What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] frozen computer (some type of trojan?) help, please. :)

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
My boyfriend said he used to use Norton quite some time ago but he stopped paying for it so it stopped working. If there is a more recent Norton file on here, I honestly don't know where it came from. The java update installed nicely. I'm running Kaspersky now. Only 5% done but it has found one infected object. This might take an overnight run to finish. I'll post the log when it's all done.
Post #47 last edited
Hi Faithiefaith, Ok we'll take care of the Norton remnants later. The Kaspersky may speed up depending on what it's scanning. Just sit back and let it run.
Post #48
Here are the results. Only took a few hours :) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, January 6, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Thursday, January 07, 2010 01:03:27 Records in database: 3331636 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Objects scanned: 125038 Threats found: 6 Infected objects found: 8 Suspicious objects found: 0 Scan duration: 02:30:18 File name / Threat / Threats count C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL/C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL Infected: not-a-virus:AdWare.Win32.MegaSearch.aj 1 C:\Documents and Settings\sonnguyen\My Documents\LimeWire\Incomplete\T-3515161-###### you archive.wma Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\sonnguyen\My Documents\LimeWire\Saved\sonne rammstein.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1 C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.aj 1 C:\Qoobox\Quarantine\C\Program Files\Malware Defense\mdext.dll.vir Infected: Packed.Win32.TDSS.aa 1 C:\Qoobox\Quarantine\C\Program Files\Malware Defense\uninstall.exe.vir Infected: Packed.Win32.TDSS.aa 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\H8SRTfhdyemtbqx.sys.vir Infected: Trojan.Win32.Tdss.aver 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTbpkkdibquj.dll.vir Infected: Trojan.Win32.FraudPack.ajso 1 Selected area has been scanned.
Post #49
Hi Faithiefaith,

That doesn't look too bad. Though as you can see some of those detections were in one those "hardly ever get used" programs. The other detection are quarantined files which will be removed when we remove the tools.

The MegaUpLoads ToolBar is detected as adware if you don't use the ToolBar it can be uninstalled from Add/Remove programs.

Norton PC Checkup most likely was installed along with an Abobe Flash update. We will remove it as it can cause some slowdowns at startup.

Let's get the loose ends cleaned up.

I need you to make a batch file.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

@echo off
sc config PCCUJobMgr start= disabled
del %0

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "fix.bat"
  • Click save
You should now have a file on your desktop with an icon like this 📎bat.PNG

Double click on fix.bat & allow it to run. A small black screen may breifly flash on and off, that normal.

Reboot your machine.


After the restart:

Go to Add/Remove programs and uninstall

Norton PC Checkup


Next

Download the Norton Removal Tool from HERE and save it to your desktop.

Next Double click on Norton_Removal_Tool.exe to run the tool.

Follow the on-screen instructions.
Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.



Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Reg
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\Program Files\LimeWire\LimeWire.exe"=-
"c:\Program Files\Vuze\Azureus.exe"=-

:Files
C:\Documents and Settings\sonnguyen\My Documents\LimeWire
C:\Program Files\Symantec
C:\Program Files\Vuze
C:\Program Files\LimeWire

:Commands
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.

Download and install one of these free antivirus programs.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum



Finally open OTL and click the Quick Scan button. It will produce an OTL.txt.

Please post back with
  • OTL fix log
  • OTL Quick Scan log
How's the computer?

Thanks
Post #50 last edited
Everything went well and I made sure to do the steps in order. I installed AVG. However, during the OTL run fix it did not generate a log for me, it just restarted the computer. I'm not sure if this is a problem. The computer is working great!

Here is my OTL quick scan log:

OTL logfile created on: 1/7/2010 3:58:13 AM - Run 3
OTL by OldTimer - Version 3.1.21.0 Folder = C:\Documents and Settings\sonnguyen\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 227.87 Gb Total Space | 41.29 Gb Free Space | 18.12% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 59.69 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SON_NGUYEN
Current User Name: sonnguyen
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Documents and Settings\sonnguyen\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
PRC - c:\Program Files\Common Files\Logitech\LU\LogitechUpdate.exe (Logitech, Inc.)
PRC - c:\Program Files\Common Files\Logitech\LU\LULnchr.exe (Logitech, Inc.)
PRC - C:\Program Files\VentSrv\ventrilo_srv.exe ()
PRC - C:\WINDOWS\system32\PnkBstrA.exe ()
PRC - C:\Program Files\VentSrv\ventrilo_svc.exe ()
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
PRC - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Logitech\QuickCam\LU\LULnchr.exe (Logitech, Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Program Files\D-Link\AirPlus XtremeG DWL-G520\AirPlusCFG.exe (D-Link)
PRC - C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe (Sony Corporation)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe (D-Link)
PRC - C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe (Alpha Networks Inc.)
PRC - C:\Program Files\Sony\Sony TV Tuner Library\SMceMan.exe (Sony Corporation)
PRC - C:\Program Files\Sony\Sony TV Tuner Library\RM_SV.exe (Sony Corporation)
PRC - C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\MsPMSPSv.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\sonnguyen\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Xfire\xfire_toucan_40700.dll (Xfire Inc.)
MOD - C:\WINDOWS\temp\logishrd\LVPrcInj01.dll (Logitech Inc.)
MOD - C:\WINDOWS\system32\wsock32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\serwvdrv.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\umdmxfrm.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (npggsvc) – C:\WINDOWS\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (PnkBstrA) – C:\WINDOWS\system32\PnkBstrA.exe ()
SRV - (Ventrilo) – C:\Program Files\VentSrv\ventrilo_svc.exe ()
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (Ati HotKey Poller) – C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
SRV - (ATI Smart) – C:\WINDOWS\system32\ati2sgag.exe ()
SRV - (nmraapache) – C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe (Pure Networks, Inc.)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.)
SRV - (ANIWZCSdService) – C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe (Wireless Service)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-AppServer) – C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (VzCdbSvc) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
SRV - (VzFw) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation)
SRV - (Vcsw) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-VideoServer-UPnP) VAIO Media Video Server (UPnP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-UPnP) VAIO Media Integrated Server (UPnP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-VideoServer-HTTP) VAIO Media Video Server (HTTP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-HTTP) VAIO Media Integrated Server (HTTP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-Mobile-Gateway) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe (Sony Corporation)
SRV - (SonicStageMonitoring) – C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-VideoServer-AppServer) – C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe (Sony Corporation)
SRV - (Sony TVTA Manager) – C:\Program Files\Sony\Sony TV Tuner Library\SMceMan.exe (Sony Corporation)
SRV - (Sony TV Tuner Controller) – C:\Program Files\Sony\Sony TV Tuner Library\halsv.exe (Sony Corporation)
SRV - (Sony TV Tuner Manager) – C:\Program Files\Sony\Sony TV Tuner Library\RM_SV.exe (Sony Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (WMDM PMSP Service) – C:\WINDOWS\system32\MsPMSPSv.exe (Microsoft Corporation)
SRV - (Creative Service for CDROM Access) – C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Live Search"
FF - prefs.js..browser.search.defaulturl: "http://search.live.com/results.aspx?FORM=IEFM1&q="
FF - prefs.js..browser.search.order.1: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "megaup"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "megaup"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.samuraioflegend.com/login.php"
FF - prefs.js..extensions.enabledItems: [removed]:1.0.8.0552
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.24
FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?FORM=IEFM1&q="


FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/01/07 03:54:36 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/01/07 03:54:57 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/06 00:59:56 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/06 20:31:55 | 00,000,000 | —D | M]

[2008/07/26 10:20:17 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Extensions
[2010/01/06 01:29:33 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions
[2008/11/06 07:44:19 | 00,000,000 | —D | M] (NeffyPlugin Launcher) – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\{5601B994-0E9B-4ce2-8AB9-AD1155F2ABBD}
[2009/07/06 09:41:59 | 00,000,000 | —D | M] (Foxkeh Theme) – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\{57407AE0-868F-11DC-AD21-49A755D89593}
[2009/06/16 09:47:40 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\[removed]
[2009/05/16 19:14:54 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\[removed]
[2009/06/16 09:47:33 | 00,002,399 | —- | M] () – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\searchplugins\daemon-search.xml
[2009/01/31 17:35:23 | 00,001,632 | —- | M] () – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\searchplugins\live-search.xml
[2010/01/06 20:31:56 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/08/03 23:28:37 | 00,024,683 | —- | M] (Ask.com) – C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
[2007/04/16 12:07:12 | 00,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: (98 bytes) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Megaupload Toolbar) - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (Ask Toolbar BHO) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Megaupload Toolbar) - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Megaupload Toolbar) - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
O4 - HKLM..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe (Alpha Networks Inc.)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CreateCD_Reminder] C:\WINDOWS\SONYSYS\VAIO Recovery\Reminder.exe (Sony Electronics, Inc)
O4 - HKLM..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [D-Link AirPlus Xtreme G] C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe (D-Link)
O4 - HKLM..\Run: [D-Link AirPlus XtremeG DWL-G520] C:\Program Files\D-Link\AirPlus XtremeG DWL-G520\AirPlusCFG.exe (D-Link)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [nmapp] C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Pure Networks, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VAIO Recovery] C:\WINDOWS\SONYSYS\VAIO Recovery\PartSeal.exe (Sony Electronics Inc)
O4 - HKLM..\Run: [VAIO Update 2] C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe (Sony Corporation)
O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\sonnguyen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe (Creative Technology Ltd)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\sonnguyen\Start Menu\Programs\Startup\PowerReg Scheduler.exe ()
O4 - Startup: C:\Documents and Settings\sonnguyen\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab (GoPetsWeb Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Pure Networks, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/12/01 14:43:52 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/01/07 03:55:34 | 00,000,000 | -H-D | C] – C:\$AVG
[2010/01/07 03:55:17 | 00,012,464 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/01/07 03:55:16 | 00,360,584 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/01/07 03:55:09 | 00,333,192 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/01/07 03:55:08 | 00,028,424 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/01/07 03:55:00 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\Avg
[2010/01/07 03:54:58 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/01/07 03:54:36 | 00,000,000 | —D | C] – C:\Program Files\AVG
[2010/01/07 03:54:32 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/01/07 03:47:14 | 00,891,248 | —- | C] (AVG Technologies) – C:\Documents and Settings\sonnguyen\Desktop\avg_free_stb_all_9_40_cnet.exe
[2010/01/07 03:33:01 | 00,793,200 | —- | C] (Symantec Corporation) – C:\Documents and Settings\sonnguyen\Desktop\Norton_Removal_Tool.exe
[2010/01/06 20:31:23 | 00,000,000 | —D | C] – C:\Program Files\Java
[2010/01/06 19:39:16 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/06 19:39:14 | 00,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/06 19:39:14 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/06 19:38:38 | 05,061,520 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\sonnguyen\Desktop\mbam-setup.exe
[2010/01/06 19:33:34 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2010/01/06 19:33:28 | 00,000,000 | —D | C] – C:\_OTL
[2010/01/06 18:18:10 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2010/01/06 16:00:59 | 00,000,000 | —D | C] – C:\jgh24072j
[2010/01/06 07:49:51 | 00,000,000 | RHSD | C] – C:\cmdcons
[2010/01/06 07:49:11 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/01/06 07:49:11 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/01/06 07:49:11 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/01/06 07:49:11 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/01/06 07:49:03 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/01/06 07:49:02 | 00,000,000 | —D | C] – C:\jgh
[2010/01/06 07:48:45 | 00,000,000 | —D | C] – C:\Qoobox
[2010/01/06 04:42:36 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\sonnguyen\Desktop\OTL.exe
[2010/01/06 03:25:24 | 00,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2009/02/08 14:28:35 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2009/02/08 12:12:37 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Xfire
[2008/11/10 13:58:17 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Xfire
[2008/10/23 23:26:48 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/09/14 16:22:09 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2008/09/14 16:22:09 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2008/07/26 10:01:20 | 00,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2004/12/01 14:49:31 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2004/12/01 14:43:51 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2004/12/01 14:43:51 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/01/07 03:55:17 | 00,012,464 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/01/07 03:55:17 | 00,001,507 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2010/01/07 03:55:16 | 00,360,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/01/07 03:55:10 | 00,333,192 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/01/07 03:55:08 | 00,113,461 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/01/07 03:55:08 | 00,028,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/01/07 03:55:07 | 47,512,541 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/01/07 03:55:00 | 06,061,540 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2010/01/07 03:55:00 | 00,492,629 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2010/01/07 03:55:00 | 00,135,014 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2010/01/07 03:47:16 | 00,891,248 | —- | M] (AVG Technologies) – C:\Documents and Settings\sonnguyen\Desktop\avg_free_stb_all_9_40_cnet.exe
[2010/01/07 03:44:21 | 00,003,284 | —- | M] () – C:\WINDOWS\System32\ANIWZCS{356C534A-D8DA-4494-9843-56CB82CAA1CB}
[2010/01/07 03:44:20 | 00,293,744 | —- | M] () – C:\WINDOWS\System32\CTHELPER.RPT
[2010/01/07 03:44:14 | 00,000,010 | —- | M] () – C:\WINDOWS\System32\ANIWZCSUSERNAME{356C534A-D8DA-4494-9843-56CB82CAA1CB}
[2010/01/07 03:44:04 | 00,000,007 | —- | M] () – C:\WINDOWS\System32\ANIWZCSUSERNAME
[2010/01/07 03:43:51 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/07 03:43:49 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/07 03:43:46 | 21,462,22080 | -HS- | M] () – C:\hiberfil.sys
[2010/01/07 03:42:37 | 00,029,520 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/07 03:42:37 | 00,029,520 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/07 03:42:37 | 00,026,304 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/07 03:42:37 | 00,026,304 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/07 03:42:37 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/01/07 03:42:37 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2010/01/07 03:42:37 | 00,000,384 | —- | M] () – C:\WINDOWS\System32\DVCStateBkp-{00000006-00000000-00000001-00001102-00000004-20021102}.dat
[2010/01/07 03:42:37 | 00,000,384 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000006-00000000-00000001-00001102-00000004-20021102}.dat
[2010/01/07 03:42:15 | 04,980,736 | -H– | M] () – C:\Documents and Settings\sonnguyen\NTUSER.DAT
[2010/01/07 03:42:15 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\sonnguyen\ntuser.ini
[2010/01/07 03:36:00 | 00,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-417312340-3947967205-3010690940-1005UA.job
[2010/01/07 03:33:03 | 00,793,200 | —- | M] (Symantec Corporation) – C:\Documents and Settings\sonnguyen\Desktop\Norton_Removal_Tool.exe
[2010/01/06 19:39:18 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/06 19:38:57 | 05,061,520 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\sonnguyen\Desktop\mbam-setup.exe
[2010/01/06 19:33:29 | 00,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2010/01/06 18:36:01 | 00,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-417312340-3947967205-3010690940-1005Core.job
[2010/01/06 18:29:41 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/06 07:50:01 | 00,000,279 | RHS- | M] () – C:\boot.ini
[2010/01/06 07:46:31 | 00,000,176 | —- | M] () – C:\Documents and Settings\sonnguyen\defogger_reenable
[2010/01/06 07:31:40 | 03,819,182 | R— | M] () – C:\Documents and Settings\sonnguyen\Desktop\jgh.exe
[2010/01/06 04:34:10 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\sonnguyen\Desktop\OTL.exe
[2010/01/06 00:59:26 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/05 14:14:11 | 00,018,944 | —- | M] () – C:\Documents and Settings\sonnguyen\Desktop\Clan Donations.xls
[2009/12/30 14:55:24 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/30 14:54:58 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/27 15:26:07 | 00,027,648 | —- | M] () – C:\Documents and Settings\sonnguyen\Desktop\Affliction.xls

========== Files Created - No Company Name ==========

[2010/01/07 03:55:17 | 00,001,507 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2010/01/07 03:55:07 | 00,113,461 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/01/07 03:55:00 | 47,512,541 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/01/07 03:55:00 | 06,061,540 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2010/01/07 03:55:00 | 00,492,629 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2010/01/07 03:55:00 | 00,135,014 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2010/01/06 19:39:18 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/06 18:28:34 | 21,462,22080 | -HS- | C] () – C:\hiberfil.sys
[2010/01/06 07:50:00 | 00,000,209 | —- | C] () – C:\Boot.bak
[2010/01/06 07:49:56 | 00,260,272 | —- | C] () – C:\cmldr
[2010/01/06 07:49:11 | 00,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/01/06 07:49:11 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/01/06 07:49:11 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/01/06 07:49:11 | 00,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/01/06 07:49:11 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/01/06 07:46:11 | 00,000,176 | —- | C] () – C:\Documents and Settings\sonnguyen\defogger_reenable
[2010/01/06 07:45:59 | 03,819,182 | R— | C] () – C:\Documents and Settings\sonnguyen\Desktop\jgh.exe
[2010/01/06 07:36:04 | 00,050,621 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\Defogger.exe
[2010/01/06 04:42:36 | 00,293,376 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\gfmer.exe
[2010/01/06 00:59:26 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/01 05:20:44 | 00,018,944 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\Clan Donations.xls
[2009/12/22 18:59:32 | 00,041,872 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2009/10/20 14:52:28 | 00,049,152 | —- | C] () – C:\WINDOWS\System32\JJAKEn.dll
[2009/10/06 15:31:21 | 00,000,000 | —- | C] () – C:\WINDOWS\VAIOUpdt.INI
[2009/10/06 15:27:38 | 00,651,264 | R— | C] () – C:\WINDOWS\System32\libeay32.dll
[2009/10/06 15:27:38 | 00,147,456 | R— | C] () – C:\WINDOWS\System32\ssleay32.dll
[2009/09/16 15:19:41 | 00,000,032 | —- | C] () – C:\WINDOWS\basefx.INI
[2009/09/09 10:46:29 | 00,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2008/11/16 17:38:19 | 00,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/11/04 08:37:44 | 00,022,328 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/10/06 12:13:38 | 00,000,050 | —- | C] () – C:\WINDOWS\MegaManager.INI
[2008/07/26 14:34:17 | 00,063,488 | —- | C] () – C:\Documents and Settings\sonnguyen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/26 14:20:30 | 00,066,482 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/07/26 13:16:00 | 00,002,154 | —- | C] () – C:\WINDOWS\System32\ssmute.ini
[2008/07/26 13:12:43 | 00,000,176 | —- | C] () – C:\WINDOWS\Quicken.ini
[2008/07/26 13:12:00 | 00,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/07/26 13:12:00 | 00,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/07/26 13:12:00 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/07/26 13:12:00 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/07/26 13:12:00 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/07/26 13:11:59 | 00,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/07/26 13:10:49 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/07/26 13:04:53 | 00,019,968 | —- | C] () – C:\WINDOWS\System32\Cpuinf32.dll
[2008/07/26 12:19:20 | 00,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2008/07/26 12:15:55 | 00,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVS58.DLL
[2008/07/26 10:03:57 | 00,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2008/07/26 10:02:23 | 00,043,517 | —- | C] () – C:\WINDOWS\System32\e10kxwdm.ini
[2008/07/26 10:02:23 | 00,000,175 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2008/07/26 10:01:36 | 00,005,515 | —- | C] () – C:\WINDOWS\System32\ENSDEF.INI
[2008/07/26 10:01:36 | 00,000,194 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2008/07/26 09:58:12 | 00,000,136 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2008/07/26 09:50:40 | 00,000,132 | —- | C] () – C:\Documents and Settings\sonnguyen\Local Settings\Application Data\fusioncache.dat
[2008/07/26 08:25:02 | 00,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008/07/23 11:50:52 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/07/23 11:46:38 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2004/12/01 16:43:00 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/12/01 16:16:58 | 00,156,672 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2004/12/01 14:51:57 | 00,000,811 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/12/01 13:29:23 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2004/12/01 13:28:46 | 00,000,790 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/10/22 15:10:08 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/01/07 14:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/06/12 12:21:12 | 00,049,152 | R— | C] () – C:\WINDOWS\System32\winchip.dll
[2001/10/24 19:00:40 | 00,524,288 | —- | C] () – C:\WINDOWS\System32\TDI-SonyOMG.dll
[1996/04/03 14:33:26 | 00,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2008/08/01 22:45:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2010/01/07 03:56:51 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/01/07 03:54:36 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2008/08/03 23:28:42 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2009/06/16 09:47:44 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2008/09/29 11:45:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EmailNotifier
[2008/09/29 11:45:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Megaupload
[2008/07/26 16:45:29 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2009/03/22 21:06:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2008/08/01 22:45:40 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/08/01 22:46:37 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\acccore
[2008/07/27 08:39:09 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Auslogics
[2009/08/13 03:27:32 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Azureus
[2009/10/06 15:14:30 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Blitware
[2009/06/16 10:01:50 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\DAEMON Tools Lite
[2008/09/29 11:45:11 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\EmailNotifier
[2009/07/14 11:17:13 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\GetRightToGo
[2008/12/20 22:53:34 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\GSC 2.00
[2009/09/16 15:12:49 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Jasc
[2008/11/28 20:01:50 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Leadertech
[2008/12/15 05:25:02 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\LimeWire
[2010/01/07 03:57:30 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\MegauploadToolbar
[2008/11/26 03:32:03 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Screaming Bee
[2009/12/23 20:15:15 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Tific
[2008/08/02 03:17:33 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Viewpoint

========== Purity Check ==========


< End of report >
Post #51
Hi faithiefaith,

Have a look here for the OTL log

C:\_OTListIt\MovedFiles

In the right panel should be some log files , they will have an icon that looks sort of like a notepad. The names will be a series of numbers, this represents the date and time. Post the most recent.

Thanks
Post #52
Thank you :) Here it is: ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List not found. Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List not found. ========== FILES ========== C:\Documents and Settings\sonnguyen\My Documents\LimeWire\Store Purchased folder moved successfully. C:\Documents and Settings\sonnguyen\My Documents\LimeWire\Shared folder moved successfully. C:\Documents and Settings\sonnguyen\My Documents\LimeWire\Saved\Trance & Techno folder moved successfully. C:\Documents and Settings\sonnguyen\My Documents\LimeWire\Saved folder moved successfully. C:\Documents and Settings\sonnguyen\My Documents\LimeWire\Incomplete folder moved successfully. C:\Documents and Settings\sonnguyen\My Documents\LimeWire folder moved successfully. File\Folder C:\Program Files\Symantec not found. C:\Program Files\Vuze\plugins\azupnpav folder moved successfully. C:\Program Files\Vuze\plugins\azemp\mplayer folder moved successfully. C:\Program Files\Vuze\plugins\azemp folder moved successfully. C:\Program Files\Vuze\plugins folder moved successfully. C:\Program Files\Vuze folder moved successfully. File\Folder C:\Program Files\LimeWire not found. ========== COMMANDS ========== OTL by OldTimer - Version 3.1.21.0 log created on 01072010_034203
Post #53
Hi faithiefaith,

Quick little fix then we'll clean up the tools and re-enable your drivers.

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:OTL
[2009/08/13 03:27:32 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Azureus
[2008/08/03 23:28:42 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2008/12/15 05:25:02 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\LimeWire
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
Post #54
========== OTL ========== C:\Documents and Settings\sonnguyen\Application Data\Azureus\updates folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\torrents folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\tmp folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\subs folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\shares folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\plugins\azupnpav folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\plugins folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\net folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\media\azpd folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\media folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\logs\save folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\logs folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\dht folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\cache folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus\active folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\Azureus folder moved successfully. C:\Documents and Settings\All Users\Application Data\Azureus folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire\xml\data folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire\xml folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire\themes\windows_theme folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire\themes\limewirePro_theme folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire\themes folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire\promotion folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire\.AppSpecialShare folder moved successfully. C:\Documents and Settings\sonnguyen\Application Data\LimeWire folder moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found. OTL by OldTimer - Version 3.1.21.0 log created on 01072010_043956
Post #55 last edited
Hi faithiefaith,


If no other problems, we can clean up our tools. Keep Defogger, we will use it shortly.

From your desktop, please delete, if present
  • any notepads/logs that we created
  • GMER.zip
  • GMER.exe (whatever you renamed it to)
  • Norton_Removal_Tool.exe

Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /uninstall


Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep MBAM updated and use it regularly.


To re-enable your Emulation drivers, double click DeFogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.



Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. You have an antivirus program and an on demand antispyware program.

For resident antispyware I suggest either

Windows Defender
OR
Winpatrol

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware,IMO)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis

- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.

- Keep your antivirus program updated, as well as any other security programs you have.

-More tips and programs can be found HERE

- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".


Take care :adios:
Post #56
I had no problems with the last steps. The computer is working again!

Thank you so much for taking your time to help me with this computer. I really cannot express how much I appreciate it. I am so glad that this forum full of knowledgable and helpful people exists. What you're doing here is amazing. I couldn't have fixed this computer without the tons of help you have given me. I will be sure to read through and follow the tips to keep me safe in the future. I have downloaded Windows Defender and Spyware Blaster in addition to checking my IE settings. I feel so much safer now. Again, thank you so much.

You take care as well! :wavey:
Post #57
Hi faithiefaith, You are very welcome. Feel free to browse the rest of the forum, there's plenty of good stuff to discover. Take care, keep safe.
Post #58
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI