What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] "System Has been infected" Backgound image Locked

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #32 last edited
any luck locating regrebld.exe on your system? How difficult would it be to reinstall your SQL and import your db's?
Post #33
no i was not able to find it. Well my fear is that i will not be able to get my db because they are attached to the server and since i cant get the server running i will not be able to get the db's unattached
Post #35 last edited
Hi

Please do the following:

I am looking for any other files in the binn directory that may assist us.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :dir
c:\program files\microsoft sql server\80\tools\binn /s

:service
MSSQLServerAdHelper
MSSQLSERVER
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


The only other option perhaps is to restore the computer back to where the SQL server was running once more.

Export your db's to an external drive so they will be safe, then clean the computer again with ComboFix, then reinstall the SQL and import the db's that you previously backed up.

Let me know your thoughts on this.
Post #36 last edited
Hello I would just like to tell you that i managed to get the problem resolved yesterday. I had to manual uninstall the SQL server from my computer(delete the registry entrys by hand) because it would kick back and error or stall out when you tried to run the uninstall. I reinstalled it an got it going( it sounds so simple when i say it like that but in reality it took me all most 10 hours to get it back going). Thank you so much for all of you time, patience and guidance threw this. Your services were one of a kind. Thanks again Pat P.S. I did not see your most recent post till right now else wise i would have followed that.
Post #37
Hi,

I'm sorry it wasn't an easy fix for you, but obviously the malware corrupted the installation.

Your machine was very heavily infected.

We need to do a couple of more scans to make sure we have all the infections:

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • MBAM Log
  • Kaspersky report
Post #38
Here is the malware log. I can not run the kaspersky online scan because I have kasperky anti virus installed on my computer. Malwarebytes' Anti-Malware 1.44 Database version: 3556 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 1/13/2010 4:09:36 PM mbam-log-2010-01-13 (16-09-36).txt Scan type: Quick Scan Objects scanned: 120903 Time elapsed: 10 minute(s), 33 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 6 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\browser.exe (Worm.AutoRun) -> Quarantined and deleted successfully. C:\Documents and Settings\Pat\Application Data\EHBinHex.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\AdobeLM.dll (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Tw10122.dat (Worm.KoobFace) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Local.dtd (Malware.Trace) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Ui.dtd (Malware.Trace) -> Quarantined and deleted successfully.
Post #39
Here is the log from my Kaspersky. Status: Deleted (events: 30) 1/12/2010 7:21:12 PM Deleted Trojan program Trojan.Win32.Tdss.avbu C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\H8SRTkypixdoykt.sys.vir High 1/12/2010 7:21:10 PM Deleted Trojan program Trojan-Downloader.Win32.Small.aood C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\svchost.exe.vir High 1/12/2010 7:21:08 PM Deleted virus Rootkit.Win32.Bezopi.g C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\OLD7.tmp.vir High 1/12/2010 7:21:07 PM Deleted Trojan program Trojan-Dropper.Win32.Mudrop.fru C:\Qoobox\Quarantine\C\WINDOWS\system32\winlogon32.exe.vir High 1/12/2010 7:21:05 PM Deleted Trojan program Trojan-Dropper.Win32.Mudrop.fru C:\Qoobox\Quarantine\C\WINDOWS\system32\smss32.exe.vir High 1/12/2010 7:21:04 PM Deleted Trojan program Trojan.Win32.FraudPack.ajtw C:\Qoobox\Quarantine\C\WINDOWS\system32\helper32.dll.vir High 1/12/2010 7:21:03 PM Deleted Trojan program Packed.Win32.TDSS.aa C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTqrlybluvpj.dll.vir High 1/12/2010 7:21:03 PM Deleted Trojan program Packed.Win32.TDSS.aa C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTltbqxfijsw.dll.vir High 1/12/2010 7:21:02 PM Deleted Trojan program Trojan.Win32.Agent.dfjb C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll.vir High 1/12/2010 7:21:03 PM Deleted Trojan program Trojan.Win32.FraudPack.ajug C:\Qoobox\Quarantine\C\Program Files\InternetSecurity2010\IS2010.exe.vir High 1/12/2010 7:21:00 PM Deleted Trojan program Trojan.Win32.FraudPack.ajss C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTbpjxtufybw.dll.vir High 1/12/2010 6:08:01 PM Deleted Trojan program Trojan-Dropper.Win32.Mudrop.fru C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106169.exe High 1/12/2010 6:07:59 PM Deleted Trojan program Trojan-Dropper.Win32.Mudrop.fru C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106165.exe High 1/12/2010 6:07:56 PM Deleted Trojan program Trojan.Win32.FraudPack.ajtw C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106161.dll High 1/12/2010 6:07:52 PM Deleted Trojan program Trojan-Downloader.Win32.Small.aood C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106158.exe High 1/12/2010 6:07:44 PM Deleted Trojan program Trojan.Win32.FraudPack.ajug C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106138.exe High 1/12/2010 1:52:37 PM Deleted Trojan program Trojan.Win32.Agent.dfjb C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106137.dll High 1/12/2010 5:55:31 AM Deleted Trojan program Trojan.Win32.FraudPack.ajss C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106106.dll High 1/12/2010 5:32:16 AM Deleted Trojan program Packed.Win32.TDSS.aa C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106105.dll High 1/12/2010 5:15:16 AM Deleted Trojan program Packed.Win32.TDSS.aa C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106105.dll High 1/12/2010 4:15:14 AM Deleted Trojan program Packed.Win32.TDSS.aa C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106104.dll High 1/12/2010 3:15:38 AM Deleted Trojan program Trojan.Win32.Tdss.avbu C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106103.sys High 1/12/2010 2:15:16 AM Deleted Trojan program Trojan.Win32.FraudPack.ajtw C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103283.dll High 1/12/2010 1:15:15 AM Deleted Trojan program Trojan-Downloader.Win32.Small.aood C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103280.exe High 1/12/2010 12:15:13 AM Deleted Trojan program Trojan.Win32.FraudPack.ajug C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103260.exe High 1/11/2010 11:15:23 PM Deleted Trojan program Trojan.Win32.Agent.dfjb C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103259.dll High 1/11/2010 10:16:17 PM Deleted Trojan program Trojan.Win32.FraudPack.ajss C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103088.dll High 1/11/2010 9:15:18 PM Deleted Trojan program Packed.Win32.TDSS.aa C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103087.dll High 1/11/2010 8:15:13 PM Deleted Trojan program Packed.Win32.TDSS.aa C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103086.dll High 1/11/2010 7:12:41 PM Deleted Trojan program Trojan.Win32.Tdss.avbu C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103085.sys High
Post #40
Hi,


Please run this online scan


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Post #41
C:\Qoobox\Quarantine\[4]-Submit_2010-01-11_17.31.04.zip a variant of Win32/Kryptik.BMP trojan deleted - quarantined C:\Qoobox\Quarantine\C\WINDOWS\system32\gehufidu.dll.vir Win32/KillAV.NHS trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\system32\gepibura.dll.vir a variant of Win32/Kryptik.BMP trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\system32\holiwaga.dll.vir a variant of Win32/KillAV.NHS trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\system32\tayanage.dll.vir a variant of Win32/Kryptik.BMP trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\system32\warning.html.vir Win32/TrojanDownloader.FakeAlert.AED virus deleted - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103281.dll Win32/KillAV.NHS trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103282.dll a variant of Win32/Kryptik.BMP trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103284.dll a variant of Win32/KillAV.NHS trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP505\A0103288.dll a variant of Win32/Kryptik.BMP trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106159.dll Win32/KillAV.NHS trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106160.dll a variant of Win32/Kryptik.BMP trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106162.dll a variant of Win32/KillAV.NHS trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{C53722FA-6049-406E-A98D-DF2A75D5F126}\RP506\A0106167.dll a variant of Win32/Kryptik.BMP trojan cleaned by deleting - quarantined C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Desktop.htt Win32/TrojanDownloader.FakeAlert.AED virus deleted - quarantined
Post #43
Everything seams to be running just fine. Here are the logs DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 10:36:03.03 on Thu 01/14/2010 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.77 [GMT -6:00] AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\AutoScale2000\Attended.exe C:\Program Files\AutoScale2000\Devices.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\AutoScale2000\ASIRptPr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe C:\Program Files\AutoScale2000\ASIScaleSvr.exe C:\Documents and Settings\Pat\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = about:blank mStart Page = about:blank BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\ievkbd.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.3000.1001\en-us\msntb.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File mRun: [WinPatrol] c:\progra~1\billps~1\winpat~1\winpatrol.exe mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} Trusted Zone: aol.com\free DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://active.macromedia.com/flash2/cabs/swflash.cab Notify: klogon - c:\windows\system32\klogon.dll AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\pat\applic~1\mozilla\firefox\profiles\jpqroyfl.default\ FF - prefs.js: browser.search.selectedEngine - eBay FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - component: c:\program files\mozilla firefox\extensions\[removed]\components\KavLinkFilter.dll FF - plugin: c:\documents and settings\pat\application data\move networks\plugins\npqmp071505000011.dll FF - plugin: c:\documents and settings\pat\application data\mozilla\firefox\profiles\jpqroyfl.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-12-23 36880] R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016] R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-1-11 315408] R2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe [2009-10-20 340456] R2 FSHOOK;FSHOOK;c:\windows\system32\drivers\FSHOOK.SYS [2004-6-21 7040] R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [2008-10-20 20504] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472] S0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2004-6-21 77312] S2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\windows\system32\drivers\nvtvsnd.sys –> c:\windows\system32\drivers\nvtvsnd.sys [?] S2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;"c:\program files\webroot\spy sweeper\spysweeper.exe" –> c:\program files\webroot\spy sweeper\SpySweeper.exe [?] S3 dalwdmservice;dal service;c:\windows\system32\drivers\dalwdm.sys –> c:\windows\system32\drivers\dalwdm.sys [?] S3 iteio;iteio;c:\windows\system32\drivers\Iteio.sys [2004-6-21 3680] S3 Vsp;Vsp;\??\c:\windows\system32\drivers\vsp.sys –> c:\windows\system32\drivers\Vsp.sys [?] =============== Created Last 30 ================ 2010-01-13 23:06:04 0 d—–w- c:\program files\ESET 2010-01-13 21:56:22 0 d—–w- c:\docume~1\pat\applic~1\Malwarebytes 2010-01-13 21:56:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-13 21:56:12 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-01-13 21:56:10 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-01-13 21:56:09 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-01-12 23:25:42 0 d—–w- C:\sqlbackup 2010-01-12 21:51:45 0 d—–w- c:\program files\Microsoft SQL Server 2010-01-12 21:04:16 0 d—–w- C:\MSDE 2010-01-12 17:13:30 0 d—–w- C:\MSDE backup 2010-01-12 00:04:22 0 d—–w- c:\program files\Kaspersky Lab 2010-01-12 00:04:22 0 d—–w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab 2010-01-11 20:21:50 0 d—–w- c:\windows\system32\wbem\Repository 2010-01-11 19:00:00 0 d-sha-r- C:\cmdcons 2010-01-11 18:58:51 98816 —-a-w- c:\windows\sed.exe 2010-01-11 18:58:51 77312 —-a-w- c:\windows\MBR.exe 2010-01-11 18:58:51 261632 —-a-w- c:\windows\PEV.exe 2010-01-11 18:58:51 161792 —-a-w- c:\windows\SWREG.exe 2010-01-02 20:13:42 0 d—–w- c:\windows\system32\XPSViewer 2010-01-02 20:12:53 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2010-01-02 20:12:53 117760 ——w- c:\windows\system32\prntvpt.dll 2010-01-02 20:12:52 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2010-01-02 20:12:52 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll 2010-01-02 20:12:52 575488 ——w- c:\windows\system32\xpsshhdr.dll 2010-01-02 20:12:51 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll 2010-01-02 20:12:51 1676288 ——w- c:\windows\system32\xpssvcs.dll 2010-01-02 20:12:51 0 d—–w- C:\e745aa45b9d8451e60ebc 2009-12-30 14:51:33 0 d—–w- c:\program files\common files\Sonic Shared 2009-12-30 14:51:32 0 d—–w- c:\program files\Roxio 2009-12-30 14:26:06 0 d—–w- c:\docume~1\alluse~1\applic~1\Research In Motion 2009-12-28 18:32:14 0 d—–w- c:\program files\WebEx 2009-12-28 17:58:02 0 d—–w- c:\windows\LastGood(2) 2009-12-24 15:57:08 470528 -c—-w- c:\windows\system32\dllcache\aclayers.dll 2009-12-24 15:45:15 664 —-a-w- c:\windows\system32\d3d9caps.dat 2009-12-24 14:06:27 104 —-a-w- c:\windows\system32\nvapps.xml 2009-12-24 14:06:25 446464 —-a-w- c:\windows\system32\nvuninst.exe 2009-12-24 14:06:25 446464 —-a-w- c:\windows\system32\nvudisp.exe 2009-12-24 14:06:25 18070 —-a-w- c:\windows\system32\nvdisp.nvu 2009-12-23 22:14:15 3387392 —-a-r- c:\windows\system32\nvrsja.dll 2009-12-23 18:28:40 0 d–h–w- c:\windows\PIF 2009-12-23 16:53:26 36880 —-a-w- c:\windows\system32\drivers\klbg.sys 2009-12-23 16:47:53 0 d—–w- c:\program files\TrendMicro 2009-12-23 15:25:52 0 d—–w- C:\NVIDIA ==================== Find3M ==================== 2009-12-18 22:41:12 704544 –sha-w- c:\windows\system32\drivers\fidbox2.dat 2009-12-18 22:41:12 3488 –sha-w- c:\windows\system32\drivers\fidbox2.idx 2009-12-18 22:41:12 3128864 –sha-w- c:\windows\system32\drivers\fidbox.dat 2009-12-18 22:41:12 25524 –sha-w- c:\windows\system32\drivers\fidbox.idx 2009-10-29 05:48:04 662016 ——w- c:\windows\system32\wininet.dll 2009-10-21 06:00:55 75776 —-a-w- c:\windows\system32\strmfilt.dll 2009-10-21 06:00:55 25088 —-a-w- c:\windows\system32\httpapi.dll 2009-10-21 02:34:56 219664 —-a-w- c:\windows\system32\klogon.dll ============= FINISH: 10:36:58.09 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume1 Install Date: 6/21/2004 1:07:05 AM System Uptime: 1/13/2010 4:12:12 PM (18 hours ago) Motherboard: soyocomputer | | KT600-8237 Processor: AMD Athlon™ XP 2600+ | Socket A | 1916/167mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 112 GiB total, 81.643 GiB free. D: is CDROM () E: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318} Description: VIA Serial ATA RAID Controller Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_31491106&REV_80\3&61AAA01&0&78 Manufacturer: VIA Technologies, Inc. Name: VIA Serial ATA RAID Controller PNP Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_31491106&REV_80\3&61AAA01&0&78 Service: viasraid Class GUID: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} Description: HID Non-User Input Data Filter (KB 911895) Device ID: HID\VID_045E&PID_00E1&COL01\6&1BCD3302&0&0000 Manufacturer: Microsoft Name: HID Non-User Input Data Filter (KB 911895) PNP Device ID: HID\VID_045E&PID_00E1&COL01\6&1BCD3302&0&0000 Service: NuidFltr ==== System Restore Points =================== RP461: 10/16/2009 4:23:23 PM - System Checkpoint RP462: 10/19/2009 5:49:13 PM - System Checkpoint RP463: 10/20/2009 6:00:41 PM - System Checkpoint RP464: 10/27/2009 5:49:45 PM - System Checkpoint RP465: 10/28/2009 7:38:54 PM - System Checkpoint RP466: 10/29/2009 8:29:12 PM - System Checkpoint RP467: 11/2/2009 6:45:51 PM - System Checkpoint RP468: 11/4/2009 6:28:18 PM - System Checkpoint RP469: 11/5/2009 6:45:12 PM - System Checkpoint RP470: 11/6/2009 6:46:50 PM - System Checkpoint RP471: 11/7/2009 8:22:12 AM - Software Distribution Service 3.0 RP472: 11/7/2009 9:07:52 AM - Software Distribution Service 3.0 RP473: 11/9/2009 5:23:25 PM - System Checkpoint RP474: 11/10/2009 6:01:11 PM - System Checkpoint RP475: 11/16/2009 5:37:49 AM - Installed Compatibility Pack for the 2007 Office system RP476: 11/17/2009 4:55:59 PM - System Checkpoint RP477: 11/18/2009 5:26:01 PM - System Checkpoint RP478: 11/19/2009 6:38:02 PM - System Checkpoint RP479: 11/20/2009 7:26:01 PM - System Checkpoint RP480: 11/21/2009 7:37:58 PM - System Checkpoint RP481: 11/22/2009 8:26:01 PM - System Checkpoint RP482: 11/23/2009 9:24:51 PM - System Checkpoint RP483: 11/24/2009 10:23:47 PM - System Checkpoint RP484: 11/27/2009 5:11:09 PM - System Checkpoint RP485: 11/30/2009 7:06:30 PM - System Checkpoint RP486: 12/2/2009 4:18:54 PM - System Checkpoint RP487: 12/3/2009 5:53:52 PM - System Checkpoint RP488: 12/9/2009 5:21:51 PM - System Checkpoint RP489: 12/10/2009 5:38:42 PM - System Checkpoint RP490: 12/13/2009 9:33:31 AM - System Checkpoint RP491: 12/16/2009 4:46:24 PM - System Checkpoint RP492: 12/28/2009 11:57:25 AM - System Checkpoint RP493: 12/28/2009 12:15:20 PM - Restore Operation RP494: 1/4/2010 5:32:29 AM - Printer Driver Microsoft XPS Document Writer Installed RP495: 1/4/2010 5:59:53 AM - Software Distribution Service 3.0 RP496: 1/4/2010 6:12:35 AM - Installed HiJackThis RP497: 1/5/2010 10:23:36 AM - System Checkpoint RP498: 1/6/2010 7:28:08 AM - Removed Kaspersky Anti-Virus 2010. RP499: 1/6/2010 8:10:23 AM - Installed Kaspersky Anti-Virus 2010. RP500: 1/6/2010 9:22:54 AM - Removed Kaspersky Anti-Virus 2010. RP501: 1/6/2010 9:33:12 AM - Installed Kaspersky Anti-Virus 2010. RP502: 1/6/2010 9:37:15 AM - Removed Kaspersky Anti-Virus 2010. RP503: 1/6/2010 1:18:06 PM - Installed Kaspersky Anti-Virus 2010. RP504: 1/7/2010 4:57:15 PM - System Checkpoint RP505: 1/11/2010 6:54:58 AM - Automatic Restore Point RP506: 1/11/2010 2:20:53 PM - Restore Operation RP507: 1/11/2010 6:03:58 PM - Installed Kaspersky Anti-Virus 2010. RP508: 1/12/2010 11:17:53 AM - Removed Microsoft SQL Server Desktop Engine RP509: 1/12/2010 12:43:22 PM - Removed Microsoft SQL Server Desktop Engine RP510: 1/12/2010 12:46:44 PM - Removed Microsoft SQL Server Desktop Engine RP511: 1/12/2010 12:47:10 PM - Removed Microsoft SQL Server Desktop Engine RP512: 1/12/2010 3:22:40 PM - Installed Microsoft SQL Server Desktop Engine RP513: 1/12/2010 3:44:52 PM - Installed Microsoft SQL Server Desktop Engine RP514: 1/12/2010 3:47:43 PM - Automatic Restore Point RP515: 1/12/2010 3:55:42 PM - Restore Operation RP516: 1/12/2010 3:58:04 PM - Installed Microsoft SQL Server Desktop Engine RP517: 1/13/2010 5:37:18 AM - Automatic Restore Point RP518: 1/14/2010 9:23:19 AM - System Checkpoint ==== Installed Programs ====================== 32 Bit HP BiDi Channel Components Installer 3DPipe© Version 1.5 Adobe Acrobat 5.0 Adobe Creative Suite Adobe Download Manager Adobe Flash Player 10 Plugin Adobe SVG Viewer 3.0 Ahead InCD Ahead InCD EasyWrite Reader Ahead Nero Express Ahead NeroVision Express Apple Mobile Device Support Apple Software Update AutoCAD 2004 AutoCAD Express Tools Volumes 1-9 Autodesk Express Viewer AutoScale 2000 BlackBerry Desktop Software 5.0.1 Bonjour BootMagic BroadJump Client Foundation ccCommon Cliprex DS DVD Player Compatibility Pack for the 2007 Office system Creative Modem Blaster PCI DI5633 Creative System Information dBpoweramp FLAC Codec dBpoweramp Music Converter Digidesign Shared Plug-Ins DIGOpt DIGReqEx DNA Drivers Install For Linksys Easylink Advisor Exact Audio Copy 0.99pb3 Eye Candy 3.1 for After Effects Garmin Communicator Plugin Garmin POI Loader Garmin USB Drivers Google SketchUp 7 HiJackThis Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) hp instant support hp print screen utility iTunes Jasc Paint Shop Pro 9 Java™ 6 Update 7 Kaspersky Anti-Virus 2010 Linksys EasyLink Advisor 1.6 (0032) Macromedia Flash Player 8 Malwarebytes' Anti-Malware Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft IntelliPoint 6.2 Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office 2000 SR-1 Professional Microsoft Picture It! Express 9 Microsoft Picture It! Library 9 Microsoft SQL Server Desktop Engine Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visio Professional 2002 [English] mkw Audio Compression Toolkit MobileMe Control Panel Move Media Player Mozilla Firefox (3.5.7) MSN MSN Encarta Plus Support Files MSN Messenger 6.2 MSN Toolbar MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 and SOAP Toolkit 3.0 MSXML 6 Service Pack 2 (KB973686) NVIDIA Drivers OpenOffice.org Installer 1.0 PACE System Files PartitionMagic PowerDVD PowerQuest BootMagic 8.0 PowerQuest PartitionMagic 8.0 Quicken 2005 QuickTime RealPlayer Roxio Media Manager Roxio UDF Reader Safari Screenblast ACID 4.0 Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371-v2) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974455) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB976325) Sound Blaster Live! SOYO H/W Monitor The Disc 3.0 Update for Windows XP (KB898461) Update for Windows XP (KB951072-v2) Update for Windows XP (KB955759) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VIA Audio Driver Setup Program VIA Integrated Setup Wizard VIA Rhine-Family Fast Ethernet Adapter Visual IP InSight(SBC) WASAY DPU WebEx WebFldrs XP Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Media Format 11 runtime Windows Media Player 11 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinPatrol Xvid 1.1.3 final uninstall ==== Event Viewer Messages From Past Week ======== 1/8/2010 9:21:49 AM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 f8d1051d, parameter3 f8c8dc00, parameter4 f8c8d8fc. 1/8/2010 6:48:58 AM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 f8d1851d, parameter3 f8bedc00, parameter4 f8bed8fc. 1/7/2010 6:12:05 AM, information: Windows File Protection [64001] - File replacement was attempted on the protected system file aec.sys. This file was restored to the original version to maintain system stability. The file version of the bad file is 1.4.0.0, the version of the system file is 5.1.2601.2078. 1/12/2010 6:10:50 AM, error: Service Control Manager [7001] - The SQLSERVERAGENT service depends on the MSSQLSERVER service which failed to start because of the following error: After starting, the service hung in a start-pending state. 1/12/2010 5:28:03 AM, error: Service Control Manager [7034] - The MSSQLSERVER service terminated unexpectedly. It has done this 5 time(s). 1/12/2010 5:26:48 AM, error: Service Control Manager [7034] - The MSSQLSERVER service terminated unexpectedly. It has done this 4 time(s). 1/12/2010 5:26:24 AM, error: Service Control Manager [7034] - The MSSQLSERVER service terminated unexpectedly. It has done this 3 time(s). 1/12/2010 5:23:18 AM, error: Service Control Manager [7024] - The MSSQLServerADHelper service terminated with service-specific error 3221225572 (0xC0000064). 1/12/2010 5:23:11 AM, error: Service Control Manager [7034] - The MSSQLSERVER service terminated unexpectedly. It has done this 2 time(s). 1/12/2010 3:40:31 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 4 time(s). 1/12/2010 2:44:46 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 3 time(s). 1/12/2010 2:25:32 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 2 time(s). 1/12/2010 2:06:37 PM, error: Service Control Manager [7001] - The SQLSERVERAGENT service depends on the MSSQLSERVER service which failed to start because of the following error: The system cannot find the path specified. 1/12/2010 2:05:13 PM, error: Service Control Manager [7000] - The MSSQLSERVER service failed to start due to the following error: The system cannot find the path specified. 1/12/2010 12:50:53 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 Fips kl1 KLIF 1/12/2010 12:50:08 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 1/12/2010 12:49:53 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 1/12/2010 12:49:40 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 1/12/2010 12:19:42 PM, error: Service Control Manager [7034] - The MSSQLSERVER service terminated unexpectedly. It has done this 7 time(s). 1/12/2010 11:38:01 AM, error: Service Control Manager [7034] - The MSSQLSERVER service terminated unexpectedly. It has done this 6 time(s). 1/12/2010 11:17:53 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found. 1/12/2010 1:08:38 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s). 1/11/2010 6:13:13 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service. 1/11/2010 5:30:42 PM, error: Service Control Manager [7034] - The InCD File System Service service terminated unexpectedly. It has done this 1 time(s). 1/11/2010 5:17:47 AM, error: Service Control Manager [7034] - The WMDM PMSP Service service terminated unexpectedly. It has done this 1 time(s). 1/11/2010 5:17:47 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s). 1/11/2010 5:17:46 AM, error: Service Control Manager [7034] - The Roxio Upnp Server 9 service terminated unexpectedly. It has done this 1 time(s). 1/11/2010 5:17:46 AM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s). 1/11/2010 5:17:21 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Kaspersky Anti-Virus service to connect. 1/11/2010 5:17:21 AM, error: Service Control Manager [7000] - The Kaspersky Anti-Virus service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/11/2010 4:38:10 PM, error: Service Control Manager [7034] - The MSSQLSERVER service terminated unexpectedly. It has done this 1 time(s). 1/11/2010 4:38:09 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: UdfReadr 1/11/2010 4:37:50 PM, error: Service Control Manager [7022] - The MSSQLSERVER service hung on starting. 1/11/2010 4:36:24 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect. 1/11/2010 4:36:24 PM, error: Service Control Manager [7000] - The Webroot Spy Sweeper Engine service failed to start due to the following error: The system cannot find the path specified. 1/11/2010 4:36:24 PM, error: Service Control Manager [7000] - The nVidia WDM TVAudio Crossbar service failed to start due to the following error: The system cannot find the file specified. 1/11/2010 2:27:32 PM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 f8d0a51d, parameter3 f8c71c38, parameter4 f8c71934. 1/11/2010 2:27:30 PM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 f8cfe51d, parameter3 f8c7dc00, parameter4 f8c7d8fc. 1/11/2010 2:18:15 PM, error: Service Control Manager [7000] - The Digidesign MME Refresh Service service failed to start due to the following error: The system cannot find the file specified. 1/11/2010 10:14:13 AM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 f8d0051d, parameter3 f8bedc00, parameter4 f8bed8fc. 1/11/2010 10:14:12 AM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 f8d0451d, parameter3 f8c85c00, parameter4 f8c858fc. 1/11/2010 10:14:09 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 1/11/2010 10:14:05 AM, error: System Error [1003] - Error code 100000d1, parameter1 f69ae198, parameter2 00000002, parameter3 00000000, parameter4 f69a5d8a. ==== End Of File ===========================
Post #44
Hi,

Things look good

Just some housekeeping to do now,

Please do the following:

Please download JavaRa to your desktop and unzip it to its own folder.
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
  • Scroll down to the Java SE Runtime Environment (JRE) option.
  • Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 17)


NEXT


Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /uninstall in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If any logs remain after using this tool > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.


  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.


  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.





    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE


  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI