copiusdazes
Topic Starter
Hi everyone and to those who can help,
I am currently working on a Windows Vista, and recently, using internet explorer has been a drag……When i try signing on to simple stuff such as facebook, it CONSTANTLY FREEZES! I can only conclude that i was attracted some virus/adwares/spywares or malwares(I really dont know the differences). Being the self-starting computer illiterate that i am, i go and download free removal programs thinking that it will create a solution for me. I downloaded TWO PROGRAMS for it, one is called REGRUN REANIMATOR and one is called
AVAST! ANTIVIRUS. I didnt use AVAST! yet but however i used the REGRUN REANIMATOR and it showed a number of "POTENTIAL" files that i needed to look at, long story short not knowing what to do, i THINK i deleted a lot of important files.
This morning when i gave my comp a try, the internet explorer is still messed up, i am using google chrome at the mean time, on top of it, i cant access backup and store center, control panel, print documents, e.t.c and god knows what else. I am wondering if anyone can help with this issue, not on the issue of the virus/malware/spyware, i will simply deal with that later but how do i retrieve these important files back. I have a log on REGRUN showing me what i''ve deleted last night, and i will post that at the bottom, Can ANYONE HELP PLEASE?!?! I am not a COMPLETE comp illiterate but if someone can generously give me some detailed instructions and how-tos, it will be greatly appreciated. THANK YOU
C
nyc, ny
MBAM LOG
Malwarebytes' Anti-Malware 1.44
Database version: 3823
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18882
3/3/2010 8:23:37 PM
mbam-log-2010-03-03 (20-23-37).txt
Scan type: Quick Scan
Objects scanned: 100907
Time elapsed: 2 minute(s), 50 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
GMER log
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-03 21:04:26
Windows 6.0.6001 Service Pack 1
Running: t29qgqyf.exe
—- Registry - GMER 1.0.15 —-
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\2032751892\Groups@EOTM\xa7?????? 0
—- EOF - GMER 1.0.15 —-
here is the DDS report
DDS (Ver_09-12-01.01) - NTFSX64
Run by [removed] at 22:48:24.34 on Wed 03/03/2010
Internet Explorer: 8.0.6001.18882
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2036.894 [GMT -5:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\AERTSr64.exe
C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\PROGRA~2\AVG\AVG8\avgrsa.exe
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~2\AVG\AVG8\avgnsa.exe
C:\Windows\system32\DRIVERS\xaudio64.exe
C:\PROGRA~2\AVG\AVG8\avgemc.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\AVG\AVG8\avgcsrvx.exe
C:\Windows\RAVCpl64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Steam\steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\Digital Line Detect\DLG.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files (x86)\Dell\MediaDirect\PCMService.exe
C:\Program Files (x86)\AVG\AVG8\avgtray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Java\jre6\bin\jucheck.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\PROGRA~2\Java\jre6\bin\jp2launcher.exe
C:\Program Files (x86)\Java\jre6\bin\java.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\menghua\Documents\Downloads\dds.com
C:\Windows\SysWOW64\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://search.conduit.com/?SearchSource=10&ctid=CT1978305
mLocal Page = c:\windows\syswow64\blank.htm
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files (x86)\aim toolbar\aimtb.dll
uURLSearchHooks: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files (x86)\aim toolbar\aimtb.dll
mURLSearchHooks: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files (x86)\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files (x86)\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files (x86)\aim toolbar\aimtb.dll
BHO: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files (x86)\windows live\toolbar\wltcore.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files (x86)\aim toolbar\aimtb.dll
TB: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files (x86)\windows live\toolbar\wltcore.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Aim] "c:\program files (x86)\aim\aim.exe" /d locale=en-US
uRun: [msnmsgr] "c:\program files (x86)\windows live\messenger\msnmsgr.exe" /background
uRun: [Steam] "c:\program files (x86)\steam\Steam.exe" -silent
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files (x86)\windows media player\WMPNSCFG.exe
mRun: [PCMService] "c:\program files (x86)\dell\mediadirect\PCMService.exe"
mRun: [Microsoft Default Manager] "c:\program files (x86)\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [AVG8_TRAY] c:\progra~2\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRunOnce: [Malwarebytes' Anti-Malware] "c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe" /install /silent
StartupFolder: c:\users\menghua\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files (x86)\erunt\AUTOBACK.EXE
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files (x86)\digital line detect\DLG.exe
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~2\micros~2\office11\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~2\office11\REFIEBAR.DLL
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://oas.support.microsoft.com/ActiveX/MSDcode.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files (x86)\avg\avg8\avgpp.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: AIM Toolbar: {61539ECD-CC67-4437-A03C-9AACCBD14326} -
TB-X64: {D51D388B-F5DC-471A-A1CE-5E2D671091C0} - No File
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun-x64: [RtHDVCpl] RAVCpl64.exe
mRun-x64: [Skytel] Skytel.exe
mRun-x64: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun-x64: [Persistence] c:\windows\system32\igfxpers.exe
AppInit_DLLs-X64: avgrssta.dll
============= SERVICES / DRIVERS ===============
R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2009-8-13 53488]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-3-3 89680]
R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\drivers\avgldx64.sys [2009-9-14 427016]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\drivers\avgmfx64.sys [2009-9-14 33416]
R1 AvgTdiA;AVG Free8 Network Redirector x64;c:\windows\system32\drivers\avgtdia.sys [2009-9-14 133640]
R2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSr64.exe [2009-8-13 86016]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-3-3 22096]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-3-3 65616]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2010-3-3 138680]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~2\avg\avg8\avgemc.exe [2009-9-14 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~2\avg\avg8\avgwdsvc.exe [2009-9-14 297752]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2010-3-3 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2010-3-3 352920]
R3 CAXHWBS2;CAXHWBS2;c:\windows\system32\drivers\CAXHWBS2.sys [2009-8-13 411136]
S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2010-3-3 133104]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-4-24 93184]
S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968]
============== File Associations ===============
JSEFile=c:\windows\syswow64\WScript.exe "%1" %*
=============== Created Last 30 ================
2010-03-04 01:12:30 0 d—–w- c:\users\menghua\appdata\roaming\Malwarebytes
2010-03-04 01:12:25 22104 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-04 01:12:25 0 d—–w- c:\programdata\Malwarebytes
2010-03-04 01:12:25 0 d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2010-03-03 17:34:49 0 d—–w- c:\windows\RestoreSafeDeleted
2010-03-03 07:50:53 65616 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-03-03 07:50:12 380928 —-a-w- c:\windows\syswow64\actskin4.ocx
2010-03-03 07:50:12 1280480 —-a-w- c:\windows\syswow64\aswBoot.exe
2010-03-03 07:49:54 0 d—–w- c:\program files\Alwil Software
2010-03-03 07:44:48 473 —-a-w- c:\windows\syswow64\Partizan.RRI
2010-03-03 07:44:48 35040 —-a-w- c:\windows\syswow64\Partizan.exe
2010-03-03 07:40:15 2 –shatr- c:\windows\winstart.bat
2010-03-03 07:40:15 2 –shatr- c:\windows\syswow64\CONFIG.NT
2010-03-03 07:40:15 2 –shatr- c:\windows\syswow64\AUTOEXEC.NT
2010-03-03 07:39:53 0 d—–w- c:\program files (x86)\Greatis
2010-02-23 18:17:30 726528 —-a-w- c:\windows\syswow64\jscript.dll
2010-02-23 18:17:26 2048 —-a-w- c:\windows\syswow64\tzres.dll
2010-02-23 18:17:26 2048 —-a-w- c:\windows\system32\tzres.dll
2010-02-10 16:55:22 1570816 —-a-w- c:\windows\system32\quartz.dll
==================== Find3M ====================
2010-02-24 14:16:06 212864 ——w- c:\windows\system32\MpSigStub.exe
2010-01-25 13:03:03 534016 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 13:03:03 159232 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 13:03:03 158720 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 13:02:33 535040 —-a-w- c:\windows\system32\secproc.dll
2010-01-25 13:00:33 457216 —-a-w- c:\windows\system32\msdrm.dll
2010-01-25 12:48:34 472576 —-a-w- c:\windows\syswow64\secproc_isv.dll
2010-01-25 12:48:34 151040 —-a-w- c:\windows\syswow64\secproc_ssp_isv.dll
2010-01-25 12:48:34 151040 —-a-w- c:\windows\syswow64\secproc_ssp.dll
2010-01-25 12:48:06 472064 —-a-w- c:\windows\syswow64\secproc.dll
2010-01-25 12:45:56 329216 —-a-w- c:\windows\syswow64\msdrm.dll
2010-01-25 08:37:36 413696 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:37:32 594944 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:37:32 409600 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:37:29 594432 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:35:01 346624 —-a-w- c:\windows\syswow64\RMActivate_ssp_isv.exe
2010-01-25 08:35:00 523776 —-a-w- c:\windows\syswow64\RMActivate_isv.exe
2010-01-25 08:34:56 511488 —-a-w- c:\windows\syswow64\RMActivate.exe
2010-01-25 08:34:56 347136 —-a-w- c:\windows\syswow64\RMActivate_ssp.exe
2010-01-02 07:08:29 1147904 —-a-w- c:\windows\system32\wininet.dll
2010-01-02 07:03:21 77312 —-a-w- c:\windows\system32\iesetup.dll
2010-01-02 07:03:21 132096 —-a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:38:20 916480 —-a-w- c:\windows\syswow64\wininet.dll
2010-01-02 06:38:04 1208832 —-a-w- c:\windows\syswow64\urlmon.dll
2010-01-02 06:36:10 206848 —-a-w- c:\windows\syswow64\occache.dll
2010-01-02 06:33:34 5942784 —-a-w- c:\windows\syswow64\mshtml.dll
2010-01-02 06:33:32 594432 —-a-w- c:\windows\syswow64\msfeeds.dll
2010-01-02 06:33:32 55296 —-a-w- c:\windows\syswow64\msfeedsbs.dll
2010-01-02 06:32:51 25600 —-a-w- c:\windows\syswow64\jsproxy.dll
2010-01-02 06:32:33 71680 —-a-w- c:\windows\syswow64\iesetup.dll
2010-01-02 06:32:33 1985536 —-a-w- c:\windows\syswow64\iertutil.dll
2010-01-02 06:32:33 164352 —-a-w- c:\windows\syswow64\ieui.dll
2010-01-02 06:32:33 109056 —-a-w- c:\windows\syswow64\iesysprep.dll
2010-01-02 06:32:32 55808 —-a-w- c:\windows\syswow64\iernonce.dll
2010-01-02 06:32:32 184320 —-a-w- c:\windows\syswow64\iepeers.dll
2010-01-02 06:32:32 11070464 —-a-w- c:\windows\syswow64\ieframe.dll
2010-01-02 06:32:26 387584 —-a-w- c:\windows\syswow64\iedkcs32.dll
2010-01-02 05:25:39 162816 —-a-w- c:\windows\system32\ieUnatt.exe
2010-01-02 04:57:00 133632 —-a-w- c:\windows\syswow64\ieUnatt.exe
2010-01-02 04:56:50 173056 —-a-w- c:\windows\syswow64\ie4uinit.exe
2010-01-02 04:56:14 13312 —-a-w- c:\windows\syswow64\msfeedssync.exe
2009-12-28 12:45:26 13824 —-a-w- c:\windows\system32\tsbyuv.dll
2009-12-28 12:42:34 25600 —-a-w- c:\windows\system32\msyuv.dll
2009-12-28 12:42:32 38400 —-a-w- c:\windows\system32\msvidc32.dll
2009-12-28 12:42:32 143360 —-a-w- c:\windows\system32\msvfw32.dll
2009-12-28 12:42:28 15872 —-a-w- c:\windows\system32\msrle32.dll
2009-12-28 12:41:43 93184 —-a-w- c:\windows\system32\mciavi32.dll
2009-12-28 12:41:22 54272 —-a-w- c:\windows\system32\iyuv_32.dll
2009-12-28 12:39:08 76800 —-a-w- c:\windows\system32\avicap32.dll
2009-12-28 12:39:08 108544 —-a-w- c:\windows\system32\avifil32.dll
2009-12-28 12:35:50 11776 —-a-w- c:\windows\syswow64\tsbyuv.dll
2009-12-28 12:35:00 1314816 —-a-w- c:\windows\syswow64\quartz.dll
2009-12-28 12:32:34 22528 —-a-w- c:\windows\syswow64\msyuv.dll
2009-12-28 12:32:32 31744 —-a-w- c:\windows\syswow64\msvidc32.dll
2009-12-28 12:32:32 123904 —-a-w- c:\windows\syswow64\msvfw32.dll
2009-12-28 12:32:25 13312 —-a-w- c:\windows\syswow64\msrle32.dll
2009-12-28 12:31:22 82944 —-a-w- c:\windows\syswow64\mciavi32.dll
2009-12-28 12:31:01 50176 —-a-w- c:\windows\syswow64\iyuv_32.dll
2009-12-28 12:28:43 91136 —-a-w- c:\windows\syswow64\avifil32.dll
2009-12-28 12:28:43 65024 —-a-w- c:\windows\syswow64\avicap32.dll
2009-12-08 21:13:24 4678232 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-10-07 07:00:27 51200 —-a-w- c:\windows\inf\infpub.dat
2009-10-07 07:00:27 143360 —-a-w- c:\windows\inf\infstrng.dat
2009-10-07 07:00:26 86016 —-a-w- c:\windows\inf\infstor.dat
2009-08-13 19:54:57 665600 —-a-w- c:\windows\inf\drvindex.dat
2008-01-21 03:21:59 174 –sha-w- c:\program files\desktop.ini
2008-01-21 03:21:59 174 –sha-w- c:\program files (x86)\desktop.ini
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-10-14 20:22:05 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-10-14 19:51:55 245760 –sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-09-15 01:28:15 245760 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-08-13 19:54:57 8192 –sha-w- c:\windows\users\default\NTUSER.DAT
============= FINISH: 22:49:24.98 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 8/13/2009 8:09:10 AM
System Uptime: 3/3/2010 4:12:25 PM (6 hours ago)
Motherboard: Dell Inc. | | 0K068D
Processor: Intel® Core™2 Duo CPU E7300 @ 2.66GHz | Socket 775 | 2133/266mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 308 GiB total, 176.485 GiB free.
D: is FIXED (NTFS) - 273 GiB total, 259.009 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is FIXED (NTFS) - 15 GiB total, 8.701 GiB free.
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP187: 2/5/2010 1:55:38 AM - Windows Update
RP188: 2/6/2010 2:41:00 AM - Scheduled Checkpoint
RP189: 2/7/2010 1:24:00 AM - Scheduled Checkpoint
RP190: 2/7/2010 10:13:08 PM - Scheduled Checkpoint
RP191: 2/8/2010 1:16:23 PM - Windows Update
RP192: 2/10/2010 2:05:49 AM - Scheduled Checkpoint
RP193: 2/11/2010 12:58:37 AM - Scheduled Checkpoint
RP194: 2/11/2010 3:00:38 AM - Windows Update
RP195: 2/12/2010 1:47:52 AM - Scheduled Checkpoint
RP196: 2/12/2010 2:13:00 AM - Windows Update
RP197: 2/13/2010 1:01:16 AM - Scheduled Checkpoint
RP198: 2/14/2010 4:34:20 AM - Scheduled Checkpoint
RP199: 2/15/2010 1:28:56 AM - Scheduled Checkpoint
RP200: 2/15/2010 12:40:21 PM - Windows Update
RP201: 2/16/2010 1:20:28 AM - Scheduled Checkpoint
RP202: 2/17/2010 1:04:22 AM - Scheduled Checkpoint
RP203: 2/18/2010 2:44:27 AM - Scheduled Checkpoint
RP204: 2/19/2010 12:58:41 AM - Scheduled Checkpoint
RP205: 2/19/2010 12:39:14 PM - Windows Update
RP206: 2/20/2010 1:13:21 AM - Scheduled Checkpoint
RP207: 2/21/2010 1:13:49 AM - Scheduled Checkpoint
RP208: 2/22/2010 4:08:01 AM - Scheduled Checkpoint
RP209: 2/22/2010 2:03:47 PM - Windows Update
RP210: 2/24/2010 1:03:51 AM - Scheduled Checkpoint
RP211: 2/24/2010 3:00:42 AM - Windows Update
RP212: 2/25/2010 12:45:12 AM - Scheduled Checkpoint
RP213: 2/25/2010 11:09:45 AM - Windows Update
RP214: 2/26/2010 1:36:25 AM - Scheduled Checkpoint
RP215: 2/27/2010 2:26:06 AM - Scheduled Checkpoint
RP216: 2/28/2010 12:03:51 AM - Scheduled Checkpoint
RP217: 3/1/2010 1:11:34 AM - Scheduled Checkpoint
RP218: 3/1/2010 7:45:48 PM - Windows Update
RP219: 3/3/2010 2:43:31 AM - RegRun Virus Scan
RP220: 3/3/2010 2:46:48 AM - RegRun Virus Scan
RP221: 3/3/2010 2:50:18 AM - RegRun Virus Scan
RP222: 3/3/2010 2:59:35 AM - RegRun Virus Scan
RP223: 3/3/2010 3:02:38 AM - RegRun Virus Scan
RP224: 3/3/2010 12:36:18 PM - RegRun Virus Scan
RP225: 3/3/2010 7:55:58 PM - Automatic Restore Point
==== Installed Programs ======================
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1
AIM 7
AIM Toolbar
avast! Antivirus
AVG Free 8.5
Compatibility Pack for the 2007 Office system
Digital Line Detect
Download Updater (AOL LLC)
ERUNT 1.1j
Google Chrome
Google Update Helper
GPL Ghostscript 8.64
Greetings Workshop
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java™ 6 Update 15
Junk Mail filter update
Malwarebytes' Anti-Malware
Medal of Honor Allied Assault
MediaDirect
Microsoft Choice Guard
Microsoft Default Manager
Microsoft Flight Simulator X
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mininova-Vuze Toolbar
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NA Chatroom mIRC
NetWaiting
NJStar Communicator
Paint Shop Pro 6.0 (CD-ROM)
PunkBuster Services
Realtek High Definition Audio Driver
RegRun Reanimator
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Steam
SWAT 4
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
==== Event Viewer Messages From Past Week ========
3/3/2010 3:06:46 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Partizan
3/3/2010 2:51:05 AM, Error: Service Control Manager [7030] - The avast! Web Scanner service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:51:04 AM, Error: Service Control Manager [7030] - The avast! Mail Scanner service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:51:03 AM, Error: Service Control Manager [7030] - The avast! iAVS4 Control Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:51:03 AM, Error: Service Control Manager [7030] - The avast! Antivirus service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:44:45 AM, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\Drivers\regguard.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
2/26/2010 11:28:29 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
2/25/2010 10:57:33 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
2/24/2010 3:23:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
2/24/2010 3:23:35 AM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
==== End Of File ===========================
I am currently working on a Windows Vista, and recently, using internet explorer has been a drag……When i try signing on to simple stuff such as facebook, it CONSTANTLY FREEZES! I can only conclude that i was attracted some virus/adwares/spywares or malwares(I really dont know the differences). Being the self-starting computer illiterate that i am, i go and download free removal programs thinking that it will create a solution for me. I downloaded TWO PROGRAMS for it, one is called REGRUN REANIMATOR and one is called
AVAST! ANTIVIRUS. I didnt use AVAST! yet but however i used the REGRUN REANIMATOR and it showed a number of "POTENTIAL" files that i needed to look at, long story short not knowing what to do, i THINK i deleted a lot of important files.
This morning when i gave my comp a try, the internet explorer is still messed up, i am using google chrome at the mean time, on top of it, i cant access backup and store center, control panel, print documents, e.t.c and god knows what else. I am wondering if anyone can help with this issue, not on the issue of the virus/malware/spyware, i will simply deal with that later but how do i retrieve these important files back. I have a log on REGRUN showing me what i''ve deleted last night, and i will post that at the bottom, Can ANYONE HELP PLEASE?!?! I am not a COMPLETE comp illiterate but if someone can generously give me some detailed instructions and how-tos, it will be greatly appreciated. THANK YOU
C
nyc, ny
MBAM LOG
Malwarebytes' Anti-Malware 1.44
Database version: 3823
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18882
3/3/2010 8:23:37 PM
mbam-log-2010-03-03 (20-23-37).txt
Scan type: Quick Scan
Objects scanned: 100907
Time elapsed: 2 minute(s), 50 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
GMER log
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-03 21:04:26
Windows 6.0.6001 Service Pack 1
Running: t29qgqyf.exe
—- Registry - GMER 1.0.15 —-
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\2032751892\Groups@EOTM\xa7?????? 0
—- EOF - GMER 1.0.15 —-
here is the DDS report
DDS (Ver_09-12-01.01) - NTFSX64
Run by [removed] at 22:48:24.34 on Wed 03/03/2010
Internet Explorer: 8.0.6001.18882
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2036.894 [GMT -5:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\AERTSr64.exe
C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\PROGRA~2\AVG\AVG8\avgrsa.exe
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~2\AVG\AVG8\avgnsa.exe
C:\Windows\system32\DRIVERS\xaudio64.exe
C:\PROGRA~2\AVG\AVG8\avgemc.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\AVG\AVG8\avgcsrvx.exe
C:\Windows\RAVCpl64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Steam\steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\Digital Line Detect\DLG.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files (x86)\Dell\MediaDirect\PCMService.exe
C:\Program Files (x86)\AVG\AVG8\avgtray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Java\jre6\bin\jucheck.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\PROGRA~2\Java\jre6\bin\jp2launcher.exe
C:\Program Files (x86)\Java\jre6\bin\java.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\menghua\Documents\Downloads\dds.com
C:\Windows\SysWOW64\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://search.conduit.com/?SearchSource=10&ctid=CT1978305
mLocal Page = c:\windows\syswow64\blank.htm
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files (x86)\aim toolbar\aimtb.dll
uURLSearchHooks: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files (x86)\aim toolbar\aimtb.dll
mURLSearchHooks: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files (x86)\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files (x86)\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files (x86)\aim toolbar\aimtb.dll
BHO: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files (x86)\windows live\toolbar\wltcore.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files (x86)\aim toolbar\aimtb.dll
TB: Mininova-Vuze Toolbar: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - c:\program files (x86)\mininova-vuze\tbMini.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files (x86)\windows live\toolbar\wltcore.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Aim] "c:\program files (x86)\aim\aim.exe" /d locale=en-US
uRun: [msnmsgr] "c:\program files (x86)\windows live\messenger\msnmsgr.exe" /background
uRun: [Steam] "c:\program files (x86)\steam\Steam.exe" -silent
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files (x86)\windows media player\WMPNSCFG.exe
mRun: [PCMService] "c:\program files (x86)\dell\mediadirect\PCMService.exe"
mRun: [Microsoft Default Manager] "c:\program files (x86)\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [AVG8_TRAY] c:\progra~2\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRunOnce: [Malwarebytes' Anti-Malware] "c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe" /install /silent
StartupFolder: c:\users\menghua\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files (x86)\erunt\AUTOBACK.EXE
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files (x86)\digital line detect\DLG.exe
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~2\micros~2\office11\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~2\office11\REFIEBAR.DLL
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://oas.support.microsoft.com/ActiveX/MSDcode.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files (x86)\avg\avg8\avgpp.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: AIM Toolbar: {61539ECD-CC67-4437-A03C-9AACCBD14326} -
TB-X64: {D51D388B-F5DC-471A-A1CE-5E2D671091C0} - No File
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun-x64: [RtHDVCpl] RAVCpl64.exe
mRun-x64: [Skytel] Skytel.exe
mRun-x64: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun-x64: [Persistence] c:\windows\system32\igfxpers.exe
AppInit_DLLs-X64: avgrssta.dll
============= SERVICES / DRIVERS ===============
R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2009-8-13 53488]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-3-3 89680]
R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\drivers\avgldx64.sys [2009-9-14 427016]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\drivers\avgmfx64.sys [2009-9-14 33416]
R1 AvgTdiA;AVG Free8 Network Redirector x64;c:\windows\system32\drivers\avgtdia.sys [2009-9-14 133640]
R2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSr64.exe [2009-8-13 86016]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-3-3 22096]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-3-3 65616]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2010-3-3 138680]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~2\avg\avg8\avgemc.exe [2009-9-14 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~2\avg\avg8\avgwdsvc.exe [2009-9-14 297752]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2010-3-3 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2010-3-3 352920]
R3 CAXHWBS2;CAXHWBS2;c:\windows\system32\drivers\CAXHWBS2.sys [2009-8-13 411136]
S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2010-3-3 133104]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-4-24 93184]
S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968]
============== File Associations ===============
JSEFile=c:\windows\syswow64\WScript.exe "%1" %*
=============== Created Last 30 ================
2010-03-04 01:12:30 0 d—–w- c:\users\menghua\appdata\roaming\Malwarebytes
2010-03-04 01:12:25 22104 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-04 01:12:25 0 d—–w- c:\programdata\Malwarebytes
2010-03-04 01:12:25 0 d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2010-03-03 17:34:49 0 d—–w- c:\windows\RestoreSafeDeleted
2010-03-03 07:50:53 65616 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-03-03 07:50:12 380928 —-a-w- c:\windows\syswow64\actskin4.ocx
2010-03-03 07:50:12 1280480 —-a-w- c:\windows\syswow64\aswBoot.exe
2010-03-03 07:49:54 0 d—–w- c:\program files\Alwil Software
2010-03-03 07:44:48 473 —-a-w- c:\windows\syswow64\Partizan.RRI
2010-03-03 07:44:48 35040 —-a-w- c:\windows\syswow64\Partizan.exe
2010-03-03 07:40:15 2 –shatr- c:\windows\winstart.bat
2010-03-03 07:40:15 2 –shatr- c:\windows\syswow64\CONFIG.NT
2010-03-03 07:40:15 2 –shatr- c:\windows\syswow64\AUTOEXEC.NT
2010-03-03 07:39:53 0 d—–w- c:\program files (x86)\Greatis
2010-02-23 18:17:30 726528 —-a-w- c:\windows\syswow64\jscript.dll
2010-02-23 18:17:26 2048 —-a-w- c:\windows\syswow64\tzres.dll
2010-02-23 18:17:26 2048 —-a-w- c:\windows\system32\tzres.dll
2010-02-10 16:55:22 1570816 —-a-w- c:\windows\system32\quartz.dll
==================== Find3M ====================
2010-02-24 14:16:06 212864 ——w- c:\windows\system32\MpSigStub.exe
2010-01-25 13:03:03 534016 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 13:03:03 159232 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 13:03:03 158720 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 13:02:33 535040 —-a-w- c:\windows\system32\secproc.dll
2010-01-25 13:00:33 457216 —-a-w- c:\windows\system32\msdrm.dll
2010-01-25 12:48:34 472576 —-a-w- c:\windows\syswow64\secproc_isv.dll
2010-01-25 12:48:34 151040 —-a-w- c:\windows\syswow64\secproc_ssp_isv.dll
2010-01-25 12:48:34 151040 —-a-w- c:\windows\syswow64\secproc_ssp.dll
2010-01-25 12:48:06 472064 —-a-w- c:\windows\syswow64\secproc.dll
2010-01-25 12:45:56 329216 —-a-w- c:\windows\syswow64\msdrm.dll
2010-01-25 08:37:36 413696 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:37:32 594944 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:37:32 409600 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:37:29 594432 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:35:01 346624 —-a-w- c:\windows\syswow64\RMActivate_ssp_isv.exe
2010-01-25 08:35:00 523776 —-a-w- c:\windows\syswow64\RMActivate_isv.exe
2010-01-25 08:34:56 511488 —-a-w- c:\windows\syswow64\RMActivate.exe
2010-01-25 08:34:56 347136 —-a-w- c:\windows\syswow64\RMActivate_ssp.exe
2010-01-02 07:08:29 1147904 —-a-w- c:\windows\system32\wininet.dll
2010-01-02 07:03:21 77312 —-a-w- c:\windows\system32\iesetup.dll
2010-01-02 07:03:21 132096 —-a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:38:20 916480 —-a-w- c:\windows\syswow64\wininet.dll
2010-01-02 06:38:04 1208832 —-a-w- c:\windows\syswow64\urlmon.dll
2010-01-02 06:36:10 206848 —-a-w- c:\windows\syswow64\occache.dll
2010-01-02 06:33:34 5942784 —-a-w- c:\windows\syswow64\mshtml.dll
2010-01-02 06:33:32 594432 —-a-w- c:\windows\syswow64\msfeeds.dll
2010-01-02 06:33:32 55296 —-a-w- c:\windows\syswow64\msfeedsbs.dll
2010-01-02 06:32:51 25600 —-a-w- c:\windows\syswow64\jsproxy.dll
2010-01-02 06:32:33 71680 —-a-w- c:\windows\syswow64\iesetup.dll
2010-01-02 06:32:33 1985536 —-a-w- c:\windows\syswow64\iertutil.dll
2010-01-02 06:32:33 164352 —-a-w- c:\windows\syswow64\ieui.dll
2010-01-02 06:32:33 109056 —-a-w- c:\windows\syswow64\iesysprep.dll
2010-01-02 06:32:32 55808 —-a-w- c:\windows\syswow64\iernonce.dll
2010-01-02 06:32:32 184320 —-a-w- c:\windows\syswow64\iepeers.dll
2010-01-02 06:32:32 11070464 —-a-w- c:\windows\syswow64\ieframe.dll
2010-01-02 06:32:26 387584 —-a-w- c:\windows\syswow64\iedkcs32.dll
2010-01-02 05:25:39 162816 —-a-w- c:\windows\system32\ieUnatt.exe
2010-01-02 04:57:00 133632 —-a-w- c:\windows\syswow64\ieUnatt.exe
2010-01-02 04:56:50 173056 —-a-w- c:\windows\syswow64\ie4uinit.exe
2010-01-02 04:56:14 13312 —-a-w- c:\windows\syswow64\msfeedssync.exe
2009-12-28 12:45:26 13824 —-a-w- c:\windows\system32\tsbyuv.dll
2009-12-28 12:42:34 25600 —-a-w- c:\windows\system32\msyuv.dll
2009-12-28 12:42:32 38400 —-a-w- c:\windows\system32\msvidc32.dll
2009-12-28 12:42:32 143360 —-a-w- c:\windows\system32\msvfw32.dll
2009-12-28 12:42:28 15872 —-a-w- c:\windows\system32\msrle32.dll
2009-12-28 12:41:43 93184 —-a-w- c:\windows\system32\mciavi32.dll
2009-12-28 12:41:22 54272 —-a-w- c:\windows\system32\iyuv_32.dll
2009-12-28 12:39:08 76800 —-a-w- c:\windows\system32\avicap32.dll
2009-12-28 12:39:08 108544 —-a-w- c:\windows\system32\avifil32.dll
2009-12-28 12:35:50 11776 —-a-w- c:\windows\syswow64\tsbyuv.dll
2009-12-28 12:35:00 1314816 —-a-w- c:\windows\syswow64\quartz.dll
2009-12-28 12:32:34 22528 —-a-w- c:\windows\syswow64\msyuv.dll
2009-12-28 12:32:32 31744 —-a-w- c:\windows\syswow64\msvidc32.dll
2009-12-28 12:32:32 123904 —-a-w- c:\windows\syswow64\msvfw32.dll
2009-12-28 12:32:25 13312 —-a-w- c:\windows\syswow64\msrle32.dll
2009-12-28 12:31:22 82944 —-a-w- c:\windows\syswow64\mciavi32.dll
2009-12-28 12:31:01 50176 —-a-w- c:\windows\syswow64\iyuv_32.dll
2009-12-28 12:28:43 91136 —-a-w- c:\windows\syswow64\avifil32.dll
2009-12-28 12:28:43 65024 —-a-w- c:\windows\syswow64\avicap32.dll
2009-12-08 21:13:24 4678232 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-10-07 07:00:27 51200 —-a-w- c:\windows\inf\infpub.dat
2009-10-07 07:00:27 143360 —-a-w- c:\windows\inf\infstrng.dat
2009-10-07 07:00:26 86016 —-a-w- c:\windows\inf\infstor.dat
2009-08-13 19:54:57 665600 —-a-w- c:\windows\inf\drvindex.dat
2008-01-21 03:21:59 174 –sha-w- c:\program files\desktop.ini
2008-01-21 03:21:59 174 –sha-w- c:\program files (x86)\desktop.ini
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-10-14 20:22:05 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-10-14 19:51:55 245760 –sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-09-15 01:28:15 245760 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-08-13 19:54:57 8192 –sha-w- c:\windows\users\default\NTUSER.DAT
============= FINISH: 22:49:24.98 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 8/13/2009 8:09:10 AM
System Uptime: 3/3/2010 4:12:25 PM (6 hours ago)
Motherboard: Dell Inc. | | 0K068D
Processor: Intel® Core™2 Duo CPU E7300 @ 2.66GHz | Socket 775 | 2133/266mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 308 GiB total, 176.485 GiB free.
D: is FIXED (NTFS) - 273 GiB total, 259.009 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is FIXED (NTFS) - 15 GiB total, 8.701 GiB free.
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP187: 2/5/2010 1:55:38 AM - Windows Update
RP188: 2/6/2010 2:41:00 AM - Scheduled Checkpoint
RP189: 2/7/2010 1:24:00 AM - Scheduled Checkpoint
RP190: 2/7/2010 10:13:08 PM - Scheduled Checkpoint
RP191: 2/8/2010 1:16:23 PM - Windows Update
RP192: 2/10/2010 2:05:49 AM - Scheduled Checkpoint
RP193: 2/11/2010 12:58:37 AM - Scheduled Checkpoint
RP194: 2/11/2010 3:00:38 AM - Windows Update
RP195: 2/12/2010 1:47:52 AM - Scheduled Checkpoint
RP196: 2/12/2010 2:13:00 AM - Windows Update
RP197: 2/13/2010 1:01:16 AM - Scheduled Checkpoint
RP198: 2/14/2010 4:34:20 AM - Scheduled Checkpoint
RP199: 2/15/2010 1:28:56 AM - Scheduled Checkpoint
RP200: 2/15/2010 12:40:21 PM - Windows Update
RP201: 2/16/2010 1:20:28 AM - Scheduled Checkpoint
RP202: 2/17/2010 1:04:22 AM - Scheduled Checkpoint
RP203: 2/18/2010 2:44:27 AM - Scheduled Checkpoint
RP204: 2/19/2010 12:58:41 AM - Scheduled Checkpoint
RP205: 2/19/2010 12:39:14 PM - Windows Update
RP206: 2/20/2010 1:13:21 AM - Scheduled Checkpoint
RP207: 2/21/2010 1:13:49 AM - Scheduled Checkpoint
RP208: 2/22/2010 4:08:01 AM - Scheduled Checkpoint
RP209: 2/22/2010 2:03:47 PM - Windows Update
RP210: 2/24/2010 1:03:51 AM - Scheduled Checkpoint
RP211: 2/24/2010 3:00:42 AM - Windows Update
RP212: 2/25/2010 12:45:12 AM - Scheduled Checkpoint
RP213: 2/25/2010 11:09:45 AM - Windows Update
RP214: 2/26/2010 1:36:25 AM - Scheduled Checkpoint
RP215: 2/27/2010 2:26:06 AM - Scheduled Checkpoint
RP216: 2/28/2010 12:03:51 AM - Scheduled Checkpoint
RP217: 3/1/2010 1:11:34 AM - Scheduled Checkpoint
RP218: 3/1/2010 7:45:48 PM - Windows Update
RP219: 3/3/2010 2:43:31 AM - RegRun Virus Scan
RP220: 3/3/2010 2:46:48 AM - RegRun Virus Scan
RP221: 3/3/2010 2:50:18 AM - RegRun Virus Scan
RP222: 3/3/2010 2:59:35 AM - RegRun Virus Scan
RP223: 3/3/2010 3:02:38 AM - RegRun Virus Scan
RP224: 3/3/2010 12:36:18 PM - RegRun Virus Scan
RP225: 3/3/2010 7:55:58 PM - Automatic Restore Point
==== Installed Programs ======================
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1
AIM 7
AIM Toolbar
avast! Antivirus
AVG Free 8.5
Compatibility Pack for the 2007 Office system
Digital Line Detect
Download Updater (AOL LLC)
ERUNT 1.1j
Google Chrome
Google Update Helper
GPL Ghostscript 8.64
Greetings Workshop
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java™ 6 Update 15
Junk Mail filter update
Malwarebytes' Anti-Malware
Medal of Honor Allied Assault
MediaDirect
Microsoft Choice Guard
Microsoft Default Manager
Microsoft Flight Simulator X
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mininova-Vuze Toolbar
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NA Chatroom mIRC
NetWaiting
NJStar Communicator
Paint Shop Pro 6.0 (CD-ROM)
PunkBuster Services
Realtek High Definition Audio Driver
RegRun Reanimator
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Steam
SWAT 4
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
==== Event Viewer Messages From Past Week ========
3/3/2010 3:06:46 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Partizan
3/3/2010 2:51:05 AM, Error: Service Control Manager [7030] - The avast! Web Scanner service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:51:04 AM, Error: Service Control Manager [7030] - The avast! Mail Scanner service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:51:03 AM, Error: Service Control Manager [7030] - The avast! iAVS4 Control Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:51:03 AM, Error: Service Control Manager [7030] - The avast! Antivirus service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/3/2010 2:44:45 AM, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\Drivers\regguard.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
2/26/2010 11:28:29 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
2/25/2010 10:57:33 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
2/24/2010 3:23:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
2/24/2010 3:23:35 AM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
==== End Of File ===========================
