What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] onizewug.dll What is this?

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
The reason there is 2 antivirus is because I originally had Norton. The other day I downloaded avast.
I was trying to decide which to keep. I wanted to totally disable Norton but there is no way for me to do it.
I have to just uncheck everything. If I uninstall and decide I want it then I have to contact Norton and have them
download it again and it's a pain.

ComboFix 10-02-16.03 - mom 02/17/2010 10:00:08.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.422 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\mom\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

file zipped: c:\windows\abeqodadujo.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\abeqodadujo.dll

.
((((((((((((((((((((((((( Files Created from 2010-01-17 to 2010-02-17 )))))))))))))))))))))))))))))))
.

2010-02-17 04:17 . 2009-08-22 07:28 165240 —-a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2010-02-17 04:15 . 2010-02-17 04:15 271752 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-16 13:26 . 2010-02-16 13:26 52224 —-a-w- c:\documents and settings\mom\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-16 13:26 . 2010-02-16 13:26 117760 —-a-w- c:\documents and settings\mom\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-16 13:25 . 2010-02-16 13:25 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-16 13:25 . 2010-02-16 13:25 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-16 13:25 . 2010-02-16 13:25 ——– d—–w- c:\documents and settings\mom\Application Data\SUPERAntiSpyware.com
2010-02-16 13:25 . 2010-02-16 13:25 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-16 13:07 . 2010-02-16 13:07 ——– d—–w- c:\program files\CCleaner
2010-02-15 23:47 . 2010-02-11 18:42 162512 —-a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-15 23:47 . 2010-02-11 18:38 19024 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-15 23:47 . 2010-02-11 18:39 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-15 23:47 . 2010-02-11 18:42 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-15 23:47 . 2010-02-11 18:38 100432 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-15 23:47 . 2010-02-11 18:38 94800 —-a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-15 23:47 . 2010-02-11 18:38 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-15 23:47 . 2010-02-11 18:53 38848 —-a-w- c:\windows\system32\avastSS.scr
2010-02-15 23:47 . 2010-02-11 18:53 153184 —-a-w- c:\windows\system32\aswBoot.exe
2010-02-15 23:47 . 2010-02-15 23:47 ——– d—–w- c:\program files\Alwil Software
2010-02-15 23:47 . 2010-02-15 23:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-15 23:07 . 2010-02-15 23:07 ——– d—–w- c:\program files\Trend Micro
2010-02-15 15:44 . 2010-02-03 09:00 84912 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\NAVENG.SYS
2010-02-15 15:44 . 2010-02-03 09:00 1324720 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\NAVEX15.SYS
2010-02-15 15:44 . 2009-08-25 08:00 177520 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\NAVENG32.DLL
2010-02-15 15:44 . 2009-08-25 08:00 1647984 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\NAVEX32A.DLL
2010-02-15 15:44 . 2009-12-09 09:00 2747440 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\CCERASER.DLL
2010-02-15 15:44 . 2009-09-22 08:00 259440 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\ECMSVR32.DLL
2010-02-15 15:44 . 2009-08-26 08:00 371248 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\EECTRL.SYS
2010-02-15 15:44 . 2009-08-26 08:00 102448 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100215.002\ERASER.SYS
2010-02-15 03:27 . 2010-02-15 23:43 15944 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-02-15 03:26 . 2010-02-15 03:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-02-15 03:26 . 2010-02-15 03:26 ——– d—–w- c:\program files\Hitman Pro 3.5
2010-02-14 01:45 . 2010-02-14 01:45 152576 —-a-w- c:\documents and settings\mom\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-02-14 01:44 . 2010-02-14 01:44 79488 —-a-w- c:\documents and settings\mom\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-12 21:43 . 2009-10-28 22:37 343088 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100210.001\IDSvix86.sys
2010-02-12 21:43 . 2009-10-28 22:37 329592 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100210.001\IDSXpx86.sys
2010-02-12 21:43 . 2009-10-28 22:37 811896 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100210.001\Scxpx86.dll
2010-02-12 21:43 . 2009-10-28 22:37 488312 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100210.001\IDSxpx86.dll
2010-02-12 21:43 . 2009-10-28 22:37 466992 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100210.001\IDSviA64.sys
2010-02-09 00:34 . 2010-02-09 00:34 ——– d—–w- c:\program files\Norton Support
2010-02-09 00:34 . 2010-02-09 00:34 ——– d—–w- c:\documents and settings\mom\Local Settings\Application Data\Symantec
2010-02-05 21:55 . 2009-10-28 22:37 343088 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSvix86.sys
2010-02-05 21:55 . 2009-10-28 22:37 329592 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSXpx86.sys
2010-02-05 21:55 . 2009-10-28 22:37 811896 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\Scxpx86.dll
2010-02-05 21:55 . 2009-10-28 22:37 488312 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSxpx86.dll
2010-02-05 21:55 . 2009-10-28 22:37 466992 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSviA64.sys
2010-02-05 17:58 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2010-02-05 17:58 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-02-05 17:58 . 2004-08-04 05:56 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll
2010-02-05 17:58 . 2004-08-04 05:56 21504 —-a-w- c:\windows\system32\hidserv.dll
2010-02-05 17:58 . 2001-08-17 19:02 9600 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2010-02-05 17:58 . 2001-08-17 19:02 9600 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-30 14:30 . 2010-02-16 13:05 0 —-a-w- c:\windows\Ptehoduli.bin
2010-01-30 14:30 . 2010-02-17 03:57 120 —-a-w- c:\windows\Shibinu.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 22:34 . 2008-10-25 02:36 ——– d—–w- c:\documents and settings\mom\Application Data\U3
2010-02-15 23:01 . 2006-05-09 22:50 7311360 —-a-w- c:\windows\system32\nvcpl.dll
2010-02-14 03:23 . 2008-10-26 03:10 ——– d—–w- c:\documents and settings\mom\Application Data\SiteClasses
2010-02-14 03:01 . 2009-06-18 20:39 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-14 03:01 . 2009-10-05 21:37 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-14 01:46 . 2008-10-25 01:55 ——– d—–w- c:\program files\Java
2010-01-25 01:49 . 2008-10-25 07:03 ——– d—–w- c:\documents and settings\mom\Application Data\Image Zone Express
2010-01-15 03:48 . 2009-01-06 23:40 ——– d—–w- c:\program files\TurboTax
2010-01-08 02:19 . 2009-09-29 13:39 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-01-08 02:18 . 2009-09-29 13:39 38784 —-a-w- c:\documents and settings\mom\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-08 02:18 . 2009-09-29 13:39 38784 —-a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-07 21:07 . 2009-06-18 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-06-18 20:39 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2007-07-27 12:00 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2007-07-27 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2007-07-27 12:00 17408 ——w- c:\windows\system32\corpol.dll
2009-12-31 16:14 . 2007-07-27 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 12:37 . 2009-10-17 23:49 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2009-12-16 12:58 . 2008-10-25 02:18 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-15 17:01 . 2009-12-15 17:01 1956528 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-12-14 07:35 . 2007-07-27 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 18:53 . 2007-07-27 12:00 2136064 ——w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:19 . 2004-08-03 22:59 2015744 ——w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 14:41 . 2007-07-27 12:00 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:33 . 2007-07-27 12:00 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:33 . 2004-08-04 00:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:37 . 2007-07-27 12:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:37 . 2007-07-27 12:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:37 . 2007-07-27 12:00 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:37 . 2004-08-04 00:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:37 . 2001-08-17 22:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-21 16:36 . 2007-07-27 12:00 470528 —-a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-02-17_04.09.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-17 04:17 . 2010-02-17 04:17 16384 c:\windows\Temp\Perflib_Perfdata_684.dat
+ 2010-02-17 04:16 . 2010-02-17 04:16 16384 c:\windows\Temp\Perflib_Perfdata_600.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-02-15 7311360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Corel MEDIA FOLDERS INDEXER 8.LNK]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Corel MEDIA FOLDERS INDEXER 8.LNK
backup=c:\windows\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CreataCard Gold 2 Forget Me Not Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\CreataCard Gold 2 Forget Me Not Reminders.lnk
backup=c:\windows\pss\CreataCard Gold 2 Forget Me Not Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 16:08 935288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 08:08 35696 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-04 01:43 69632 ——w- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2007-07-27 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 16:35 49152 —-a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2000-08-16 01:25 311350 —-a-w- c:\program files\Microsoft Works\wkssb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2007-03-06 07:08 28672 —-a-w- c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp]
2000-07-19 16:00 24625 —-a-w- c:\program files\Microsoft Money\System\Money Startup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-02-15 23:01 7311360 —-a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2006-05-09 22:50 86016 —-a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-05-09 22:50 1519616 —-a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-10-25 18:50 155648 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-07-21 23:56 16261632 ——w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 09:17 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-01-05 12:56 2002160 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-08-16 01:25 24576 —-a-w- c:\program files\Microsoft Works\wkfud.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1008000.029\SymEFA.sys [1/27/2010 10:42 PM 310320]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2/15/2010 6:47 PM 162512]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1008000.029\BHDrvx86.sys [1/27/2010 10:42 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1008000.029\cchpx86.sys [1/27/2010 10:42 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100210.001\IDSXpx86.sys [2/12/2010 4:43 PM 329592]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/15/2010 6:47 PM 19024]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe [1/27/2010 10:42 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/28/2009 5:39 AM 102448]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\documents and settings\mom\Application Data\Mozilla\Firefox\Profiles\c5eb5zxe.default\
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 10:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.8.0.41\diMaster.dll\" /prefetch:1"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1008)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-02-17 10:06:13
ComboFix-quarantined-files.txt 2010-02-17 15:06
ComboFix2.txt 2010-02-17 04:10

Pre-Run: 233,426,513,920 bytes free
Post-Run: 233,395,499,008 bytes free

- - End Of File - - 15B3B80FCA76C96B169FA6D8B4698848
Upload was successful
Post #17
linda0314,

OK, I understand. If you have a current license for Norton 2010 I'd keep that and uninstall Avast. Your call though. I'd like you to run these two scans to make sure we have everything:

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • MBAM log
  • Kaspersky log
Post #18
Here is malwarebytes…it is clean but I ran this a few days ago and it never picked anything up and showed clean then I will post the kaspersky one later as I have to run out here for awhile. Malwarebytes' Anti-Malware 1.44 Database version: 3751 Windows 5.1.2600 Service Pack 2 Internet Explorer 7.0.5730.13 2/17/2010 11:49:33 AM mbam-log-2010-02-17 (11-49-33).txt Scan type: Full Scan (C:\|) Objects scanned: 191286 Time elapsed: 27 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #19
Here is the Kaspersy ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, February 17, 2010 Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Wednesday, February 17, 2010 13:04:39 Records in database: 3544318 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Objects scanned: 80299 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 01:47:15 No threats found. Scanned area is clean. Selected area has been scanned.
Post #20
linda0314,

Good job, your logs look clean! We have some important cleanup and housekeeping to do now though:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 18. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
        Applications and AppletsTrace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.
    Click to load external image (Posted Image) Now, let’s update your operating system:
    • Click Start -> All Programs -> Windows Update or go to This site
    • In the left pane, click on Check for Updates
    • Download and install all updates labeled Critical, Important or Recommended.
    • Repeat these steps until no more Critical, Important or Recommended updates appear.
    • In the left pane, click on Change Settings. Choose Install updates automatically and pick a time that works for you. Also check the box in the Recommended updates section.
    Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

    Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

    Click to load external image (Posted Image) Uninstall ComboFix
    • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens:
      Combofix /Uninstall
    Click to load external image (Posted Image)

    Click to load external image (Posted Image) Clean up with OTL:
    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.
    • Manually delete any remaining logs or tools.
    Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
    • Restart any anti-malware programs that we disabled while we were cleaning your machine.
    • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
    • Consider running in a limited user account. See this post for more information.
    • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
    Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #21
Okay it took me awhile to do some of those. Luckily I had just done the Windows updates last week. Thank you sooo much for your time. Everything seems to be great. I will be back in the next few days to get some help cleaning up my older computer that seems soooo slow. BTW I notice that you are in the same state as me. Thanks again. Linda
Post #23
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI