This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] repost of "My computer is owned (by someone else!)&q

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hello all and thanks for your hard work on this board. I would be an ignorant individual who has somehow gained additional unwanted baggage. I've stepped through a number of self help posts (CatByte even tried to get me started here previously) and am finally resolved that this is bigger than self help can deal with and in search of someone who knows infinitely more than i do about this stuff. I've had increasing problems over last (4) months - first problem was the remote driver for media center will error after about 24 hours indicating that the device driver is previous loaded?? will clear on reboot -security software will be disabled and the icons in the program tray will be removed (symantech, panda cloud, avg. currently running avast). windows security alerts have even been disabled. -home page will be changed and spywareguard will alert and change it back -scans normally reveal no problems online and on computer -Just installed Comodo firewall pro and the alerts are crazy. Seems something takes over a Microsoft system file (name changes each boot up) and tries to inject a hook in everything that is running. i just keep hitting deny. gratefully the connection still works. -there is only one desktop computer connected through Iban router. network zones shows a loopback zone, and 2 local area networks?? -regular system freeze ups. today had system freeze up and on hard reboot went strait to the same user desktop, bypassing the user selection screen?? in attempting to run dds, the firewall gave warnings of dds creating a file with the same name and then all kinds of registry changes which i denied. program crashed. in frustration accidentally ran dds twice at the same time..one completed and the other crashed (ha there is someone on my side!). files attached. on running rootrepeal had the file opening a same named file and the flurry of registry changes, finally a request to load the device driver (approved) and a message that shows 'device driver failed'. On rerun it skips all the registry changes and tries to just load the driver only to also fail. If i have to reload windows i can do that but would prefer (hopefully) not to. Thanks for whatever help is possible. Here is the posted version of the dds.txt file. DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 6:32:43.85 on Wed 09/16/2009 Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_15 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.2035 [GMT -6:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k WindowsMobile C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\ehome\ehsched.exe C:\Windows\ehome\ehRecvr.exe C:\Windows\explorer.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Windows\eHome\EhTray.exe C:\Windows\ehome\ehmsas.exe C:\Windows\System32\mobsync.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Administrator\Downloads\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll uURLSearchHooks: H - No File BHO: MRI_DISABLED - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [hpsysdrv] "c:\hp\support\hpsysdrv.exe" mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe" mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe" mRun: [Windows Mobile Device Center] "c:\windows\windowsmobile\wmdc.exe" mRun: [WPCUMI] "c:\windows\system32\WpcUmi.exe" mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript StartupFolder: c:\users\admini~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mri_di~1\snapfi~1.lnk - c:\program files\snapfish picture mover\SnapfishMediaDetector.exe uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll LSP: c:\windows\system32\wpclsp.dll DPF: {2042B57E-6336-459E-B7CE-2A0F6C9E6AF8} - file:///F:/win/setup/iaieplay.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {8B67B37E-1AE2-4B99-B8CF-55AF4D58DF0D} - file:///F:/win/setup/iamce.dll DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll AppInit_DLLs: avgrsstx.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\admini~1\appdata\roaming\mozilla\firefox\profiles\0nmd4l7d.default\ FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-26 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-26 108552] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-26 297752] R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2008-12-3 1426304] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-9-15 38224] S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2008-12-22 55264] S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2008-12-8 533344] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2007-11-2 18176] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2007-1-22 7680] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2007-10-10 42112] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-6-18 23680] =============== Created Last 30 ================ 2009-09-15 23:42 –d—– c:\program files\Trend Micro 2009-09-15 22:39 –d—– c:\users\admini~1\appdata\roaming\Malwarebytes 2009-09-15 22:39 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-15 22:39 19,160 a——- c:\windows\system32\drivers\mbam.sys 2009-09-15 22:39 –d—– c:\programdata\Malwarebytes 2009-09-15 22:39 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-09-15 22:39 –d—– c:\progra~2\Malwarebytes 2009-09-15 09:28 –d—– c:\program files\Smith Micro 2009-09-14 10:04 107,368 a——- c:\windows\system32\GEARAspi.dll 2009-09-14 10:04 26,600 a——- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-09-14 10:03 –d—– c:\program files\iPod 2009-09-14 10:03 –d—– c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-09-14 10:03 –d—– c:\progra~2\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-09-14 10:03 –d—– c:\program files\iTunes 2009-09-14 10:03 –d—– c:\program files\Bonjour 2009-09-14 10:02 –d—– c:\programdata\Apple Computer 2009-09-08 22:42 –dsh— c:\windows\system32\%APPDATA% 2009-09-05 01:54 94,208 a——- c:\windows\system32\QuickTimeVR.qtx 2009-09-05 01:54 69,632 a——- c:\windows\system32\QuickTime.qts 2009-09-02 12:31 67,223 a——- c:\programdata\nvModes.dat 2009-09-02 12:31 67,223 a——- c:\progra~2\nvModes.dat 2009-09-02 12:07 28,672 a——- c:\windows\system32\Apphlpdm.dll 2009-09-02 12:07 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll 2009-09-02 11:39 –d—– C:\NVIDIA 2009-09-02 11:22 –d—– c:\program files\SystemRequirementsLab 2009-09-02 11:07 54,156 a—h— c:\windows\QTFont.qfn 2009-09-02 11:07 1,409 a——- c:\windows\QTFont.for 2009-09-02 08:24 –d—– c:\users\Administrator 2009-08-29 06:50 411,368 a——- c:\windows\system32\deploytk.dll 2009-08-28 11:00 –d—– c:\programdata\Spybot - Search & Destroy 2009-08-28 11:00 –d—– c:\program files\Spybot - Search & Destroy 2009-08-28 11:00 –d—– c:\progra~2\Spybot - Search & Destroy 2009-08-28 10:29 –d—– c:\program files\SpywareBlaster 2009-08-28 03:28 55,656 a——- c:\windows\system32\drivers\avgntflt.sys 2009-08-27 06:40 –d—– c:\program files\CCleaner 2009-08-26 23:09 –d-h— C:\$AVG8.VAULT$ 2009-08-26 22:12 108,552 a——- c:\windows\system32\drivers\avgtdix.sys 2009-08-26 22:12 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-08-26 22:12 335,240 a——- c:\windows\system32\drivers\avgldx86.sys 2009-08-26 22:12 –d—– c:\windows\system32\drivers\Avg 2009-08-26 22:11 –d—– c:\programdata\AVG Security Toolbar 2009-08-26 22:11 –d—– c:\progra~2\AVG Security Toolbar 2009-08-26 22:11 –d—– c:\programdata\avg8 2009-08-26 22:11 –d—– c:\program files\AVG 2009-08-26 22:11 –d—– c:\progra~2\avg8 2009-08-26 03:14 –dsh— C:\found.001 2009-08-26 03:01 2,048 a——- c:\windows\system32\tzres.dll 2009-08-22 03:49 –d—– c:\windows\Hewlett-Packard 2009-08-20 11:15 499,712 a——- c:\windows\system32\kerberos.dll 2009-08-20 11:15 270,848 a——- c:\windows\system32\schannel.dll 2009-08-20 11:15 218,624 a——- c:\windows\system32\msv1_0.dll 2009-08-20 11:15 175,104 a——- c:\windows\system32\wdigest.dll 2009-08-20 11:15 1,259,008 a——- c:\windows\system32\lsasrv.dll 2009-08-20 11:15 439,864 a——- c:\windows\system32\drivers\ksecdd.sys 2009-08-20 11:15 72,704 a——- c:\windows\system32\secur32.dll 2009-08-20 11:15 9,728 a——- c:\windows\system32\lsass.exe ==================== Find3M ==================== 2009-09-14 09:59 143,360 a——- c:\windows\inf\infstrng.dat 2009-09-14 09:59 143,360 a——- c:\windows\inf\infstor.dat 2009-09-14 09:59 51,200 a——- c:\windows\inf\infpub.dat 2009-08-28 20:30 173,056 a——- c:\windows\apppatch\AcXtrnal.dll 2009-08-28 20:30 458,752 a——- c:\windows\apppatch\AcSpecfc.dll 2009-08-28 20:30 2,159,616 a——- c:\windows\apppatch\AcGenral.dll 2009-08-28 20:30 542,720 a——- c:\windows\apppatch\AcLayers.dll 2009-08-17 02:42 2,173,472 a——- c:\windows\system32\nvcplui.exe 2009-08-17 02:42 1,346,080 a——- c:\windows\system32\nvsvs.dll 2009-08-17 02:41 3,176,992 a——- c:\windows\system32\nvwss.dll 2009-08-17 02:41 4,033,056 a——- c:\windows\system32\nvvitvs.dll 2009-08-17 02:41 1,292,832 a——- c:\windows\system32\nvmobls.dll 2009-08-17 02:41 195,104 a——- c:\windows\system32\nvmccss.dll 2009-08-17 02:41 3,553,824 a——- c:\windows\system32\nvgames.dll 2009-08-17 02:41 13,904,416 a——- c:\windows\system32\nvcpl.dll 2009-08-17 02:41 4,930,080 a——- c:\windows\system32\nvdisps.dll 2009-08-17 02:41 764,448 a——- c:\windows\system32\nvsvc.dll 2009-08-17 02:41 215,584 a——- c:\windows\system32\nvvsvc.exe 2009-08-17 02:41 143,360 a——- c:\windows\system32\nvshext.dll 2009-08-17 02:41 92,704 a——- c:\windows\system32\nvmctray.dll 2009-08-17 00:57 10,858,496 a——- c:\windows\system32\nvoglv32.dll 2009-08-17 00:57 9,545,152 a——- c:\windows\system32\drivers\nvlddmkm.sys 2009-08-17 00:57 7,569,920 a——- c:\windows\system32\nvd3dum.dll 2009-08-17 00:57 2,169,376 a——- c:\windows\system32\nvcuvid.dll 2009-08-17 00:57 1,985,536 a——- c:\windows\system32\nvcuda.dll 2009-08-17 00:57 1,706,528 a——- c:\windows\system32\nvcuvenc.dll 2009-08-17 00:57 1,044,992 a——- c:\windows\system32\nvapi.dll 2009-08-17 00:57 485,920 a——- c:\windows\system32\nvudisp.exe 2009-08-17 00:57 155,648 a——- c:\windows\system32\nvcod162.dll 2009-08-17 00:57 155,648 a——- c:\windows\system32\nvcod.dll 2009-08-17 00:57 4,224 a——- c:\windows\system32\drivers\nvBridge.kmd 2009-08-14 11:07 0 a—h— c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf 2009-08-14 10:27 904,776 a——- c:\windows\system32\drivers\tcpip.sys 2009-08-14 09:53 17,920 a——- c:\windows\system32\netevent.dll 2009-08-14 07:49 9,728 a——- c:\windows\system32\TCPSVCS.EXE 2009-08-14 07:49 17,920 a——- c:\windows\system32\ROUTE.EXE 2009-08-14 07:49 11,264 a——- c:\windows\system32\MRINFO.EXE 2009-08-14 07:49 27,136 a——- c:\windows\system32\NETSTAT.EXE 2009-08-14 07:49 19,968 a——- c:\windows\system32\ARP.EXE 2009-08-14 07:49 8,704 a——- c:\windows\system32\HOSTNAME.EXE 2009-08-14 07:49 10,240 a——- c:\windows\system32\finger.exe 2009-08-14 07:48 30,720 a——- c:\windows\system32\drivers\tcpipreg.sys 2009-08-14 07:48 105,984 a——- c:\windows\system32\netiohlp.dll 2009-08-11 12:35 485,920 a——- c:\windows\system32\nvuninst.exe 2009-07-21 15:52 915,456 a——- c:\windows\system32\wininet.dll 2009-07-21 15:47 109,056 a——- c:\windows\system32\iesysprep.dll 2009-07-21 15:47 71,680 a——- c:\windows\system32\iesetup.dll 2009-07-21 14:13 133,632 a——- c:\windows\system32\ieUnatt.exe 2009-07-17 07:54 71,680 a——- c:\windows\system32\atl.dll 2009-07-15 06:40 8,147,456 a——- c:\windows\system32\wmploc.DLL 2009-07-15 06:39 313,344 a——- c:\windows\system32\wmpdxm.dll 2009-07-15 06:39 4,096 a——- c:\windows\system32\dxmasf.dll 2009-07-15 06:39 7,680 a——- c:\windows\system32\spwmp.dll 2009-07-11 13:01 513,536 a——- c:\windows\system32\wlansvc.dll 2009-07-11 13:01 302,592 a——- c:\windows\system32\wlansec.dll 2009-07-11 13:01 293,376 a——- c:\windows\system32\wlanmsm.dll 2009-07-11 13:01 65,024 a——- c:\windows\system32\wlanapi.dll 2009-07-11 11:03 127,488 a——- c:\windows\system32\L2SecHC.dll 2009-06-30 01:39 665,600 a——- c:\windows\inf\drvindex.dat 2008-06-07 13:52 174 a–sh— c:\program files\desktop.ini 2006-11-02 06:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 06:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 06:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 06:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 03:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 03:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 03:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 03:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 2009-06-11 03:16 245,760 a–sh— c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2007-11-23 12:01 8,192 a–sh— c:\windows\users\default\NTUSER.DAT ============= FINISH: 6:33:38.03 =============== Go to the top of the page +Quote Post Noviciate Rating: 4 View Member Profile post Today, 05:31 PM Post #3 Classroom Teacher Group Icon Group: Classroom Teacher Posts: 2,689 Joined: 30-July 06 Member No.: 59,198 Operating System: Windows XP Given that Helpers look for threads with zero replies, it is likely that this one will be overlooked due to you replying to it yourself. I suggest you start a fresh thread and only post once into it and somebody will be along as soon as to help. I'll lock this one to keep everything tidy.

Attachments:

Hi Rwilles,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI