What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] how to stop av_md.exe from being added to start up

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Free AVG reported that a command to run the file AV_MD.EXE was being added to start up.

I have removed the av_md.exe files from C:\windows\system32\ and C:\windows\system32\config\systemprofile\

When I unchecked them in my startup manager (C:\windows\system32\config\systemprofile\av_md.exe unchecked from HKCU/Run and C:\windows\system32\av_md.exe unchecked from HKLM/Run) they would immediately return and the AVG would report it again.

I also had the ATAPI.SYS file reported as containing a Trojan Horse Packed.Protector.C The file size was 146K when Microsoft says it should be 95K. I renamed the file extension .bak
I then tried to restore to an earlier date and the restore failed. But when the system restarted the ATAPI.SYS file was back in the C:\windows\system32\ folder and it is 95K. I then moved the 146K file that AVG reported as containing the Trojan Horse Packed.Protector.C to the virus vault.

As I type this I realize that unchecking the AV_MD.EXE in the start up manager no longer results in them being instantly readded. Maybe the two are connected.

Anyway, I have a hijackthis log file that I prepared and am attaching it. Although I think the problem is solved. If the virus reports/warnings come back I will add to this post.

My question is: Does anything look abnormal in the log?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:44:58 PM, on 12/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wentxp.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\ASUS\Asus Probe\AsusProb.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\POP Peeper\POPPeeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\SYSTEM32\taskmgr.exe
H:\Data\Downloads\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 150.176.182.32:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;*.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\Stopzilla!\Toolbar\SZSG.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: LEC - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - C:\Program Files\Power Translator\Applications\LEC IE Translation Extension.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\Stopzilla!\Toolbar\SZSG.dll
O4 - HKLM\..\Run: [ASUS Probe] "C:\Program Files\ASUS\Asus Probe\AsusProb.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] "C:\PROGRA~1\AVG\AVG8\avgtray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\SYSTEM32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NokiaMServer] "C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer" /watchfiles startup
O4 - HKLM\..\Run: [av_md] C:\WINDOWS\system32\av_md.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [POP Peeper] "C:\Program Files\POP Peeper\POPPeeper.exe" -min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [av_md] C:\WINDOWS\system32\config\systemprofile\av_md.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Clear Fields - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra 'Tools' menuitem: Clear Fields - {320AF880-6646-11D3-ABEE-C5DBF3571F54} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComClearFields.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.macromedia.com
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1187595567843
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.236.73:8000//activex/AxisCamControl.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Update Service (gupdate1c9d8c4a1f1518a) (gupdate1c9d8c4a1f1518a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Fotoprix\FotoLibro\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: WinEncrypt service (wencrservice) - WinEncrypt - C:\WINDOWS\SYSTEM32\wentxp.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe

–
End of file - 12837 bytes

Attachments:

Post #2 last edited
Hi

HJT doesn't tell us much these days, (other than I can see you still have av_md.exe on your system) we need deeper diagnostic scans and an ARK scan to really see whats going on on your computer.

Please do not run any other scans or do any more deletions unless instructed:


Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
When you said I still had AV_MD.exe on the computer I realized that I hadn't actually removed the files but only renamed them .bak so they would not run even if I couldn't stop then from being added to the start up list. So I went in and deleted them from the C:\windows\system32\ and the C:\windows\system32\config\systemprofile\ folders. Then I saw the instruction not to delete anything else. sorry! OK attached are the files requested, remembering that I deleted two files named AV_MD.BAK from the above folders.

Attachments:

Post #4
Hi,

You have a number of SPDT drivers on your system from Alcohol120 and Daemon Tools, they sometimes interfere with our tools:

The following program will disable those drivers temporarily. We will enable them once the computer is clean.


Please do the following:

Please download DeFogger to your desktop.
Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.



NEXT


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
One question, I have Alcohol120 on my computer but I don't use it. If it is problematical should I just remove it in your opinion? OK, here is what happened: I ran DeFogger and did not get error message WHILE RUNNING DeFogger. the system failed twice to boot up after restart. I hit "start windows normally" and on the second attempt it rebooted. The DeFogger error message was on the desktop when the computer came back up. It is attached. NOTE: I had to change it to a .txt file to be able to upload it. The error said it couldn't find the SPDT drivers and required a reboot. I then tried running ComboFix. I turned off the SpySweeper and Free AVG programs first and then double clicked on ComboFix. I got a warning (attached as warning.jpg) saying the anti-virus program was still running. I checked the windows task manager Neither Spy sweeper nor Free AVG are shown as running in the windows task manager's applications tab. but under processes there are five AVG—.exe's and one SpySweeper.exe listed. (avgnsx.exe, avgrsx.exe, avgemc.exe, avgwdsvc.exe, and avgcsrvx.exe) I highlighted them and hit "EndProcess" but they just reappear. rather than hit OK, I hit the "X" at the top of the warning box with the intention of stopping the ComboFix program but I got a second warning (attached as warning2.jpg) saying the anti-virus was still running and ComboFix was going to continue to run. and "Kindly note that this is at your own risk." I don't want any risks, I want to shut off ComboFix until this is cleared up!!!! :-) Now I don't want to hit the "X" in the second warning window for fear the program will run anyway. I will keep the computer as is until I hear from you. Thanks, Dan

Attachments:

Post #6
Hi,

Disable AVG by doing the following:

  • open AVG User Interface
  • double-click on the Resident Shield
  • un-tick the option "Resident Shield active"
  • save the changes.

As long as you do that. ComboFix will be fine to run.
Post #7
ComboFix ran fine and produced a log; it is attached. I did have a warning pop up telling me about a program that quit working (PEV.cfxxe) and asking if I wanted to send a report to Microsoft. I didn't click on anything, neither "don't send report" nor "send report" as the warning in the Combofix instructions said mouse clicking on ComboFix's window may cause it to stall. At the end of the ComboFix's cycle the pop-up disappeared. Also, installing the recovery console caused Internet Explorer to become my default browser. I changed that back to Firefox. I also had to reset my wireless connection to allow windows to control it to get it working. Everything is up and running at the moment. Dan

Attachments:

Post #8 last edited
Hi,

Please delete the copy of ComboFix that you have from your desktop and download a fresh copy. Disable your security programs as you did before, then do the following:


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/how_stop_av_md_exe_being_added_start_up_t108697.html

Collect::
c:\windows\system32\fjhdyfhsn.bat
c:\documents and settings\Default User\Application Data\fvgqad.dat
c:\documents and settings\Dan\Application Data\avdrn.dat
c:\windows\DUMP7937.tmp
c:\windows\DUMP7acd.tmp
c:\windows\DUMP730d.tmp

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #9
Here is the log. File is also attached.

ComboFix 09-12-08.03 - Dan 12/08/2009 22:22:37.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.469 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

file zipped: c:\documents and settings\Dan\Application Data\avdrn.dat
file zipped: c:\documents and settings\Default User\Application Data\fvgqad.dat
file zipped: c:\windows\DUMP730d.tmp
file zipped: c:\windows\DUMP7937.tmp
file zipped: c:\windows\DUMP7acd.tmp
file zipped: c:\windows\system32\fjhdyfhsn.bat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Dan\Application Data\avdrn.dat
c:\documents and settings\Dan\cookies-dan_and_maria.txt
c:\documents and settings\Dan\cookies-daniel_in_spain.txt
c:\documents and settings\Dan\Favorites\Videos.url
c:\documents and settings\Dan\My Documents\ZbThumbnail.info
c:\documents and settings\Dan\Start Menu\Programs\Videos.url
c:\documents and settings\Default User\Application Data\fvgqad.dat
c:\windows\DUMP730d.tmp
c:\windows\DUMP7937.tmp
c:\windows\DUMP7acd.tmp
c:\windows\system32\fjhdyfhsn.bat

.
((((((((((((((((((((((((( Files Created from 2009-11-08 to 2009-12-08 )))))))))))))))))))))))))))))))
.

2009-12-07 11:44 . 2009-12-07 11:44 152576 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-07 11:44 . 2009-12-07 11:44 79488 —-a-w- c:\documents and settings\Dan\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-06 10:07 . 2009-12-06 10:07 ——– d—–w- c:\documents and settings\All Users\Application Data\SITEguard
2009-12-06 10:05 . 2009-12-06 13:39 ——– d—–w- c:\program files\STOPzilla!
2009-12-06 10:05 . 2009-12-06 10:05 ——– d—–w- c:\program files\Common Files\iS3
2009-12-06 10:05 . 2009-12-06 13:28 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-12-04 21:08 . 2009-08-05 21:48 54752 —-a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-12-04 21:01 . 2009-12-04 21:01 ——– d—–w- c:\program files\Microsoft
2009-12-04 21:01 . 2009-12-04 21:01 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-12-04 20:53 . 2009-12-04 20:53 ——– d—–w- c:\program files\Common Files\Windows Live
2009-12-04 20:25 . 2009-12-04 20:25 ——– d—–w- c:\windows\Performance
2009-12-04 20:25 . 2009-12-04 20:25 ——– d—–w- c:\documents and settings\Dan\Local Settings\Application Data\Microsoft Corporation
2009-12-04 20:24 . 2009-12-04 20:24 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-11-29 15:00 . 2009-11-29 15:00 ——– d—–w- c:\windows\system32\wbem\Repository
2009-11-26 09:27 . 2009-11-26 09:27 ——– d—–w- c:\documents and settings\Dan\Bluetooth Software
2009-11-26 09:27 . 2009-11-26 09:27 ——– d—–w- c:\program files\Belkin
2009-11-25 21:16 . 2009-11-26 09:27 ——– d—–w- c:\program files\Belkin(4)
2009-11-25 09:53 . 2009-11-25 09:53 ——– d—–w- c:\program files\DjVuZone
2009-11-22 10:43 . 2009-11-22 10:43 ——– d—–w- C:\Alberto
2009-11-12 10:46 . 2009-11-12 10:46 ——– d—–w- C:\Garmin
2009-11-11 15:02 . 2009-11-12 10:59 ——– d—–w- c:\documents and settings\Dan\Application Data\GARMIN
2009-11-11 15:02 . 2009-11-11 15:02 ——– d—–w- c:\documents and settings\All Users\Application Data\GARMIN

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-08 17:22 . 2007-03-21 19:52 ——– d—–w- c:\documents and settings\Dan\Application Data\Skype
2009-12-08 17:04 . 2006-09-28 21:01 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-12-07 21:47 . 2006-09-30 16:05 ——– d—–w- c:\documents and settings\Dan\Application Data\Canon
2009-12-07 12:41 . 2007-04-21 09:16 ——– d—–w- c:\documents and settings\Dan\Application Data\Azureus
2009-12-07 11:47 . 2006-09-30 16:32 ——– d—–w- c:\program files\Java
2009-12-07 11:36 . 2007-04-21 09:16 ——– d—–w- c:\program files\Azureus
2009-12-06 10:11 . 2009-12-06 10:09 2416 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-12-06 10:09 . 2009-12-06 10:09 128 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2009-12-06 08:17 . 2006-09-28 15:47 35880 —-a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-04 21:05 . 2008-09-18 14:40 ——– d—–w- c:\program files\Windows Live
2009-12-04 10:15 . 2008-05-29 21:46 2555 —-a-w- c:\documents and settings\Dan\Application Data\SAS7_000.DAT
2009-12-03 14:39 . 2006-09-29 09:01 ——– d—–w- c:\documents and settings\Dan\Application Data\AdobeUM
2009-11-29 13:05 . 2006-09-29 22:38 ——– d—–w- c:\documents and settings\Dan\Application Data\POP Peeper
2009-11-27 14:38 . 2007-03-09 14:25 ——– d—–w- c:\documents and settings\Dan\Application Data\Nokia
2009-11-25 15:49 . 2006-09-30 16:31 ——– d—–w- c:\program files\LimeWire
2009-11-05 10:22 . 2009-11-05 10:22 ——– d—–w- c:\documents and settings\Dan\Application Data\anpo.republika.pl
2009-11-05 09:28 . 2009-11-05 09:28 ——– d—–w- c:\documents and settings\Dan\Application Data\fltk.org
2009-11-03 12:05 . 2007-03-09 14:22 ——– d—–w- c:\program files\Nokia
2009-11-03 11:31 . 2009-11-03 11:31 ——– d—–w- c:\program files\MSBuild
2009-11-03 11:31 . 2009-11-03 11:31 134784 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-11-03 11:26 . 2009-11-03 11:26 ——– d—–w- c:\program files\Reference Assemblies
2009-11-02 17:49 . 2008-04-01 21:11 ——– d—–w- c:\program files\Common Files\Nokia
2009-11-02 17:48 . 2009-11-02 17:48 ——– d—–w- c:\program files\PC Connectivity Solution
2009-11-02 17:46 . 2009-11-02 17:46 77824 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2009-11-02 17:46 . 2009-11-02 17:46 50000 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Installer\CommonCustomActions\pcswpc.exe
2009-11-02 17:46 . 2009-10-23 16:51 ——– d—–w- c:\documents and settings\All Users\Application Data\OviInstallerCache
2009-11-02 17:20 . 2008-04-01 21:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
2009-11-02 17:16 . 2009-11-02 17:16 3351812 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\msxml6Exec.exe
2009-11-02 17:16 . 2009-11-02 17:16 36864 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe
2009-11-02 17:16 . 2009-11-02 17:16 3203453 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\vcredistExec.exe
2009-11-02 17:16 . 2009-11-02 17:19 24403616 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_1.8.10EN.exe
2009-11-02 06:49 . 2009-11-02 17:46 60426224 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{82E16F2D-804A-4990-BEEF-C9DB44AE844B}\Nokia_Ovi_Suite_webupgrade_ALL.exe
2009-10-23 17:48 . 2009-10-23 17:48 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-10-23 17:16 . 2009-10-23 17:16 ——– d—–w- c:\documents and settings\Dan\Application Data\Nokia Ovi Suite
2009-10-23 16:52 . 2009-10-23 16:52 12212040 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{F189FCA9-6147-49EE-A995-BE611281EE6E}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2009-10-23 16:52 . 2009-10-23 16:52 13930312 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{F189FCA9-6147-49EE-A995-BE611281EE6E}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2009-10-23 16:52 . 2009-10-23 16:52 61440 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{F189FCA9-6147-49EE-A995-BE611281EE6E}\Installer\CommonCustomActions\WMF11Runx86.exe
2009-10-23 16:52 . 2009-10-23 16:52 58880 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{F189FCA9-6147-49EE-A995-BE611281EE6E}\Installer\CommonCustomActions\WMF11Runx64.exe
2009-10-23 16:52 . 2009-10-23 16:52 50000 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{F189FCA9-6147-49EE-A995-BE611281EE6E}\Installer\CommonCustomActions\pcswpc.exe
2009-10-23 16:48 . 2009-10-23 16:51 92597600 —-a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{F189FCA9-6147-49EE-A995-BE611281EE6E}\Nokia_Ovi_Suite_webinstaller.exe
2009-10-22 09:14 . 2007-03-10 10:14 ——– d—–w- c:\program files\Common Files\PCSuite
2009-10-22 09:06 . 2009-10-22 09:14 33773208 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng_web(2).exe
2009-10-22 08:59 . 2007-03-09 14:22 ——– d—–w- c:\documents and settings\Dan\Application Data\PC Suite
2009-10-22 08:10 . 2009-10-22 08:10 95232 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-10-22 08:10 . 2009-10-22 08:10 8192 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-10-22 08:10 . 2009-10-22 08:10 61440 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-10-22 08:10 . 2009-10-22 08:10 10240 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-10-22 08:10 . 2009-10-22 08:11 33773208 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng.exe
2009-10-18 15:13 . 2009-10-18 15:13 15240 —-a-w- c:\documents and settings\Dan\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
2009-10-14 15:23 . 2006-09-28 21:01 ——– d—–w- c:\program files\Google
2009-10-14 09:48 . 2008-04-13 19:29 ——– d—–w- c:\program files\Microsoft Silverlight
2009-10-11 03:17 . 2009-07-10 08:08 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-10-09 07:16 . 2009-03-16 11:12 164 —-a-w- c:\windows\install.dat
2009-09-29 18:19 . 2009-09-29 18:19 2146304 —-a-w- c:\windows\system32\GPhotos.scr
2009-09-25 14:38 . 2007-10-01 11:08 7154255 —-a-w- c:\documents and settings\Dan\Application Data\Azureus\plugins\azemp\azmplay.exe
2009-09-25 14:36 . 2009-01-24 20:32 10686001 —-a-w- c:\documents and settings\Dan\Application Data\Azureus\plugins\azump\mplayer.exe
2009-09-18 12:08 . 2007-06-20 15:25 1563008 —-a-w- c:\windows\WRSetup.dll
2009-09-18 11:42 . 2006-10-19 14:08 176752 —-a-w- c:\windows\system32\drivers\ssidrv.sys
2009-09-18 11:42 . 2008-08-09 12:42 29808 —-a-w- c:\windows\system32\drivers\ssfs0bbc.sys
2009-09-18 11:42 . 2006-10-19 14:08 23152 —-a-w- c:\windows\system32\drivers\sshrmd.sys
1998-06-16 21:00 . 2008-09-23 11:25 254005 ——w- c:\program files\Msvcrt.dll
1998-02-10 15:34 . 2008-09-23 11:25 128000 ——w- c:\program files\UNWISE.EXE
1996-10-13 22:38 . 2008-09-23 11:25 924432 ——w- c:\program files\Mfc40.dll
2006-05-03 09:06 . 2009-07-15 10:02 163328 –sh–r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-07-15 10:02 31232 –sh–r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-07-15 10:02 216064 –sh–r- c:\windows\system32\nbDX.dll
2008-02-04 19:26 . 2008-03-17 21:51 151040 –sh–w- c:\windows\system32\VistaUltm.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-12-08_16.18.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-08 20:13 . 2009-12-08 20:13 16384 c:\windows\Temp\Perflib_Perfdata_228.dat
+ 2004-08-04 12:00 . 2009-12-08 16:34 78098 c:\windows\system32\perfc009.dat
- 2004-08-04 12:00 . 2009-12-08 14:28 78098 c:\windows\system32\perfc009.dat
+ 2006-09-22 10:14 . 2009-12-08 20:13 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2006-09-22 10:14 . 2009-12-08 14:23 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2006-09-22 10:14 . 2009-12-08 20:13 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-09-22 10:14 . 2009-12-08 14:23 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-09-22 10:14 . 2009-12-08 14:23 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2006-09-22 10:14 . 2009-12-08 20:13 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 12:00 . 2009-12-08 16:34 454082 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2009-12-08 14:28 454082 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 14:06 764296 ——w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"POP Peeper"="c:\program files\POP Peeper\POPPeeper.exe" [2009-08-17 1486848]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"ASUS Probe"="c:\program files\ASUS\Asus Probe\AsusProb.exe" [2002-12-06 617984]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-26 2029336]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-09-18 6515784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\Belkin\Bluetooth Software\BTTray.exe [2006-6-7 553021]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-17 19:15 11952 ——w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe\0SsiEfr.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-27 18:03 152872 ——w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 00:12 110592 ——w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClocX]
2007-07-26 15:43 270336 ——w- c:\program files\ClocX\ClocX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELUXECC]
2002-08-18 23:30 229376 ——w- c:\windows\twain_32\SiPix\SCDeluxe\DELUXECC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GBMPro8Agent]
2008-07-28 08:05 189056 ——w- c:\program files\Genie-Soft\GBMPro8\GBMAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mouseElf]
2004-02-24 04:30 176128 ——w- c:\progra~1\GENIUS~1\gnetmous.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ——w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-10-07 12:33 13574144 ——w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-10-07 12:33 86016 ——w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-10-07 12:33 1630208 ——w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 15:18 413696 ——w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
2008-12-21 15:54 160592 ——w- c:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung Common SM]
2005-07-03 07:20 372736 ——w- c:\windows\Samsung\ComSMMgr\SSMMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-05-12 15:31 68856 ——w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2 (0x2)
"gupdate1c9d8c4a1f1518a"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ScanSoft\\OmniPageSE\\EregEng\\NAVBrowser.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\eRightSoft\\SUPER\\SUPER.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Jasc Software Inc\\Paint Shop Pro 8\\Paint Shop Pro.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\DRAE\\jre\\1.1\\bin\\jre.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Genie-Soft\\GBMPro8\\GBM8.exe"=
"c:\\Program Files\\Genie-Soft\\GBMPro8\\GBMAgent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"9809:TCP"= 9809:TCP:Limewire

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [8/9/2008 1:42 PM 29808]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/26/2008 6:43 PM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/26/2008 6:43 PM 108552]
R1 FAMv4;FAMv4;c:\windows\system32\drivers\FAMv4.sys [4/9/2008 3:36 PM 97816]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/1/2009 4:15 PM 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/26/2008 6:42 PM 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [12/4/2009 10:08 PM 54752]
R2 WENCRNT4;WENCRNT4;c:\windows\system32\drivers\WENCRNT4.sys [12/21/2006 3:24 PM 114944]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Spy Sweeper\WRConsumerService.exe [3/16/2009 12:13 PM 1201640]
S2 gupdate1c9d8c4a1f1518a;Google Update Service (gupdate1c9d8c4a1f1518a);c:\program files\Google\Update\GoogleUpdate.exe [5/19/2009 9:58 PM 133104]
S3 ADM8511;%ADM8511.Service.DispName%;c:\windows\system32\drivers\ADM8511.SYS [8/17/2001 11:11 AM 20160]
S3 ATHFMWDL;Atheros USB Wireless Adapter Bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [9/28/2006 4:59 PM 43392]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 10:48 PM 704864]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/25/2007 6:31 PM 42000]
S3 SCDELUXES;SiPix StyleCam Deluxe (still);c:\windows\system32\drivers\se402sc.sys [11/14/2007 12:48 PM 79484]
S3 SCDELUXEV;SiPix StyleCam Deluxe (video);c:\windows\system32\drivers\se402vc.sys [7/26/2002 11:06 AM 368868]
S3 siusbmod;siusbmod;c:\windows\system32\drivers\siusbmod.sys [7/8/2004 11:40 AM 26880]
S3 STVqx5;Digital Blue QX5™ Microscope;c:\windows\system32\drivers\STVqx5.sys [9/30/2006 5:26 PM 64512]
S3 STVqx5m;Digital Blue QX5™ Microscopem;c:\windows\system32\drivers\STVqx5m.sys [9/30/2006 5:26 PM 6144]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/26/2007 11:17 AM 685816]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = ;*.local
uInternet Settings,ProxyServer = 150.176.182.32:80
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Send to &Bluetooth Device… - c:\program files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: macromedia.com\www
FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\19d6pgzq.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.ask.com/web?&o=13048&l=dis&q=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\program files\Stopzilla!\Toolbar\Extension\components\SiteGuardFF.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICIES —-
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-08 22:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-725345543-651377827-2147175445-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:78,13,c3,6c,1c,27,71,6e,a8,e1,74,23,c2,37,c3,09,c4,28,55,f2,fe,a4,ce,
a5,d1,17,18,78,3a,1a,10,0c,a0,2f,b5,ae,57,f3,a7,61,f3,e7,c2,3d,2d,5b,86,f2,\
"??"=hex:0a,ca,a3,37,d0,f9,d1,bd,4d,93,0a,3c,95,b0,1a,20
.
Completion time: 2009-12-08 22:33:53
ComboFix-quarantined-files.txt 2009-12-08 21:33
ComboFix2.txt 2009-12-08 16:22

Pre-Run: 15,021,936,640 bytes free
Post-Run: 14,960,123,904 bytes free

- - End Of File - - F12F277B3936E8FC5A9EDA32C5F054FA
Upload was successful

Attachments:

Post #10
Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • MBAM Log
  • Kaspersky report
Post #12
Here is the file for the DeFogger guy. SPTDLook v1.0 by jpshortstuff (09.12.09) Log created at 17:29 on 09/12/2009 by Dan (Administrator - Elevation successful) SPTD sptd (No Description) Current Status: Stopped Startup Type: Disabled Error Control: Unable to Determine Binary: \SystemRoot\System32\Drivers\sptd.sys Group: Boot Bus Extender SafeBoot: Minimal(Group) Network(Group) Dependencies: (none) Dependant Services: (none) -=End Of File=- Here is the Malwarebytes log. it is also attached. Malwarebytes' Anti-Malware 1.42 Database version: 3331 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 12/9/2009 4:45:27 PM mbam-log-2009-12-09 (16-45-27).txt Scan type: Quick Scan Objects scanned: 119565 Time elapsed: 9 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 5 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\winzixmanager.winzixshell (Trojan.Swizzor) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\winzixmanager.winzixshell.1 (Trojan.Swizzor) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ee91f4cc-6ba2-424c-a1fe-64910ccb6a42} (Trojan.Swizzor) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\WinZixManager (Trojan.Swizzor) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\WinZixManager (Trojan.Swizzor) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ee91f4cc-6ba2-424c-a1fe-64910ccb6a42} (Trojan.Swizzor) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSerrors.log (Rootkit.TDSS) -> Quarantined and deleted successfully. When I clicked to restart the computer after the Malwarebytes scan the computer froze up. I restarted it and it started to load windows and then went to a brief "Blue screen" and then reset. I selected start windows normally and it restarted. Lately, the blue screen is blue at first then light green, it only lasts a split second before it resets so I can never read anything about the problem causing the reset. The Kaspersky web site said: "The current Kaspersky Online Scanner is unavailable - we apologize for the inconvenience. While you are waiting for the improved Online Scanner, why not try a free trial of Kaspersky Internet Security 2010, which has everything you need to keep your computer safe." Thanks, Dan

Attachments:

Post #13 last edited
Hi,

Please do the following online scan instead:

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.

    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI