What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Can't open anti-spyware programs; Google redirect;

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi,

Please do the following:


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Can_t_open_anti_spyware_programs_Google_redirect_t109747.html&view=findpost&p=628147#entry628147

Collect::
c:\program files\Malware Defense\mdefense.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malware Defense"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.


NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

[external image: Posted Image] Your Java is out of date.
Java™ 6 Update 16 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now.
An update should begin; > follow the prompts.


NEXT

Please advise how your computer is running now and if there are any outstanding issues.
Post #17
Hi,

Here is the latest ComboFix log. I haven't noticed any performance issues, it appears to be running as good as new.

ComboFix 10-01-27.03 - JAbena 01/27/2010 17:48:29.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.682 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\combo.com.exe
Command switches used :: c:\documents and settings\JAbena\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-28 )))))))))))))))))))))))))))))))
.

2010-01-27 04:39 . 2010-01-27 04:39 ——– d—–w- c:\documents and settings\JAbena\Application Data\Malwarebytes
2010-01-27 04:39 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-27 04:39 . 2010-01-27 04:39 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-27 04:39 . 2010-01-27 04:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-27 04:39 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-23 17:33 . 2010-01-23 17:33 ——– d-s—w- c:\documents and settings\Administrator.NETBOOK.000\UserData
2010-01-23 17:13 . 2010-01-23 17:13 ——– d—–w- c:\documents and settings\Administrator.NETBOOK.000\Local Settings\Application Data\Mozilla
2010-01-23 04:51 . 2010-01-23 04:51 ——– d-s—w- c:\documents and settings\Administrator.NETBOOK\UserData
2010-01-22 08:50 . 2010-01-26 03:47 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-01-21 09:01 . 2010-01-21 09:01 ——– d—–w- c:\program files\Windows Live Safety Center
2010-01-21 08:43 . 2010-01-21 08:43 ——– d—–w- C:\63d8b68237bc4a4c59f834f0
2010-01-21 08:43 . 2010-01-21 08:43 ——– d—–w- C:\f055de69d368e3edc3
2010-01-21 08:31 . 2010-01-21 08:31 ——– d—–w- C:\3b699c428c7b07d0b23770ea
2010-01-21 06:11 . 2009-11-09 19:20 207792 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-01-21 06:11 . 2009-10-07 00:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-01-21 06:11 . 2009-09-03 17:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\program files\Spyware Doctor
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\program files\Common Files\PC Tools
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\documents and settings\JAbena\Application Data\PC Tools
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-01-21 06:11 . 2010-01-27 04:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-21 05:54 . 2010-01-21 06:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-07 03:05 . 2010-01-07 03:05 ——– d–h–w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-21 07:29 . 2009-08-01 09:31 ——– d—–w- c:\program files\Common Files\Adobe
2010-01-21 05:54 . 2009-08-01 08:50 ——– d—–w- c:\program files\Google
2010-01-21 05:51 . 2009-11-30 09:27 ——– d—–w- c:\documents and settings\JAbena\Application Data\vlc
2010-01-21 05:06 . 2009-08-01 09:01 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-18 07:33 . 2009-12-01 11:08 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2009-12-28 08:17 . 2009-12-28 08:17 ——– d—–w- c:\documents and settings\JAbena\Application Data\Mael
2009-12-27 10:41 . 2009-08-01 09:11 ——– d—–w- c:\program files\McAfee
2009-12-22 16:38 . 2009-08-01 08:43 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-22 16:38 . 2009-08-01 08:48 ——– d—–w- c:\program files\Common Files\InstallShield
2009-12-22 05:21 . 2009-08-01 07:34 667136 ——w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2009-08-01 08:52 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-12-21 06:12 . 2009-11-30 23:15 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2009-12-15 05:28 . 2009-12-15 05:28 ——– d—–w- c:\program files\Common Files\SWF Studio
2009-12-14 19:15 . 2009-12-14 19:15 2146304 —-a-w- c:\windows\system32\GPhotos.scr
2009-12-09 11:01 . 2009-08-01 08:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-09 09:54 . 2009-12-09 09:54 54436 —ha-w- c:\windows\system32\mlfcache.dat
2009-12-05 10:20 . 2009-11-30 23:34 60664 —-a-w- c:\documents and settings\JAbena\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-04 19:57 . 2009-12-04 19:57 ——– d—–w- c:\program files\MSBuild
2009-12-04 19:57 . 2009-12-04 19:57 ——– d—–w- c:\program files\Reference Assemblies
2009-12-02 18:35 . 2009-08-01 06:54 76487 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-02 09:28 . 2009-12-02 09:28 ——– d—–w- c:\documents and settings\JAbena\Application Data\Hewlett-Packard
2009-12-02 09:27 . 2009-12-02 09:21 20724 —-a-w- c:\windows\hpoins01.dat
2009-12-02 09:27 . 2009-12-02 09:22 ——– d—–w- c:\program files\Hewlett-Packard
2009-12-02 09:27 . 2009-12-02 09:27 82380 —-a-w- c:\windows\system32\drivers\AFS2K.SYS
2009-12-02 09:24 . 2009-12-02 09:24 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2009-12-02 06:39 . 2009-08-01 09:11 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-02 06:08 . 2009-12-02 06:09 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-02 06:08 . 2009-12-02 06:08 ——– d—–w- c:\program files\Java
2009-12-02 06:07 . 2009-12-02 06:07 152576 —-a-w- c:\documents and settings\JAbena\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-12-02 05:47 . 2009-12-01 11:13 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT
2009-12-02 05:46 . 2009-12-01 17:53 ——– d—–w- c:\documents and settings\JAbena\Application Data\Nikon
2009-12-01 21:37 . 2009-12-01 21:37 0 —-a-w- c:\windows\nsreg.dat
2009-12-01 18:57 . 2009-12-01 18:57 ——– d—–w- c:\documents and settings\JAbena\Application Data\eSobi
2009-12-01 11:17 . 2009-12-01 11:17 49152 —-a-r- c:\documents and settings\JAbena\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2009-12-01 11:17 . 2009-12-01 11:10 ——– d—–w- c:\program files\Common Files\Nikon
2009-12-01 11:17 . 2009-12-01 11:17 57344 —-a-r- c:\documents and settings\JAbena\Application Data\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2009-12-01 11:14 . 2009-12-01 11:10 ——– d—–w- c:\program files\Nikon
2009-12-01 11:13 . 2009-12-01 11:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Extensions
2009-12-01 11:13 . 2009-12-01 11:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Ultima_T15
2009-12-01 11:13 . 2009-12-01 11:08 ——– d—–w- c:\documents and settings\All Users\Application Data\EnterNHelp
2009-12-01 11:10 . 2009-12-01 11:10 ——– d—–w- c:\program files\Common Files\muvee Technologies
2009-12-01 11:10 . 2009-12-01 11:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Nikon
2009-12-01 11:08 . 2009-12-01 11:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Documentation
2009-12-01 11:08 . 2003-03-19 20:05 106496 —-a-w- c:\windows\system32\ATL71.DLL
2009-12-01 11:08 . 2009-11-30 09:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-01 10:43 . 2009-12-01 10:37 ——– d—–w- c:\program files\Ahead
2009-12-01 10:42 . 2009-12-01 10:42 ——– d—–w- c:\program files\Common Files\LightScribe
2009-12-01 10:40 . 2009-12-01 10:40 ——– d—–w- c:\program files\Common Files\Nero
2009-12-01 10:37 . 2009-12-01 10:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Ahead
2009-12-01 10:37 . 2009-12-01 10:37 ——– d—–w- c:\program files\Common Files\Ahead
2009-12-01 09:25 . 2009-12-01 09:25 ——– d—–w- c:\documents and settings\JAbena\Application Data\WindSolutions
2009-12-01 09:25 . 2009-12-01 09:24 ——– d—–w- c:\program files\CopyTrans
2009-11-30 20:58 . 2009-11-30 20:58 64 —-a-w- c:\documents and settings\JAbena\Application Data\wklnhst.dat
2009-11-30 20:58 . 2009-11-30 20:58 ——– d—–w- c:\documents and settings\JAbena\Application Data\Template
2009-11-30 11:02 . 2009-11-30 11:02 ——– d—–w- c:\program files\EphPod
2009-11-30 10:38 . 2009-11-30 10:38 ——– d—–w- c:\documents and settings\JAbena\Application Data\CopyTrans
2009-11-30 09:59 . 2009-11-30 09:40 ——– d—–w- c:\documents and settings\JAbena\Application Data\Apple Computer
2009-11-30 09:42 . 2009-11-30 09:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2009-11-30 09:40 . 2009-11-30 09:39 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-30 09:40 . 2009-11-30 09:39 ——– d—–w- c:\program files\iTunes
2009-11-30 09:39 . 2009-11-30 09:39 ——– d—–w- c:\program files\iPod
2009-11-30 09:39 . 2009-11-30 09:35 ——– d—–w- c:\program files\Common Files\Apple
2009-11-30 09:38 . 2009-11-30 09:38 ——– d—–w- c:\program files\Bonjour
2009-11-30 09:38 . 2009-11-30 09:37 ——– d—–w- c:\program files\QuickTime
2009-11-30 09:37 . 2009-11-30 09:37 ——– d—–w- c:\program files\Apple Software Update
2009-11-30 09:24 . 2009-11-30 09:24 ——– d—–w- c:\program files\VideoLAN
2009-11-30 08:43 . 2009-11-30 08:43 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-11-21 15:51 . 2009-08-01 07:34 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-13 22:57 . 2009-08-01 07:02 922112 —-a-w- c:\windows\system32\imapi2fs.dll
2009-11-13 22:57 . 2009-08-01 07:02 426496 —-a-w- c:\windows\system32\imapi2.dll
2009-11-13 01:07 . 2009-11-13 01:07 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-05 00:54 . 2009-08-01 09:14 79816 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-11-05 00:54 . 2009-08-01 09:14 40552 —-a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-11-05 00:54 . 2009-08-01 09:14 35272 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2009-11-05 00:54 . 2009-08-01 09:14 214664 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2009-11-05 00:53 . 2009-08-01 09:14 34248 —-a-w- c:\windows\system32\drivers\mferkdk.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-01-26_04.37.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-27 04:27 . 2010-01-27 04:27 16384 c:\windows\Temp\Perflib_Perfdata_73c.dat
- 2009-08-01 07:34 . 2010-01-26 04:28 68386 c:\windows\system32\perfc009.dat
+ 2009-08-01 07:34 . 2010-01-27 04:31 68386 c:\windows\system32\perfc009.dat
- 2009-11-30 23:25 . 2010-01-26 04:28 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-11-30 23:25 . 2010-01-28 01:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-01-27 07:38 . 2010-01-28 01:41 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-11-30 23:25 . 2010-01-26 04:28 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-08-01 07:34 . 2010-01-26 04:28 434266 c:\windows\system32\perfh009.dat
+ 2009-08-01 07:34 . 2010-01-27 04:31 434266 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-30 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"M3000Mnt"="M3000Rmv.dll " [X]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-12-30 875016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-24 17529856]
"AzMixerSel"="c:\program files\Realtek\Audio\Drivers\AzMixerSel.exe" [2006-01-25 53248]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-01 30192]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2008-10-03 294544]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-06 1430824]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"DVDTray"="c:\program files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 65536]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-02 149280]
"Google Updater"="c:\program files\Google\Google Updater\GoogleUpdater.exe" [2010-01-21 160752]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

c:\documents and settings\JAbena\Start Menu\Programs\Startup\
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-8-1 565248]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2002-12-2 40960]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [8/1/2009 1:18 AM 93320]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [8/1/2009 1:35 AM 237568]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [7/31/2009 11:35 PM 38912]
R3 M3000Srv;WebCam Driver;c:\windows\system32\drivers\M3000KNT.sys [9/27/2009 6:58 AM 145152]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8/1/2009 12:48 AM 1684736]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/1/2009 12:50 AM 30192]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys –> c:\windows\system32\Drivers\RTS5121.sys [?]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys –> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-01-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]

2010-01-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-30 05:54]

2009-08-01 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-01 20:22]

2009-08-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-01 20:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_one&r=0xph11094255l03g4wu25w87123117
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\JAbena\Application Data\Mozilla\Firefox\Profiles\zw6k93lj.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1808.5272\npCIDetect14.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-27 17:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(528)
c:\windows\system32\igfxdev.dll
.
Completion time: 2010-01-27 17:56:48
ComboFix-quarantined-files.txt 2010-01-28 01:56
ComboFix2.txt 2010-01-27 04:31

Pre-Run: 129,069,428,736 bytes free
Post-Run: 129,154,306,048 bytes free

- - End Of File - - E6D0CEC8422B44A1110664137DEB4724

_____________________________________________________________
Post #18
Hi,

Please run the following:

Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt


A text file should open.

Post the contents of that file in your next reply.
Post #19
Hi, Here are the contents of the text file. Acer Crystal Eye webcam Ver:1.1.81.402 Acer eRecovery Management Acer ScreenSaver Acer VCM Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 9.1 Alice Greenfingers Apple Application Support Apple Mobile Device Support Apple Software Update Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver Bonjour Bookworm Adventures C:\Program Files\Acer GameZone\GameConsole Cake Mania 2 Carbonite Online Backup Setup Chicken Invaders 2 Choice Guard Compatibility Pack for the 2007 Office system Dream Day First Home EphPod eSobi v2 Fizzball Galapago Gold Miner Vegas Google Desktop Google Toolbar for Internet Explorer Google Updater Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows XP (KB932716-v2) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB954708) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB976098-v2) HP Memories Disc HP Photo and Imaging 2.0 - All-in-One HP Photo and Imaging 2.0 - All-in-One Drivers Intel® Graphics Media Accelerator Driver Intel® Matrix Storage Manager iTunes Java™ 6 Update 16 Jewelleria Junk Mail filter update Launch Manager LightScribe 1.4.62.1 Luxor - Amun Rising Malwarebytes' Anti-Malware McAfee SecurityCenter Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works Mozilla Firefox (3.5.7) MSN MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero Suite Nikon Message Center Nikon Transfer Picasa 3 Picture Control Utility PL-2303 USB-to-Serial QuickTime Realtek High Definition Audio Driver Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB973704) Security Update for Microsoft Office Excel 2007 (KB973593) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371-v2) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969897) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Segoe UI Spyware Doctor 7.0 Supercow Synaptics Pointing Device Driver Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office InfoPath 2007 (KB976416) Update for Windows XP (KB898461) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB961503) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Update for Windows XP (KB978207) USB2.0 Card Reader Software ViewNX VLC media player 1.0.3 Webcam WebFldrs XP WIDCOMM Bluetooth Software Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Live Writer Windows Media Format Runtime Windows Media Player 10 WinRAR archiver
Post #20
Hi,

we just have some housekeeping to do now,

Please do the following

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

[external image: Posted Image] Your Java is out of date.
Java™ 6 Update 16 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now.
An update should begin; > follow the prompts.


NEXT

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]




NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If there are any logs remaining > right click and delete them.

NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • For realtime protection against spyware, try SpywareTerminator


    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox, IE and chrome.


  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #21
Hi CatByte, I have updated everything and all programs and files have been removed. My computer is working flawlessly, and I can't thank you enough. I have a desktop that has similar symptoms, and I am more than confident that I can get it fixed through this forum. I will donate when I am more financially stable. Thank you again.
Post #22
Hi, Don't try and fix the desktop with the same fix that I gave you here, each fix is specific to the machine. Please download the DDS and GMER programs from the previous links I gave you and post the logs, let me take a look.
Post #23
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI