-10 19:13 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\yahoo!
2009-08-10 19:14 . 2008-09-25 17:22 ——– d—–w- c:\program files\GamerLog
2009-08-10 19:13 . 2009-08-10 19:13 99864 —-a-w- c:\users\Administrator.Finally-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-10 19:13 . 2009-08-10 19:13 99864 —-a-w- c:\users\ADMINI~1.FIN\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-10 19:13 . 2009-08-10 19:13 ——– d—–w- c:\users\Administrator.Finally-PC\AppData\Roaming\MyWebSearch
2009-08-10 19:13 . 2009-08-10 19:13 ——– d—–w- c:\users\ADMINI~1.FIN\AppData\Roaming\MyWebSearch
2009-08-09 22:30 . 2006-12-13 03:39 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-08 21:11 . 2008-04-09 19:35 ——– d—–w- c:\users\Judy\AppData\Roaming\IMVU
2009-08-06 16:16 . 2008-08-11 16:04 ——– d—–w- c:\progra~2\HP Product Assistant
2009-08-06 11:29 . 2008-06-23 01:09 ——– d—–w- c:\users\Judy\AppData\Roaming\LimeWire
2009-08-06 09:58 . 2009-02-18 00:31 ——– d—–w- c:\progra~2\Microsoft Help
2009-08-04 12:54 . 2008-02-06 20:48 99864 —-a-w- c:\users\Judy\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-04 12:26 . 2009-02-18 00:39 ——– d—–w- c:\program files\Microsoft Works
2009-08-03 07:44 . 2008-06-12 01:18 ——– d—–w- c:\program files\Microsoft Silverlight
2009-07-18 16:06 . 2009-07-28 18:53 827904 —-a-w- c:\windows\system32\wininet.dll
2009-07-18 16:01 . 2009-07-28 18:53 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-07-18 09:46 . 2009-07-28 18:53 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2009-07-16 13:39 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-07-11 21:24 . 2008-07-11 19:21 ——– d—–w- c:\program files\iWin.com
2009-07-09 21:42 . 2009-07-09 21:42 ——– d—–w- c:\users\Kayla\AppData\Roaming\Skinux
2009-07-09 21:38 . 2008-10-10 20:17 99864 —-a-w- c:\users\Kayla\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-08 21:36 . 2009-06-07 15:54 ——– d—–w- c:\progra~2\avg8
2009-07-02 21:41 . 2009-07-02 21:41 ——– d—–w- c:\program files\bfgclient
2009-06-24 22:53 . 2009-06-24 22:53 680 —-a-w- c:\users\Judy\AppData\Local\d3d9caps.dat
2009-06-20 00:47 . 2009-06-20 00:47 ——– d—–w- c:\users\Judy\AppData\Roaming\GamesCafe
2009-06-12 16:07 . 2009-06-11 00:53 ——– d—–w- c:\users\Judy\AppData\Roaming\Flood Light Games
2009-06-12 16:07 . 2009-06-11 00:53 ——– d—–w- c:\progra~2\Flood Light Games
2009-06-12 15:09 . 2009-06-12 15:09 34062 —-a-w- c:\users\Judy\AppData\Roaming\Move Networks\ie_bin\Uninst.exe
2008-04-29 22:10 . 2008-04-29 22:10 774144 —-a-w- c:\program files\RngInterstitial.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-25 66912]
[HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-07-25 18:37 66912 —-a-w- c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-31 39408]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-19 2153472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-11-23 319488]
"Acer Product Registration"="c:\program files\Acer Registration\ACE1.exe" [2006-12-13 3166208]
"Acer Assist Launcher"="c:\program files\Acer Assist\launcher.exe" [2006-12-04 1261568]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-11-17 453120]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"iolo Startup"="c:\program files\iolo\Common\Lib\ioloLManager.exe" [2008-03-04 307056]
"iolo Personal Firewall"="c:\program files\iolo\System Shield 3\Personal Firewall\ioloFW.exe" [2008-03-05 1305440]
"iolo AntiVirus"="c:\program files\iolo\System Shield 3\AntiVirus\ioloAV.exe" [2008-03-05 1095520]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-02-01 385024]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2006-11-09 3784704]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2006-12-12 528384]
Gamerlog.lnk - c:\program files\GamerLog\GamerLog.exe [2008-8-22 1216512]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-5-10 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AD5C0732-F722-4859-AE16-B32CE74E0916}"= UDP:c:\program files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{642287D5-2E06-4A01-B33D-261440D83042}"= TCP:c:\program files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{89BBC071-8908-4460-A7B4-6F8A8F8BF845}"= UDP:c:\program files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{7601C2B2-0371-44AB-B77C-74222A7BCAA7}"= TCP:c:\program files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{C4694198-63D5-483E-A87C-87E8BEFEAE57}"= UDP:c:\program files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{CF99901E-C817-4C67-83BB-B096D8AF0CFD}"= TCP:c:\program files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{954E4407-A0BD-4F1A-9CF9-75487AED7AE1}"= UDP:c:\program files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{F83598BE-AC2A-4EED-A7F4-83C8E99DB965}"= TCP:c:\program files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{1D78E303-70E9-4943-A079-2F7E5DA36309}"= UDP:c:\program files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA
"{1F60CDE7-D481-44A4-98F0-A30C1862CC06}"= TCP:c:\program files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA
"{82C8D8D4-D9B4-44B6-A7FE-03CAC70AC3EA}"= UDP:c:\program files\CallWave\IAM.exe:CallWave
"{AD25995E-FBB2-4AC7-9184-09978D7DCA31}"= TCP:c:\program files\CallWave\IAM.exe:CallWave
"{1A632447-FB65-445F-B802-3B78E7A4C972}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{A23CDCCF-71EB-49BA-9058-16A38F9B3AF0}c:\\users\\judy\\appdata\\local\\temp\\ixp000.tmp\\smwinvnc.exe"= UDP:c:\users\judy\appdata\local\temp\ixp000.tmp\smwinvnc.exe:smwinvnc.exe
"UDP Query User{9F6EDE09-E61A-4342-AC02-135DAF150D17}c:\\users\\judy\\appdata\\local\\temp\\ixp000.tmp\\smwinvnc.exe"= TCP:c:\users\judy\appdata\local\temp\ixp000.tmp\smwinvnc.exe:smwinvnc.exe
"{89A6D4A5-DC85-460F-9D58-80A11A21097C}"= UDP:c:\program files\Microsoft Games\Zoo Tycoon 2 Trial Version\zt2demoretail.exe:Zoo Tycoon 2 Demo Executable
"{B343D3A6-736F-4D88-83E1-538DA1789B73}"= TCP:c:\program files\Microsoft Games\Zoo Tycoon 2 Trial Version\zt2demoretail.exe:Zoo Tycoon 2 Demo Executable
"{3D43AD31-7992-4A65-BC86-0564597E6F66}"= UDP:c:\users\Judy\Downloads\LimeWire\LimeWire.exe:LimeWire
"{0FCD10E3-73C8-404B-9843-2C54C15384F9}"= TCP:c:\users\Judy\Downloads\LimeWire\LimeWire.exe:LimeWire
"{30E6D005-B0BA-4D5F-B8E7-6816407E853A}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{C3B04A37-1C6D-47D8-8209-8B6BAE408FE2}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{A3FB2F95-13CD-4413-9756-D7844F8D764A}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{DF8398CD-AEB5-4767-88FC-B64941F6E822}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{02939F16-15CF-44D2-A88C-56830E3B3948}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{9EC9CFE8-985C-47F9-B54D-CFCE0DADB002}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{6198FBA6-8D46-47F3-8EBE-0D5A2299AE3B}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{E6C92F71-EDE5-4855-BCBD-A18DAC02CE8C}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{D9228AE2-17E9-4257-BE2B-EA17F60F6540}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{BFEC3500-4247-4F1E-90B6-E772500C7DC9}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{0B114AA3-5F80-4A34-A685-7BB288C4F9DF}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{14896EA4-0BFE-48F4-8976-72742DE2284A}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{D1C979EA-E5EB-4F08-897D-1AA79F56FD3D}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{0B6A602A-3B18-4B93-B5A8-748BB490CD8F}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{850938AA-685E-496C-A257-08AA1C84B6F7}"= UDP:c:\program files\iolo\System Shield 3\Personal Firewall\ioloFW.exe:iolo Firewall®
"{19461FAC-D788-472D-BE38-F7501C04534A}"= TCP:c:\program files\iolo\System Shield 3\Personal Firewall\ioloFW.exe:iolo Firewall®
"{4F2423AD-B8AE-42A8-99E9-582D2410FA7A}"= UDP:c:\program files\iolo\System Shield 3\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{3897B61B-0AD2-431A-A4B9-4ADB40E91905}"= TCP:c:\program files\iolo\System Shield 3\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{9B6900DE-0775-4E7F-B25D-362645534929}"= UDP:c:\program files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{6C2FC8B1-A23D-4D22-BDC1-BCE9F5C48392}"= TCP:c:\program files\iolo\System Shield 3\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{E2F7A70C-7BC7-4C8D-8819-C1688A307DBD}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{70B80C0B-7597-4F70-BA9C-2E28A668B2F8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{2BA29355-08D7-4B46-89E2-09B0D82FD728}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{6F04BE72-191F-47F5-88E3-7FA1F7002D71}"= UDP:c:\program files\iWin Games\iWinGames.exe:iWin Games application.
"{FE1FAB14-C8C6-43A3-AC9D-C85EF47BB3DB}"= TCP:c:\program files\iWin Games\iWinGames.exe:iWin Games application.
"{627CAD3B-2C33-4453-8AA5-53A0C9D66B54}"= UDP:c:\program files\iWin Games\WebUpdater.exe:iWin Games updater.
"{9D8D003C-6B2D-4E6E-AC95-07C6EF4D1505}"= TCP:c:\program files\iWin Games\WebUpdater.exe:iWin Games updater.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= c:\acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= c:\acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
"c:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= c:\acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption
R2 gupdate1c9dd44c9cdecca;Google Update Service (gupdate1c9dd44c9cdecca);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-25 133104]
R3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2008-08-22 18688]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2008-08-22 8320]
R3 motport;Motorola USB Diagnostic Port;c:\windows\system32\DRIVERS\motport.sys [2007-06-19 23680]
S0 XPacket;iolo Personal Firewall Driver;c:\windows\System32\xpacket.sys [2007-10-02 39424]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [2007-09-20 12800]
S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-02-26 628584]
S2 ioloProductUpdate;iolo Product Update Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-02-26 628584]
S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-02-26 628584]
S2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [2009-06-04 78104]
S2 MrHealthyService;MrHealthy;c:\program files\Norton PC Checkup\executables\mrHealthy\MrHealthy.exe [2009-01-29 578920]
— Other Services/Drivers In Memory —
*Deregistered* - mchInjDrv
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - ORPHANS REMOVED - - - -
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
HKLM-Run-sysfbtray - c:\windows\freddy57.exe
HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://en.us.acer.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZJxdm070YYUS
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\Judy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
LSP: c:\windows\system32\iavlsp.dll
LSP: c:\program files\iolo\Common\Firewall\iFW_Xfilter.dll
DPF: {C6E9F0B8-AFEA-46F3-831B-612E97381ABA} - hxxp://www.imvu.com/activex/imvustreamer.cab
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.
**************************************************************************
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files:
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(672)
c:\program files\iolo\Common\Firewall\iFW_Xfilter.dll
- - - - - - - > 'Explorer.exe'(4396)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\ShowErrMsg.dll
c:\program files\Common Files\Winferno\wse2007.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\audiodg.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\igfxsrvc.exe
c:\acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
c:\program files\AOL\AIM Toolbar 5.0\AolTbServer.exe
c:\program files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
c:\program files\MSN\Toolbar\3.0.0988.2\msntask.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Yahoo!\Companion\Installs\cpn1\ytbb.exe
.
**************************************************************************
.
Completion time: 2009-08-11 1:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-11 05:04
Pre-Run: 58,611,961,856 bytes free
Post-Run: 60,743,352,320 bytes free
456 — E O F — 2009-08-10 19:00
CatByte
Hi,
Please do the following:
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your C drive - the same place you saved combo-fix, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your C:\ drive;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
Please do the following:
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
- They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
http://forums.whatthetech.com/my_windows_defender_says_everything_fine_t105937.html&view=findpost&p=586470#entry586470
Collect::
c:\program files\iWin Games\iWinTrusted.exe
c:\windows\ckms134.dat
c:\windows\prxid93ps.dat
c:\windows\mmsmark2.dat
Folder::
c:\program files\iWin
c:\program files\iWin.com
c:\program files\iWin Games
c:\users\Administrator.Finally-PC\AppData\Roaming\MyWebSearch
c:\users\ADMINI~1.FIN\AppData\Roaming\MyWebSearch
Dirlook::
c:\users\Kayla\AppData\Local\temp
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6F04BE72-191F-47F5-88E3-7FA1F7002D71}"=-
"{FE1FAB14-C8C6-43A3-AC9D-C85EF47BB3DB}"=-
"{627CAD3B-2C33-4453-8AA5-53A0C9D66B54}"=-
"{9D8D003C-6B2D-4E6E-AC95-07C6EF4D1505}"=-
Driver::
iWinTrusted
DDS::
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZJxdm070YYUS
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your C drive - the same place you saved combo-fix, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your C:\ drive;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
- now navigate to your C: drive and locate the two files Combo-Fix.exe and ComboFix.txt
- drag the newly created CFScript.txt file and drop it into Combo-Fix.exe.
- ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
- When finished, it shall produce a log for you.
- Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
- Ensure you are connected to the internet and click OK on the message box.
HMH22
Question is script blocking the same as script debugging?
CatByte
No, it's different, but as long as your AV is disabled, you'll be fine
HMH22
OK when I draged it over and it was about a window came op saying update Combofix should I update or not I clicked on no?
CatByte
did it run?…if it didn't run, try it again and this time, click yes to the update
HMH22
Ok when I did it this time there was an error message saying you cannot rename ComboxFix as Combo-Fix Please use another name preferably made up of alphanumeric characters
CatByte
call it combafix
make sure you drag and drop the fix CFScript.txt into combafix before it runs
make sure you drag and drop the fix CFScript.txt into combafix before it runs
HMH22
Hi, ok I tried to post the log but it said it was to long to post do u want me to seperate it in posts.
CatByte
you can attach it…
use the upload feature on the bottom right of the reply window…browse to the combofix.txt…then upload, click on the uploaded text button to insert it into the post
HMH22
Ok i attached it
CatByte
Hi,
How is the computer running now? It should be running a lot better now.
Lets see if you can now download and save to your desktop.
Please do the following:
Please download Malwarebytes' Anti-Malware
Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
How is the computer running now? It should be running a lot better now.
Lets see if you can now download and save to your desktop.
Please do the following:
Please download Malwarebytes' Anti-Malware
- Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish, so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected. <– very important
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI