Vashmere
I do not have a windows installation disk-
The computer appears to be doing just fine, i'm just hoping the problems dont come back like last time.
Finished getting adobe and java
Spyware / Malware / Virus Removal
[Resolved] System infected background,popups, other bizzare behavior
21 min read
CatByte
Hi,
Please do the following:
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
NEXT
Please post a fresh DDS log
Please do the following:
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
- Double-click SystemLook.exe to run it.
- Copy the content of the following codebox into the main textfield:
:filefind *proquota*
- Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
NEXT
Please post a fresh DDS log
Vashmere
SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 13:45 on 05/12/2009 by Jesse (Administrator - Elevation successful)
========== filefind ==========
Searching for "*proquota*"
No files found.
-=End Of File=-
———————————————————————————————————————–
DDS
DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 13:46:26.76 on Sat 12/05/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.275 [GMT -5:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Documents and Settings\Jesse\Desktop\dds.pif
============== Pseudo HJT Report ===============
uStart Page = hxxp://blackle.com/
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [Easy SpyRemover] c:\program files\easy spyremover\EasySpyRemover.exe /smart
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [Uninstall Adobe Download Manager] "c:\windows\system32\rundll32.exe" "c:\program files\nos\bin\getPlus_Helper.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
StartupFolder: c:\docume~1\jesse\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: line6.net
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
============= SERVICES / DRIVERS ===============
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-11 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-11 74480]
R2 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2001-10-29 9296]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-11 7408]
S2 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2001-10-29 466944]
S3 L6TPortGX;Service - Line 6 TonePort GX;c:\windows\system32\drivers\l6tportgx.sys –> c:\windows\system32\drivers\L6TPortGX.sys [?]
S3 NAVAP;NAVAP;c:\program files\navnt\navap.sys [2001-10-29 178304]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20091118.003\NAVENG.sys [2009-11-20 84912]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20091118.003\NAVEX15.sys [2009-11-20 1323568]
=============== Created Last 30 ================
2009-12-05 15:28:44 73728 —-a-w- c:\windows\system32\javacpl.cpl
2009-12-05 15:28:44 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-02 20:43:30 77312 —-a-w- c:\windows\MBR.exe
2009-11-30 21:15:35 0 d—–w- C:\VundoFix Backups
2009-11-29 19:48:45 1 —-a-w- C:\s
2009-11-28 22:54:02 0 d—–w- c:\windows\system32\wbem\Repository
2009-11-25 00:47:50 0 d—–w- c:\windows\Logs
2009-11-25 00:47:42 0 d—–w- c:\program files\Virtools
2009-11-14 22:13:16 0 d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-11-14 22:12:51 0 d—–w- c:\program files\SUPERAntiSpyware
2009-11-14 22:12:51 0 d—–w- c:\docume~1\jesse\applic~1\SUPERAntiSpyware.com
2009-11-13 16:12:21 0 d—–w- c:\program files\common files\Wise Installation Wizard
2009-11-06 23:21:07 0 d—–w- C:\.jagex_cache_32
2009-11-06 23:16:00 63 —-a-w- c:\documents and settings\jesse\jagex_runescape_preferences2.dat
==================== Find3M ====================
2009-12-02 03:41:32 95360 ——w- c:\windows\system32\drivers\atapi.sys
2009-11-28 20:44:15 38 —-a-w- c:\documents and settings\jesse\jagex_runescape_preferences.dat
2009-11-14 06:47:57 260608 —-a-w- c:\windows\PEV.exe
============= FINISH: 13:46:44.37 ===============
————————————————————————————————————————————————————–
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 3/15/2007 6:31:14 AM
System Uptime: 12/2/2009 4:23:28 PM (69 hours ago)
Motherboard: Dell Computer Corp. | | 00T606
Processor: Intel® Celeron® CPU 1.80GHz | Microprocessor | 1800/400mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 149 GiB total, 133.575 GiB free.
D: is CDROM ()
E: is CDROM (CDFS)
==== Disabled Device Manager Items =============
Class GUID:
Description: Dell USB Smartcard Keyboard
Device ID: USB\VID_413C&PID_2100&MI_01\6&158DEE56&0&0001
Manufacturer:
Name: Dell USB Smartcard Keyboard
PNP Device ID: USB\VID_413C&PID_2100&MI_01\6&158DEE56&0&0001
Service:
==== System Restore Points ===================
RP578: 9/7/2009 11:14:02 AM - System Checkpoint
RP579: 9/8/2009 11:28:19 AM - System Checkpoint
RP580: 9/9/2009 12:28:17 PM - System Checkpoint
RP581: 9/10/2009 1:28:17 PM - System Checkpoint
RP582: 9/11/2009 2:28:18 PM - System Checkpoint
RP583: 9/18/2009 4:48:19 PM - System Checkpoint
RP584: 9/19/2009 5:24:21 PM - System Checkpoint
RP585: 9/20/2009 5:25:23 PM - System Checkpoint
RP586: 9/21/2009 6:24:19 PM - System Checkpoint
RP587: 9/22/2009 7:58:49 PM - System Checkpoint
RP588: 9/23/2009 8:24:21 PM - System Checkpoint
RP589: 9/24/2009 9:36:23 PM - System Checkpoint
RP590: 9/25/2009 10:37:06 PM - System Checkpoint
RP591: 9/26/2009 11:24:05 PM - System Checkpoint
RP592: 9/28/2009 12:28:45 PM - System Checkpoint
RP593: 9/29/2009 12:31:43 PM - System Checkpoint
RP594: 9/30/2009 1:19:41 PM - System Checkpoint
RP595: 10/1/2009 2:19:41 PM - System Checkpoint
RP596: 10/2/2009 2:36:41 PM - System Checkpoint
RP597: 10/3/2009 3:27:35 PM - System Checkpoint
RP598: 10/4/2009 6:44:41 PM - System Checkpoint
RP599: 10/5/2009 8:18:31 PM - System Checkpoint
RP600: 10/6/2009 8:25:48 PM - System Checkpoint
RP601: 10/7/2009 9:25:46 PM - System Checkpoint
RP602: 10/8/2009 9:26:51 PM - System Checkpoint
RP603: 10/9/2009 10:25:47 PM - System Checkpoint
RP604: 10/10/2009 11:25:46 PM - System Checkpoint
RP605: 10/12/2009 12:27:49 AM - System Checkpoint
RP606: 10/13/2009 1:25:30 AM - System Checkpoint
RP607: 10/14/2009 2:25:30 AM - System Checkpoint
RP608: 10/15/2009 3:25:35 AM - System Checkpoint
RP609: 10/16/2009 4:25:32 AM - System Checkpoint
RP610: 10/17/2009 4:45:59 AM - System Checkpoint
RP611: 10/18/2009 5:46:03 AM - System Checkpoint
RP612: 10/19/2009 5:47:07 AM - System Checkpoint
RP613: 10/20/2009 12:01:17 AM - Installed Connect Service
RP614: 10/21/2009 12:44:59 AM - System Checkpoint
RP615: 10/22/2009 1:45:00 AM - System Checkpoint
RP616: 10/23/2009 9:29:30 AM - System Checkpoint
RP617: 10/24/2009 9:43:42 AM - System Checkpoint
RP618: 10/25/2009 8:51:31 AM - System Checkpoint
RP619: 10/26/2009 10:45:39 AM - System Checkpoint
RP620: 10/27/2009 1:12:40 PM - System Checkpoint
RP621: 10/28/2009 1:49:59 PM - System Checkpoint
RP622: 10/29/2009 1:59:30 PM - System Checkpoint
RP623: 10/30/2009 4:25:33 PM - System Checkpoint
RP624: 10/31/2009 5:02:01 PM - System Checkpoint
RP625: 11/1/2009 2:20:30 PM - Removed Apple Mobile Device Support
RP626: 11/2/2009 2:49:19 PM - System Checkpoint
RP627: 11/3/2009 3:49:20 PM - System Checkpoint
RP628: 11/4/2009 4:49:21 PM - System Checkpoint
RP629: 11/5/2009 5:49:20 PM - System Checkpoint
RP630: 11/6/2009 5:50:30 PM - System Checkpoint
RP631: 11/7/2009 6:09:24 PM - System Checkpoint
RP632: 11/8/2009 6:56:28 PM - System Checkpoint
RP633: 11/9/2009 9:16:19 PM - System Checkpoint
RP634: 11/10/2009 9:34:31 PM - System Checkpoint
RP635: 11/11/2009 10:28:35 PM - System Checkpoint
RP636: 11/12/2009 9:21:26 PM - Restore Operation
RP637: 11/12/2009 9:30:19 PM - Restore Operation
RP638: 11/12/2009 9:36:37 PM - Restore Operation
RP639: 11/12/2009 10:11:14 PM - Restore Operation
RP640: 11/13/2009 11:17:19 AM - Restore Operation
RP641: 11/14/2009 11:37:55 AM - System Checkpoint
RP642: 11/14/2009 5:12:48 PM - Installed SUPERAntiSpyware Free Edition
RP643: 11/15/2009 5:34:30 PM - System Checkpoint
RP644: 11/16/2009 7:36:51 PM - System Checkpoint
RP645: 11/17/2009 8:15:37 PM - System Checkpoint
RP646: 11/18/2009 9:28:09 PM - System Checkpoint
RP647: 11/19/2009 9:33:36 PM - System Checkpoint
RP648: 11/20/2009 10:21:17 PM - System Checkpoint
RP649: 11/21/2009 10:47:08 PM - System Checkpoint
RP650: 11/22/2009 11:47:07 PM - System Checkpoint
RP651: 11/23/2009 11:59:02 PM - System Checkpoint
RP652: 11/24/2009 7:47:40 PM - Installed 3DVIA player 5.0
RP653: 11/27/2009 3:12:17 PM - System Checkpoint
RP654: 11/28/2009 3:27:23 PM - System Checkpoint
RP655: 11/28/2009 5:40:04 PM - Restore Operation
RP656: 11/28/2009 5:50:35 PM - Restore Operation
RP657: 11/28/2009 5:52:56 PM - Restore Operation
RP658: 11/29/2009 6:11:56 PM - System Checkpoint
RP659: 11/30/2009 6:41:53 PM - System Checkpoint
RP660: 12/1/2009 8:24:27 PM - System Checkpoint
RP661: 12/2/2009 9:05:26 PM - System Checkpoint
RP662: 12/3/2009 9:35:38 PM - System Checkpoint
RP663: 12/4/2009 10:38:48 PM - System Checkpoint
RP664: 12/5/2009 10:17:07 AM - Removed Adobe Reader 7.0.5
RP665: 12/5/2009 10:17:38 AM - Installed Adobe Reader 9.2.
RP666: 12/5/2009 10:24:00 AM - Removed J2SE Runtime Environment 5.0 Update 10
RP667: 12/5/2009 10:24:38 AM - Removed Java™ 6 Update 5
RP668: 12/5/2009 10:28:22 AM - Installed Java™ 6 Update 17
==== Installed Programs ======================
32 Bit HP CIO Components Installer
Acrobat.com
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
ArcSoft Print Creations
ArcSoft Print Creations - Album Page
ArcSoft Print Creations - Funhouse
ArcSoft Print Creations - Greeting Card
ArcSoft Print Creations - Photo Book
ArcSoft Print Creations - Photo Calendar
ArcSoft Print Creations - Scrapbook
ArcSoft Print Creations - Slimline Card
AT&T Internet Security Wizard 1.5.11
BellSouth Application Management
BufferChm
C4400
C4400_Help
Cards_Calendar_OrderGift_DoMorePlugout
CCleaner (remove only)
CCScore
Copy
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DeviceManagementQFolder
Easy SpyRemover 4.5
ERUNT 1.1j
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
eSupportQFolder
FastAccess® DSL Help Center 4.1
fflink
GPBaseService
HijackThis 2.0.2
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB945060-v3)
HP Imaging Device Functions 11.0
HP Photosmart Essential 2.5
HP Smart Web Printing
HP Update
HPPhotoSmartPhotobookWebPack1
HPProductAssistant
Intel® Extreme Graphics Driver
Intel® PRO Network Adapters and Drivers
iTunes
Java™ 6 Update 17
kgcbaby
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
Kodak EasyShare software
LiveUpdate 2.6 (Symantec Corporation)
Macromedia Flash 8 Video Encoder
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
netbrdg
Norton AntiVirus Corporate Edition
OfotoXMI
PanoStandAlone
PS_AIO_03_C4400_ProductContext
PS_AIO_03_C4400_Software
PS_AIO_03_C4400_Software_Min
PSSWCORE
QuickTime
Scan
SFR
SHASTA
skin0001
SKINXSDK
SmartWebPrinting
SolutionCenter
SoulSeek Client 156c
SoundMAX
staticcr
Status
SUPERAntiSpyware Free Edition
Toolbox
TrayApp
UnloadSupport
VideoToolkit01
VPRINTOL
WebFldrs XP
WebReg
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
WIRELESS
==== Event Viewer Messages From Past Week ========
12/1/2009 8:20:57 AM, error: Service Control Manager [7034] - The Terminal Services service terminated unexpectedly. It has done this 1 time(s).
12/1/2009 8:20:57 AM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
11/29/2009 3:41:23 PM, error: TermService [1036] - Terminal Server session creation failed. The relevant status code was 0xC0000037.
11/28/2009 5:55:43 PM, error: Service Control Manager [7023] - The Norton AntiVirus Client service terminated with the following error: The environment is incorrect.
11/28/2009 5:51:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
11/28/2009 5:51:45 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/28/2009 4:21:21 PM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
11/28/2009 4:19:26 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
11/28/2009 4:19:26 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
==== End Of File ===========================
Log created at 13:45 on 05/12/2009 by Jesse (Administrator - Elevation successful)
========== filefind ==========
Searching for "*proquota*"
No files found.
-=End Of File=-
———————————————————————————————————————–
DDS
DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 13:46:26.76 on Sat 12/05/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.275 [GMT -5:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Documents and Settings\Jesse\Desktop\dds.pif
============== Pseudo HJT Report ===============
uStart Page = hxxp://blackle.com/
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [Easy SpyRemover] c:\program files\easy spyremover\EasySpyRemover.exe /smart
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [Uninstall Adobe Download Manager] "c:\windows\system32\rundll32.exe" "c:\program files\nos\bin\getPlus_Helper.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
StartupFolder: c:\docume~1\jesse\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: line6.net
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
============= SERVICES / DRIVERS ===============
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-11 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-11 74480]
R2 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2001-10-29 9296]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-11 7408]
S2 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2001-10-29 466944]
S3 L6TPortGX;Service - Line 6 TonePort GX;c:\windows\system32\drivers\l6tportgx.sys –> c:\windows\system32\drivers\L6TPortGX.sys [?]
S3 NAVAP;NAVAP;c:\program files\navnt\navap.sys [2001-10-29 178304]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20091118.003\NAVENG.sys [2009-11-20 84912]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20091118.003\NAVEX15.sys [2009-11-20 1323568]
=============== Created Last 30 ================
2009-12-05 15:28:44 73728 —-a-w- c:\windows\system32\javacpl.cpl
2009-12-05 15:28:44 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-02 20:43:30 77312 —-a-w- c:\windows\MBR.exe
2009-11-30 21:15:35 0 d—–w- C:\VundoFix Backups
2009-11-29 19:48:45 1 —-a-w- C:\s
2009-11-28 22:54:02 0 d—–w- c:\windows\system32\wbem\Repository
2009-11-25 00:47:50 0 d—–w- c:\windows\Logs
2009-11-25 00:47:42 0 d—–w- c:\program files\Virtools
2009-11-14 22:13:16 0 d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-11-14 22:12:51 0 d—–w- c:\program files\SUPERAntiSpyware
2009-11-14 22:12:51 0 d—–w- c:\docume~1\jesse\applic~1\SUPERAntiSpyware.com
2009-11-13 16:12:21 0 d—–w- c:\program files\common files\Wise Installation Wizard
2009-11-06 23:21:07 0 d—–w- C:\.jagex_cache_32
2009-11-06 23:16:00 63 —-a-w- c:\documents and settings\jesse\jagex_runescape_preferences2.dat
==================== Find3M ====================
2009-12-02 03:41:32 95360 ——w- c:\windows\system32\drivers\atapi.sys
2009-11-28 20:44:15 38 —-a-w- c:\documents and settings\jesse\jagex_runescape_preferences.dat
2009-11-14 06:47:57 260608 —-a-w- c:\windows\PEV.exe
============= FINISH: 13:46:44.37 ===============
————————————————————————————————————————————————————–
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 3/15/2007 6:31:14 AM
System Uptime: 12/2/2009 4:23:28 PM (69 hours ago)
Motherboard: Dell Computer Corp. | | 00T606
Processor: Intel® Celeron® CPU 1.80GHz | Microprocessor | 1800/400mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 149 GiB total, 133.575 GiB free.
D: is CDROM ()
E: is CDROM (CDFS)
==== Disabled Device Manager Items =============
Class GUID:
Description: Dell USB Smartcard Keyboard
Device ID: USB\VID_413C&PID_2100&MI_01\6&158DEE56&0&0001
Manufacturer:
Name: Dell USB Smartcard Keyboard
PNP Device ID: USB\VID_413C&PID_2100&MI_01\6&158DEE56&0&0001
Service:
==== System Restore Points ===================
RP578: 9/7/2009 11:14:02 AM - System Checkpoint
RP579: 9/8/2009 11:28:19 AM - System Checkpoint
RP580: 9/9/2009 12:28:17 PM - System Checkpoint
RP581: 9/10/2009 1:28:17 PM - System Checkpoint
RP582: 9/11/2009 2:28:18 PM - System Checkpoint
RP583: 9/18/2009 4:48:19 PM - System Checkpoint
RP584: 9/19/2009 5:24:21 PM - System Checkpoint
RP585: 9/20/2009 5:25:23 PM - System Checkpoint
RP586: 9/21/2009 6:24:19 PM - System Checkpoint
RP587: 9/22/2009 7:58:49 PM - System Checkpoint
RP588: 9/23/2009 8:24:21 PM - System Checkpoint
RP589: 9/24/2009 9:36:23 PM - System Checkpoint
RP590: 9/25/2009 10:37:06 PM - System Checkpoint
RP591: 9/26/2009 11:24:05 PM - System Checkpoint
RP592: 9/28/2009 12:28:45 PM - System Checkpoint
RP593: 9/29/2009 12:31:43 PM - System Checkpoint
RP594: 9/30/2009 1:19:41 PM - System Checkpoint
RP595: 10/1/2009 2:19:41 PM - System Checkpoint
RP596: 10/2/2009 2:36:41 PM - System Checkpoint
RP597: 10/3/2009 3:27:35 PM - System Checkpoint
RP598: 10/4/2009 6:44:41 PM - System Checkpoint
RP599: 10/5/2009 8:18:31 PM - System Checkpoint
RP600: 10/6/2009 8:25:48 PM - System Checkpoint
RP601: 10/7/2009 9:25:46 PM - System Checkpoint
RP602: 10/8/2009 9:26:51 PM - System Checkpoint
RP603: 10/9/2009 10:25:47 PM - System Checkpoint
RP604: 10/10/2009 11:25:46 PM - System Checkpoint
RP605: 10/12/2009 12:27:49 AM - System Checkpoint
RP606: 10/13/2009 1:25:30 AM - System Checkpoint
RP607: 10/14/2009 2:25:30 AM - System Checkpoint
RP608: 10/15/2009 3:25:35 AM - System Checkpoint
RP609: 10/16/2009 4:25:32 AM - System Checkpoint
RP610: 10/17/2009 4:45:59 AM - System Checkpoint
RP611: 10/18/2009 5:46:03 AM - System Checkpoint
RP612: 10/19/2009 5:47:07 AM - System Checkpoint
RP613: 10/20/2009 12:01:17 AM - Installed Connect Service
RP614: 10/21/2009 12:44:59 AM - System Checkpoint
RP615: 10/22/2009 1:45:00 AM - System Checkpoint
RP616: 10/23/2009 9:29:30 AM - System Checkpoint
RP617: 10/24/2009 9:43:42 AM - System Checkpoint
RP618: 10/25/2009 8:51:31 AM - System Checkpoint
RP619: 10/26/2009 10:45:39 AM - System Checkpoint
RP620: 10/27/2009 1:12:40 PM - System Checkpoint
RP621: 10/28/2009 1:49:59 PM - System Checkpoint
RP622: 10/29/2009 1:59:30 PM - System Checkpoint
RP623: 10/30/2009 4:25:33 PM - System Checkpoint
RP624: 10/31/2009 5:02:01 PM - System Checkpoint
RP625: 11/1/2009 2:20:30 PM - Removed Apple Mobile Device Support
RP626: 11/2/2009 2:49:19 PM - System Checkpoint
RP627: 11/3/2009 3:49:20 PM - System Checkpoint
RP628: 11/4/2009 4:49:21 PM - System Checkpoint
RP629: 11/5/2009 5:49:20 PM - System Checkpoint
RP630: 11/6/2009 5:50:30 PM - System Checkpoint
RP631: 11/7/2009 6:09:24 PM - System Checkpoint
RP632: 11/8/2009 6:56:28 PM - System Checkpoint
RP633: 11/9/2009 9:16:19 PM - System Checkpoint
RP634: 11/10/2009 9:34:31 PM - System Checkpoint
RP635: 11/11/2009 10:28:35 PM - System Checkpoint
RP636: 11/12/2009 9:21:26 PM - Restore Operation
RP637: 11/12/2009 9:30:19 PM - Restore Operation
RP638: 11/12/2009 9:36:37 PM - Restore Operation
RP639: 11/12/2009 10:11:14 PM - Restore Operation
RP640: 11/13/2009 11:17:19 AM - Restore Operation
RP641: 11/14/2009 11:37:55 AM - System Checkpoint
RP642: 11/14/2009 5:12:48 PM - Installed SUPERAntiSpyware Free Edition
RP643: 11/15/2009 5:34:30 PM - System Checkpoint
RP644: 11/16/2009 7:36:51 PM - System Checkpoint
RP645: 11/17/2009 8:15:37 PM - System Checkpoint
RP646: 11/18/2009 9:28:09 PM - System Checkpoint
RP647: 11/19/2009 9:33:36 PM - System Checkpoint
RP648: 11/20/2009 10:21:17 PM - System Checkpoint
RP649: 11/21/2009 10:47:08 PM - System Checkpoint
RP650: 11/22/2009 11:47:07 PM - System Checkpoint
RP651: 11/23/2009 11:59:02 PM - System Checkpoint
RP652: 11/24/2009 7:47:40 PM - Installed 3DVIA player 5.0
RP653: 11/27/2009 3:12:17 PM - System Checkpoint
RP654: 11/28/2009 3:27:23 PM - System Checkpoint
RP655: 11/28/2009 5:40:04 PM - Restore Operation
RP656: 11/28/2009 5:50:35 PM - Restore Operation
RP657: 11/28/2009 5:52:56 PM - Restore Operation
RP658: 11/29/2009 6:11:56 PM - System Checkpoint
RP659: 11/30/2009 6:41:53 PM - System Checkpoint
RP660: 12/1/2009 8:24:27 PM - System Checkpoint
RP661: 12/2/2009 9:05:26 PM - System Checkpoint
RP662: 12/3/2009 9:35:38 PM - System Checkpoint
RP663: 12/4/2009 10:38:48 PM - System Checkpoint
RP664: 12/5/2009 10:17:07 AM - Removed Adobe Reader 7.0.5
RP665: 12/5/2009 10:17:38 AM - Installed Adobe Reader 9.2.
RP666: 12/5/2009 10:24:00 AM - Removed J2SE Runtime Environment 5.0 Update 10
RP667: 12/5/2009 10:24:38 AM - Removed Java™ 6 Update 5
RP668: 12/5/2009 10:28:22 AM - Installed Java™ 6 Update 17
==== Installed Programs ======================
32 Bit HP CIO Components Installer
Acrobat.com
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
ArcSoft Print Creations
ArcSoft Print Creations - Album Page
ArcSoft Print Creations - Funhouse
ArcSoft Print Creations - Greeting Card
ArcSoft Print Creations - Photo Book
ArcSoft Print Creations - Photo Calendar
ArcSoft Print Creations - Scrapbook
ArcSoft Print Creations - Slimline Card
AT&T Internet Security Wizard 1.5.11
BellSouth Application Management
BufferChm
C4400
C4400_Help
Cards_Calendar_OrderGift_DoMorePlugout
CCleaner (remove only)
CCScore
Copy
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DeviceManagementQFolder
Easy SpyRemover 4.5
ERUNT 1.1j
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
eSupportQFolder
FastAccess® DSL Help Center 4.1
fflink
GPBaseService
HijackThis 2.0.2
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB945060-v3)
HP Imaging Device Functions 11.0
HP Photosmart Essential 2.5
HP Smart Web Printing
HP Update
HPPhotoSmartPhotobookWebPack1
HPProductAssistant
Intel® Extreme Graphics Driver
Intel® PRO Network Adapters and Drivers
iTunes
Java™ 6 Update 17
kgcbaby
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
Kodak EasyShare software
LiveUpdate 2.6 (Symantec Corporation)
Macromedia Flash 8 Video Encoder
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
netbrdg
Norton AntiVirus Corporate Edition
OfotoXMI
PanoStandAlone
PS_AIO_03_C4400_ProductContext
PS_AIO_03_C4400_Software
PS_AIO_03_C4400_Software_Min
PSSWCORE
QuickTime
Scan
SFR
SHASTA
skin0001
SKINXSDK
SmartWebPrinting
SolutionCenter
SoulSeek Client 156c
SoundMAX
staticcr
Status
SUPERAntiSpyware Free Edition
Toolbox
TrayApp
UnloadSupport
VideoToolkit01
VPRINTOL
WebFldrs XP
WebReg
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
WIRELESS
==== Event Viewer Messages From Past Week ========
12/1/2009 8:20:57 AM, error: Service Control Manager [7034] - The Terminal Services service terminated unexpectedly. It has done this 1 time(s).
12/1/2009 8:20:57 AM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
11/29/2009 3:41:23 PM, error: TermService [1036] - Terminal Server session creation failed. The relevant status code was 0xC0000037.
11/28/2009 5:55:43 PM, error: Service Control Manager [7023] - The Norton AntiVirus Client service terminated with the following error: The environment is incorrect.
11/28/2009 5:51:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
11/28/2009 5:51:45 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/28/2009 4:21:21 PM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
11/28/2009 4:19:26 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
11/28/2009 4:19:26 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
==== End Of File ===========================
CatByte
I would consider removing Easy Spy Remover, all though it is not considered a Rogue program any longer (earlier versions were) there are much better programs out there. (MalwareBytes)
If you choose to remove it go to Start > Control Panel >Add/Remove programs. A list of installed programs will populate > scroll down to Easy Spy Remover and select REMOVE.
NEXT
Please do the following:
Go Start > Run and copy/paste the following single-line command into the Run box and click OK:
Let me know how that goes and if there are any other outstanding issues.
if not we can clean up the tools we have used.
If you choose to remove it go to Start > Control Panel >Add/Remove programs. A list of installed programs will populate > scroll down to Easy Spy Remover and select REMOVE.
NEXT
Please do the following:
Go Start > Run and copy/paste the following single-line command into the Run box and click OK:
cmd /c del /f/a/q "C:\s"
Let me know how that goes and if there are any other outstanding issues.
if not we can clean up the tools we have used.
Vashmere
everything appears to be back to normal… Ive just been defragging and using ccleaner and removing some unnessecary programs as recomended.
Thanks Catbyte this has been a huge help to me! I truly appreciate your time- It's great to know that theres people right on the other side of the malware battle like you are haha
CatByte
Hi,
Just some housekeeping to do now,
Please do the following:
Follow these steps to uninstall Combofix
[external image: Posted Image]
NEXT
Now to remove the rest of the tools that we have used in fixing your machine:
NEXT
Below I have included a number of recommendations for how to protect your computer against malware infections.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.
Thank you for your patience, and performing all of the procedures requested.
Please respond one last time so we can consider the thread resolved and close it, thank-you.
Just some housekeeping to do now,
Please do the following:
Follow these steps to uninstall Combofix
- Click START then RUN
- Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
[external image: Posted Image]
NEXT
Now to remove the rest of the tools that we have used in fixing your machine:
- Make sure you have an Internet Connection.
- Download OTC to your desktop and run it
- A list of tool components used in the Cleanup of malware will be downloaded.
- If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
- Click Yes to begin the Cleanup process and remove these components, including this application.
- You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.
NEXT
Below I have included a number of recommendations for how to protect your computer against malware infections.
- It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.
- Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
- SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
- SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
- Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
- ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
- MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:- Green to go
- Yellow for caution
- Red to stop
- Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here
If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
- Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
- ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
- In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.
Thank you for your patience, and performing all of the procedures requested.
Please respond one last time so we can consider the thread resolved and close it, thank-you.
Vashmere
Hmm could you field a guess as to why I don't have sound? I hadn't noticed that…
But anyways ive gotten all cleaned up, and i'm using firefox (long time comming haha) ive also got spyware blaster now
Again thank thank thank you CatByte!
CatByte
go into device manager and let me know if there are any warnings there: (yellow or red triangles with exclamation marks)
Start > Run > type devmgmt.msc > OK
Start > Run > type devmgmt.msc > OK
Vashmere
Nevermind problem solved! hahaha Thanks Catbyte 
CatByte
(you going to let me in on what it was? 
)
CatByte
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI