What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] ComboFix & Hijack This complete - next steps?

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I didn't get back here quickly enough and my last post was closed. This is a link to that thread:
http://forums.whatthetech.com/Hijack_Log_f…419#entry590419

I have followed all the instructions given in that last thread and have attached the log files from the combofix and hijack this as instructed.

My computers performance seems to have imporved somewhat since I ran the ATF Cleaner and Combofix. However there seems to still be a slight problem.

The speed of my computer has improved a great deal but when I click on anything, i.e. to open a file, open windows explorer, open internet explorer and proceed to my email, the procees still takes anywhere from 2-4 minutes from the click to the appropriate window opening. Frequently the cursor will freeze, the circle (vista hourglass) will spin and at the top of the window in brackets it will read (Not Responding).

Everything else seems to have improved.

Thanks in advance for any help. It's great not having to sit on the phone for hours trying to explain to someone reading a scrip that…"yes I did that….yes I did THAT TOO"…

E.

Attachments:

Post #3
Update: Any mouse click results in a wait of 3-4 minutes before the window opens or the menu clicked on opens. It has been 18 minutes since I first began the process of simply opening the Combofix log file, selecting the text, copying, and coming here to paste. In the time it has taken me to type this (I type fast with both hands) the computer has frozen 3 times.

I hope you can explain what is happening and how I can correct it.
Thanks

Combo Fix log file:

ComboFix 09-09-12.01 - Esther 12/09/2009 16:53.1.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.2.1033.18.446.113 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Bell Internet Security Services Anti-Virus *On-access scanning disabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: Bell Internet Security Services Firewall *disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
SP: AVG Anti-Spyware *disabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604}
SP: Bell Internet Security Services Anti-Spyware *disabled* (Updated) {307352C6-1CBD-11DB-8AF6-B622A1EF5492}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
c:\$recycle.bin\S-1-5-21-3338010355-403825504-3073668275-500
c:\$recycle.bin\S-1-5-21-809982700-90021882-252782198-500
c:\programdata\ntuser.dat{5b4672f8-e37c-11dd-8839-001bb985c1cf}.TMContainer00000000000000000001.regtrans-ms
c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((( Files Created from 2009-08-12 to 2009-09-12 )))))))))))))))))))))))))))))))
.

2009-09-12 21:21 . 2009-09-12 21:21 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-09-12 21:21 . 2009-09-12 21:21 ——– d—–w- c:\users\Polly\AppData\Local\temp
2009-09-10 21:44 . 2009-09-12 15:13 7469088 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-10 21:38 . 2009-09-10 21:38 ——– d—–w- c:\windows\Roaming
2009-09-10 17:11 . 2008-08-28 17:16 71184 —-a-w- c:\windows\system32\drivers\DefragFS.sys
2009-09-10 17:10 . 2009-09-10 17:10 ——– d—–w- c:\programdata\Raxco
2009-09-10 17:10 . 2009-09-10 17:10 ——– d—–w- c:\program files\Raxco
2009-09-10 17:04 . 2009-09-10 17:04 ——– d—–w- C:\Bell
2009-09-10 01:15 . 2009-07-11 19:32 293376 —-a-w- c:\windows\system32\wlanmsm.dll
2009-09-10 01:15 . 2009-07-11 19:29 127488 —-a-w- c:\windows\system32\L2SecHC.dll
2009-09-10 01:15 . 2009-07-11 19:32 302592 —-a-w- c:\windows\system32\wlansec.dll
2009-09-10 01:15 . 2009-07-11 19:32 513024 —-a-w- c:\windows\system32\wlansvc.dll
2009-09-10 01:13 . 2009-08-14 17:07 897608 —-a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-10 01:13 . 2009-08-14 16:29 104960 —-a-w- c:\windows\system32\netiohlp.dll
2009-09-10 01:13 . 2009-08-14 14:16 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2009-09-10 01:13 . 2009-08-14 14:16 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2009-09-10 01:13 . 2009-08-14 14:16 19968 —-a-w- c:\windows\system32\ARP.EXE
2009-09-10 01:13 . 2009-08-14 14:16 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2009-09-10 01:13 . 2009-08-14 14:16 10240 —-a-w- c:\windows\system32\finger.exe
2009-09-10 01:13 . 2009-08-14 14:16 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2009-09-10 01:13 . 2009-08-14 14:16 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2009-09-10 01:13 . 2009-08-14 16:29 17920 —-a-w- c:\windows\system32\netevent.dll
2009-09-10 00:56 . 2009-06-10 12:11 2868224 —-a-w- c:\windows\system32\mf.dll
2009-09-02 23:09 . 2009-08-28 12:39 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2009-09-02 23:09 . 2009-08-28 10:15 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-26 04:48 . 2009-06-22 10:22 2048 —-a-w- c:\windows\system32\tzres.dll
2009-08-18 14:28 . 2009-08-18 14:28 ——– d—–w- c:\program files\Trend Micro
2009-08-14 00:17 . 2009-06-15 15:21 499712 —-a-w- c:\windows\system32\kerberos.dll
2009-08-14 00:17 . 2009-06-15 15:24 175104 —-a-w- c:\windows\system32\wdigest.dll
2009-08-14 00:17 . 2009-06-15 15:22 213504 —-a-w- c:\windows\system32\msv1_0.dll
2009-08-14 00:17 . 2009-06-15 15:24 270848 —-a-w- c:\windows\system32\schannel.dll
2009-08-14 00:17 . 2009-06-15 15:23 1256448 —-a-w- c:\windows\system32\lsasrv.dll
2009-08-14 00:17 . 2009-06-15 18:20 439896 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-14 00:17 . 2009-06-15 15:24 72704 —-a-w- c:\windows\system32\secur32.dll
2009-08-14 00:17 . 2009-06-15 12:57 9728 —-a-w- c:\windows\system32\lsass.exe
2009-08-13 23:02 . 2009-08-13 23:02 ——– d—–w- c:\windows\system32\ErrorLogs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-12 20:07 . 2007-06-28 08:06 ——– d—–w- c:\programdata\Roxio
2009-09-12 15:13 . 2009-09-10 21:44 8036 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-10 22:36 . 2007-10-11 16:08 ——– d—–w- c:\users\Esther\AppData\Roaming\Bell
2009-09-10 21:44 . 2008-06-13 00:42 ——– d—–w- c:\program files\Personal Vault
2009-09-10 21:44 . 2007-10-11 16:08 ——– d—–w- c:\programdata\Bell
2009-09-10 17:09 . 2008-05-23 22:22 ——– d—–w- c:\program files\Bell
2009-09-10 17:09 . 2007-06-28 07:44 ——– d—–w- c:\program files\InstallShield Installation Information
2009-09-10 11:21 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-08-04 00:56 . 2009-07-20 07:02 ——– d—–w- c:\programdata\NOS
2009-08-04 00:56 . 2009-07-20 07:02 ——– d—–w- c:\program files\NOS
2009-08-03 06:28 . 2008-09-13 15:28 ——– d—–w- c:\users\Esther\AppData\Roaming\System Tweaker
2009-07-21 21:52 . 2009-07-29 03:59 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 03:59 109056 —-a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 03:59 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 03:59 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2009-07-19 16:17 . 2007-10-11 15:46 100728 —-a-w- c:\users\Esther\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-17 14:35 . 2009-08-13 10:17 71680 —-a-w- c:\windows\system32\atl.dll
2009-07-17 04:55 . 2009-06-16 00:17 ——– d—–w- c:\users\Esther\AppData\Roaming\Azureus
2009-07-14 13:00 . 2009-08-13 10:16 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-13 10:15 4096 —-a-w- c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-13 10:15 7680 —-a-w- c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-13 10:15 8147456 —-a-w- c:\windows\system32\wmploc.DLL
2009-06-15 15:24 . 2009-07-15 02:41 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-15 02:41 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-15 02:41 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-15 02:41 289792 —-a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VaultIcon1]
@="{B976888E-DC7B-456C-A62F-44EA07ED231F}"
[HKEY_CLASSES_ROOT\CLSID\{B976888E-DC7B-456C-A62F-44EA07ED231F}]
2009-07-02 19:32 503808 —-a-w- c:\program files\Personal Vault\VaultClientMenu.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-08-16 5728112]
"Uniblue RegistryBooster 2009"="c:\program files\uniblue\registrybooster\StartRegistryBooster.exe" [2008-08-26 99624]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2008-07-03 812952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-04 148888]
"SSA.exe"="c:\program files\Bell\Internet Service Advisor\SSA.exe" [2009-06-29 3245296]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-01 4390912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Esther^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{E108F155-97AC-40C1-A0E3-FA6CCF250E6D}"= c:\program files\HP\DVDPlay\DVDPlay.exe:DVD Play
"{198D9211-8BC1-4342-9BAD-BB1B4BA48100}"= c:\program files\HP\DVDPlay\DPService.exe:DVD Play Resident Program
"{81365755-CC76-4486-B6A4-CA7F4EB7B82E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{DC1E6CB6-6FDF-4E58-8E8F-E926972D2116}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E0E6A6C8-2351-4AA9-8055-3EE3E85B722B}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F8D7EE02-DA75-49D4-AE0D-572261283C6B}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{8571CEF0-B5FD-4572-8907-1D0610315C63}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{C9EDB1A8-17FE-4115-A66E-603D481F24EA}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{7C86AFCD-E2C5-43E8-A932-368F45708E26}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{03AE27F7-7645-4F47-B1F7-54FA68D72431}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{6FAEC821-FD34-42C6-9A64-43CEF2D923FF}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{DE2A6941-F14C-47D3-95D2-EFFCFA83914B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9ABB6E6B-6729-44D2-AA9A-D7247C33E148}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{67C6A91F-15EB-409F-8205-351D1DDBA6E6}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{958EDC85-A9B0-4774-BD8D-DB2CCB3FD252}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{C09D0FAB-5408-4AC8-AEF0-3DD176F9A7C1}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqtra08.exe:hpqtra08.exe
"{EC3F3CC5-BE22-4D8B-A1E9-922357FBFC14}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{2BFD0A13-DF4B-4D1E-8415-C088ED5DFA67}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqste08.exe:hpqste08.exe
"{8C484E93-39D2-4C2D-807A-CDF39D64080A}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{0F773ACA-CD16-49F7-A7D2-5024B1C0E30D}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpofxm08.exe:hpofxm08.exe
"{5680B2CE-1DF9-4C75-96B3-97EAEF0A6870}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{8E56AEB6-A484-4C6E-BB93-ECC4FAFD4485}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hposfx08.exe:hposfx08.exe
"{68EF703C-8F9C-4D7B-81DF-80B4CDDFDBB4}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{EB240FC4-E0E4-4220-9A6C-3D4029026AA5}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hposid01.exe:hposid01.exe
"{3BFB3BFC-188C-4ABB-A8E8-E552458BD3F1}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{B5AB70C9-5028-47A9-93E5-92482EE0DE66}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqscnvw.exe:hpqscnvw.exe
"{836FE781-058A-4101-85E2-A45C6BB2D85D}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{7CC1C616-CA30-410C-839E-7283C912534E}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqkygrp.exe:hpqkygrp.exe
"{3D0AEB3D-AF53-4362-BDDF-4E0D4881D7B0}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{1C2E21EF-CC07-4185-B68F-20CE669EC8EF}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpzwiz01.exe:hpzwiz01.exe
"{33E2D700-9ABB-4866-9E3B-1B4D0BD691CC}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{FB04593F-6EE8-4DDA-A42E-603F2B851AE1}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpoews01.exe:hpoews01.exe
"{52BF82A0-B73B-4DCD-93E5-F29879968261}"= Disabled:UDP:c:\program files\HP\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{BD6781C4-1CB0-436C-BF0C-B10C53EA85C8}"= Disabled:TCP:c:\program files\HP\Digital Imaging\bin\hpqnrs08.exe:hpqnrs08.exe
"{371441EA-3710-467F-BEC6-36C3C294D6D2}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F8BE08EE-B1DB-4DE4-9F96-8FDB560D9B54}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F8CE5C5A-CF3B-4BAA-B5E4-71F5FF12A2F2}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{80671BDA-E842-43C2-BBAC-C3B89F018949}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{7136986D-E1EC-4AFA-9641-212DFF0F2210}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F148DC0E-16DC-4A4B-A7FD-EBB7FF2DA872}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B3EF1E06-87D4-4BB1-8676-2AEACBB4CD24}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{CD0F0310-9C39-4018-87A6-63BF272B5450}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 RadialpointSafeConnectAgent;Bell Internet Security Services SafeConnectAgent;c:\program files\Bell\Bell Internet Security Services\SafeConnect\bin\SanaAgent.exe [14/11/2008 6:28 PM 4937752]
R3 RadialpointSafeConnectDriver;RadialpointSafeConnectDriver;c:\program files\Bell\Bell Internet Security Services\SafeConnect\Driver\platform_VISTA\SafeConnectDriver.sys [14/11/2008 6:28 PM 161304]
R3 RadialpointSafeConnectFilter;RadialpointSafeConnectFilter;c:\program files\Bell\Bell Internet Security Services\SafeConnect\Driver\platform_VISTA\SafeConnectFilter.sys [14/11/2008 6:28 PM 29720]
R3 RadialpointSafeConnectShim;RadialpointSafeConnectShim;c:\program files\Bell\Bell Internet Security Services\SafeConnect\Driver\platform_VISTA\SafeConnectShim.sys [14/11/2008 6:28 PM 29248]
S2 PD91Agent;PD91Agent;c:\program files\Raxco\PerfectDisk2008\PD91Agent.exe [22/09/2008 4:58 PM 693512]
S3 PD91Engine;PD91Engine;c:\program files\Raxco\PerfectDisk2008\PD91Engine.exe [22/09/2008 4:58 PM 910600]
S3 Radialpoint Security Services;Bell Internet Security Services;c:\program files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe [07/07/2009 1:24 PM 170736]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder

2009-09-12 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\users\Polly\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-07 04:08]

2009-09-12 c:\windows\Tasks\User_Feed_Synchronization-{53A90658-DD1C-4D1D-ABCD-6D894817FCC4}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.weatheroffice.gc.ca/city/pages/on-91_metric_e.html
mStart Page = hxxp://sympatico.ca
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.
.
——- File Associations ——-
.
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-12 17:22
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-09-12 17:39
ComboFix-quarantined-files.txt 2009-09-12 21:39

Pre-Run: 74,683,658,240 bytes free
Post-Run: 74,620,882,944 bytes free

240 — E O F — 2009-09-10 11:30


Hijack This Log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:36:03 PM, on 12/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bell\Bell Internet Security Services\rps.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91AgentS1.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Bell\Internet Service Advisor\SSA.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Bell\Internet Service Advisor\SSAComHandler.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
C:\Windows\system32\conime.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weatheroffice.gc.ca/city/pages/…1_metric_e.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.ca
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Bell\Bell Internet Security Services\pkR.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Internet Service Advisor\SSA.exe" /AUTORUN
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: Bell Internet Security Services (Radialpoint Security Services) - Bell - C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
O23 - Service: Bell Internet Security Services SafeConnectAgent (RadialpointSafeConnectAgent) - Sana Security - C:\Program Files\Bell\Bell Internet Security Services\SafeConnect\Bin\SanaAgent.exe
O23 - Service: Bell Internet Security Services Firewall (RP_FWS) - Bell - C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
O23 - Service: Personal Vault Backup Service (VaultClientSRV) - Bell Canada - C:\Program Files\Personal Vault\VaultClientSRV.exe

–
End of file - 5892 bytes


To reach this point it has taken me over 40 minutes, multiple frozen screens and now as I type the letters are appearing on the screen with 2 second delays between each key stroke.
Post #4
1. All tools MUST be run from the executable. (.exe)
With Admin Rights (Right click on HijackTHis each time you use it, choose "Run as Administrator")


1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Windows Search
Bonjour


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #5
Hello,
I followed your instructions and was able to remove/uninstall Bonjour but could not find Windows Search.

There is a noticable improvement in the speed of my computer but it still tends to freeze after a mouse click. As I type this, the letters are appearing immediately as I type the key strokes. This is definitely an improvement.

So far so good! Thank you!

The following is the HijackThis log file as you instructed:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:57:59 PM, on 13/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bell\Bell Internet Security Services\rps.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91AgentS1.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Bell\Internet Service Advisor\SSAComHandler.exe
C:\Program Files\Bell\Internet Service Advisor\SSA.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\wsqmcons.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weatheroffice.gc.ca/city/pages/…1_metric_e.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Bell\Bell Internet Security Services\pkR.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Internet Service Advisor\SSA.exe" /AUTORUN
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: Bell Internet Security Services (Radialpoint Security Services) - Bell - C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
O23 - Service: Bell Internet Security Services SafeConnectAgent (RadialpointSafeConnectAgent) - Sana Security - C:\Program Files\Bell\Bell Internet Security Services\SafeConnect\Bin\SanaAgent.exe
O23 - Service: Bell Internet Security Services Firewall (RP_FWS) - Bell - C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
O23 - Service: Personal Vault Backup Service (VaultClientSRV) - Bell Canada - C:\Program Files\Personal Vault\VaultClientSRV.exe

–
End of file - 5496 bytes
Post #6
1. All tools MUST be run from the executable. (.exe)
With Admin Rights (Right click on HijackTHis each time you use it, choose "Run as Administrator")

These aren't bad but aren't need to auto start either.

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H

Close ALL windows and browsers except HijackThis and click "Fix checked"


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #7
I have completed the latest tasks you recommended and rebooted my machine. Things have improved with the start up sequence. It is much faster.

One thing that is still a problem is the delay after I click on anything…i.e. when I opened IE I clicked once, everything froze and again (Not Responding) appeared at the top of the window. When Icame to log in to send the lates HJT log file my system froze when I clicked to add my user name and password. It took roughly 3 minutes for everything to come back so I could add the information. Once I was logged in there were no problems. Everything functioned smoothly.

I am back to work tomorrow and may not get to this until Saturday again…
Thanks for your help so far, Things are coming along nicely so far.

Here is the log file form my last HJT scan:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:55:51 PM, on 13/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bell\Bell Internet Security Services\rps.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Bell\Internet Service Advisor\SSA.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91AgentS1.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91AgentS1.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91AgentS1.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91AgentS1.exe
C:\Program Files\Bell\Internet Service Advisor\SSAComHandler.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\wsqmcons.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weatheroffice.gc.ca/city/pages/…1_metric_e.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Bell\Bell Internet Security Services\pkR.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Internet Service Advisor\SSA.exe" /AUTORUN
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: Bell Internet Security Services (Radialpoint Security Services) - Bell - C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
O23 - Service: Bell Internet Security Services SafeConnectAgent (RadialpointSafeConnectAgent) - Sana Security - C:\Program Files\Bell\Bell Internet Security Services\SafeConnect\Bin\SanaAgent.exe
O23 - Service: Bell Internet Security Services Firewall (RP_FWS) - Bell - C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
O23 - Service: Personal Vault Backup Service (VaultClientSRV) - Bell Canada - C:\Program Files\Personal Vault\VaultClientSRV.exe

–
End of file - 4935 bytes
Post #9
Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    To be on the safe side, I would also change all my passwords.


    Here's my usual all clean post

    Log looks good :D


    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      • From within Internet Explorer click on the Tools menu and then click on Options.
      • Click once on the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.


I would suggest you read How to Prevent Malware:
Post #10
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI