This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] trying to get rid of the xp antivirus 2010

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

so i just started to get the standard xp antivirus 2010 signs and all that jazz on my computer which is running on XP and after reading all of the warnings on stickies and posts i just wanted to make my own thread so i can actually have someone walk me through it heres the situation: i started googleing and searching and found out to download the malwarebytes application and attempted to run it to no prevail. i had already learned about the av.exe in the process, but i guess you need to end that process before running the malwarebytes exe so now nothing runs or works when i click on the mbam-setup so now i found this awesome site for help which would be greatly appreciated!
[external image: Posted Image]

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")


Stay with this topic until I give you the all clean post.

Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Next:

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post
ok heres the log.txt copy: exeHelper by Raktor Build 20091220 Run at 00:24:22 on 03/05/10 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished– now heres the DDS.txt: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 0:31:05.31 on Fri 03/05/2010 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2701 [GMT -6:00] AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe C:\Program Files\ATI Multimedia\main\ATIDtct.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE C:\Program Files\AIM6\aim6.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Rainmeter\Rainmeter.exe C:\Program Files\NETGEAR\WG111T\wlan111t.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Allie\Desktop\dds.scr C:\Documents and Settings\Allie\Local Settings\Application Data\av.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.myspace.com/ uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll BHO: c:\windows\system32\hsf73ikmdf3f.dll: {b2ba40a2-74f3-42bd-f434-2604812c8954} - c:\windows\system32\hsf73ikmdf3f.dll TB: Viewpoint Toolbar: {f8ad5aa5-d966-4667-9daf-2561d68b2012} - c:\program files\viewpoint\viewpoint toolbar\ViewBar.dll TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll EB: {90C61707-C8F8-43DB-A25C-C1F4B18EE41E} - No File EB: {A798E2B4-B6A0-4B96-8C53-8EC7A3B0895A} - No File uRun: [ATI DeviceDetect] c:\program files\ati multimedia\main\ATIDtct.EXE uRun: [ATI Remote Control] c:\program files\ati multimedia\remctrl\ATIRW.exe uRun: [ATI Scheduler] c:\program files\ati multimedia\main\ATISched.EXE uRun: [kdx] c:\windows\kdx\KHost.exe uRun: [PaperQuote '01] c:\program files\paperquote\PQ.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [AdobeBridge] mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe" mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [1A:Stardock TrayMonitor] mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [mxomssmenu] "c:\program files\maxtor\onetouch status\maxmenumgr.exe" mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE mRun: [Wvowekajomowapu] rundll32.exe "c:\windows\anikavupil.dll",e mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe" mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe mRun: [D-Link D-Link RangeBooster N DWA-140] c:\program files\d-link\d-link rangebooster n dwa-140\AirNCFG.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRunServices: [1A:Stardock TrayMonitor] StartupFolder: c:\docume~1\allie\startm~1\programs\startup\rainme~1.lnk - c:\program files\rainmeter\Rainmeter.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111t\wlan111t.exe IE: &AIM Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html IE: &Viewpoint Search - c:\program files\viewpoint\viewpoint toolbar\ViewBar.dll/CXTSEARCH.HTML IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\SCIEPlgn.dll IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll DPF: {205FF73B-CA67-11D5-99DD-444553540000} - hxxp://www.spywarestormer.com/files2/Install.cab DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {6F750200-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_04-windows-i586.cab DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} - hxxp://kdx.kontiki.com/kdx/Client403/kdx.cab DPF: {B49C4597-8721-4789-9250-315DFBD9F525} - hxxp://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab DPF: {CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_04-windows-i586.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab Notify: klogon - c:\windows\system32\klogon.dll AppInit_DLLs: c:\windows\system32\fahumaki.dll ,c:\progra~1\kasper~1\kasper~1\mzvkbd.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll STS: c:\windows\system32\hsf73ikmdf3f.dll: {b2ba40a2-74f3-42bd-f434-2604812c8954} - c:\windows\system32\hsf73ikmdf3f.dll LSA: Notification Packages = scecli c:\windows\system32\fahumaki.dll s32HOLAR.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\allie\applic~1\mozilla\firefox\profiles\4i4cbzui.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query= FF - prefs.js: browser.search.selectedEngine - AIM Search FF - prefs.js: browser.startup.homepage - myspace.com FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query= FF - component: c:\documents and settings\allie\application data\mozilla\firefox\profiles\4i4cbzui.default\extensions\[removed]\components\coolirisstub.dll FF - plugin: c:\documents and settings\allie\application data\mozilla\firefox\profiles\4i4cbzui.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll FF - plugin: c:\program files\java\j2re1.4.2_06\bin\NPJava11.dll FF - plugin: c:\program files\java\j2re1.4.2_06\bin\NPJava12.dll FF - plugin: c:\program files\java\j2re1.4.2_06\bin\NPJava13.dll FF - plugin: c:\program files\java\j2re1.4.2_06\bin\NPJava14.dll FF - plugin: c:\program files\java\j2re1.4.2_06\bin\NPJava32.dll FF - plugin: c:\program files\java\j2re1.4.2_06\bin\NPJPI142_06.dll FF - plugin: c:\program files\java\j2re1.4.2_06\bin\NPOJI610.dll FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPJava11.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPJava12.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPJava13.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPJava32.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPJPI141_04.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPOJI610.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - HiddenExtension: XUL Cache: {6185D7E4-718F-4E60-9979-868D6972DD86} - c:\documents and settings\allie\local settings\application data\{6185D7E4-718F-4E60-9979-868D6972DD86} FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ ============= SERVICES / DRIVERS =============== R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872] R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808] R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-4-12 213520] R2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe [2008-7-29 208616] R2 Maxtor Sync Service;Maxtor Service;c:\program files\maxtor\sync\SyncServices.exe [2007-9-28 156976] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-10 24652] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592] R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632] R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2010-1-18 517632] S3 atinysxx;ATI USB 2.0 TV Audio Crossbar;c:\windows\system32\drivers\atinysxx.sys [2005-1-1 93696] S3 atinyvxx;ATI TV WONDER USB2.0 Video & Audio;c:\windows\system32\drivers\atinyvxx.sys [2005-1-1 185344] S3 ATITUNEP2;ATI TV WONDER USB2.0 TV Tuner;c:\windows\system32\drivers\atinyuxx.sys [2005-1-1 75776] S3 ATIUTD;ATI TV WONDER USB2.0 Device Driver;c:\windows\system32\drivers\ATIUTD.sys [2005-1-1 38912] S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2006-8-28 17149] S3 TTDec;ATI TV WONDER USB2.0 Teletext Decoder;c:\windows\system32\drivers\atinyttx.sys [2005-1-1 13824] =============== Created Last 30 ================ 2010-02-15 16:18 –d—– c:\program files\iTunes 2010-02-11 18:14 –d—– c:\windows\system32\LogFiles 2010-02-08 00:19 –d—– c:\program files\Hobbyist Software 2010-02-07 16:52 –d—– c:\docume~1\allie\applic~1\ManyCam 2010-02-07 16:52 –d—– c:\program files\ManyCam 2.4 2010-02-07 16:52 –d—– c:\program files\Ask.com ==================== Find3M ==================== 2010-03-04 00:23 5,107,232 a–sh— c:\windows\system32\drivers\fidbox.dat 2010-03-04 00:23 42,028 a–sh— c:\windows\system32\drivers\fidbox.idx 2010-03-03 23:37 1,187,872 a–sh— c:\windows\system32\drivers\fidbox2.dat 2010-03-03 23:37 6,188 a–sh— c:\windows\system32\drivers\fidbox2.idx 2010-02-02 00:42 91,128 a—h— c:\windows\system32\mlfcache.dat 2009-12-31 10:50 353,792 ——– c:\windows\system32\dllcache\srv.sys 2009-12-31 09:33 70,656 ——– c:\windows\system32\dllcache\ie4uinit.exe 2009-12-31 09:33 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe 2009-12-18 07:05 634,648 ——– c:\windows\system32\dllcache\iexplore.exe 2009-12-18 07:04 161,792 ——– c:\windows\system32\dllcache\ieakui.dll 2009-12-16 12:43 343,040 a——- c:\windows\system32\mspaint.exe 2009-12-16 12:43 343,040 ——– c:\windows\system32\dllcache\mspaint.exe 2009-12-16 02:02 495,104 a——- c:\windows\system32\sqlite3.dll 2009-12-14 01:08 33,280 a——- c:\windows\system32\csrsrv.dll 2009-12-14 01:08 33,280 ——– c:\windows\system32\dllcache\csrsrv.dll 2009-12-08 13:27 2,189,184 ——– c:\windows\system32\dllcache\ntoskrnl.exe 2009-12-08 13:26 2,145,280 a——- c:\windows\system32\ntoskrnl.exe 2009-12-08 13:26 2,145,280 ——– c:\windows\system32\dllcache\ntkrnlmp.exe 2009-12-08 12:43 2,023,936 a——- c:\windows\system32\ntkrnlpa.exe 2009-12-08 12:43 2,023,936 ——– c:\windows\system32\dllcache\ntkrpamp.exe 2009-12-08 12:43 2,066,048 ——– c:\windows\system32\dllcache\ntkrnlpa.exe 2009-12-08 03:23 474,112 ——– c:\windows\system32\dllcache\shlwapi.dll 2009-04-12 14:36 61,440 a–sh— c:\windows\system32\jokapovu.exe 2009-03-30 11:58 2,713 —sh— c:\windows\system32\nayisuja.dll 2009-04-12 14:36 61,440 a–sh— c:\windows\system32\pagifobe.exe 2009-04-07 17:01 9,405 a–sh— c:\windows\system32\tumavuzu.dll 2009-06-03 07:22 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009060320090604\index.dat ============= FINISH: 0:32:01.87 =============== attach.txt attachment: 📎Attach.txt
Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")


Stay with this topic until I give you the all clean post.

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

    Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
after running combofix, my computer seems to be running fine, no notice of anything popping up like before, and i can now access things like my firewall that i couldnt before

heres the copy of the .txt:


ComboFix 10-03-04.06 - Allie 03/05/2010 12:59:50.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2532 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Allie\Local Settings\Application Data\{6185D7E4-718F-4E60-9979-868D6972DD86}
c:\documents and settings\Allie\Local Settings\Application Data\{6185D7E4-718F-4E60-9979-868D6972DD86}\chrome.manifest
c:\documents and settings\Allie\Local Settings\Application Data\{6185D7E4-718F-4E60-9979-868D6972DD86}\chrome\content\_cfg.js
c:\documents and settings\Allie\Local Settings\Application Data\{6185D7E4-718F-4E60-9979-868D6972DD86}\chrome\content\c.js
c:\documents and settings\Allie\Local Settings\Application Data\{6185D7E4-718F-4E60-9979-868D6972DD86}\chrome\content\overlay.xul
c:\documents and settings\Allie\Local Settings\Application Data\{6185D7E4-718F-4E60-9979-868D6972DD86}\install.rdf
c:\documents and settings\Allie\Local Settings\Application Data\av.exe
c:\documents and settings\Allie\Start Menu\Programs\Startup\Rainmeter.lnk
c:\progra~1\AWS\WEATHE~1\MINIbu~1.dll
c:\program files\AWS\WEATHE~1\MINIBU~1.DLL
c:\program files\screensavers.com
c:\program files\screensavers.com\Installer\bin\iebyterange.xml
c:\program files\screensavers.com\Installer\bin\iebyterange.xml.backup
c:\program files\screensavers.com\Wallpaper\Dirty Dancing - Havana Nights.jpg
c:\program files\screensavers.com\Wallpaper\swpstart.exe
c:\windows\7673d9ac.ocx
c:\windows\80f54c17.ocx
c:\windows\85a58256.ocx
c:\windows\anikavupil.dll
c:\windows\bundles
c:\windows\c4e7b72c.ocx
c:\windows\instsp2.exe
c:\windows\system32\7158fcfb.ocx
c:\windows\system32\92cb8819.ocx
c:\windows\system32\avezidat.ini
c:\windows\system32\ef841279.ocx
c:\windows\system32\etizahot.ini
c:\windows\system32\ewisuzuj.ini
c:\windows\system32\hsF73ikmdf3f.dll
c:\windows\system32\ibasemiw.ini
c:\windows\system32\jokapovu.exe
c:\windows\system32\nayisuja.dll
c:\windows\system32\oborifiz.ini
c:\windows\system32\pagifobe.exe
c:\windows\system32\twain_32.dll
c:\windows\system32\ufuzarob.ini
c:\windows\system32\uguvezer.ini
c:\windows\system32\ulifoyom.ini
c:\windows\system32\uwameput.ini
c:\windows\system32\uyigumiz.ini
F:\autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_seneka


((((((((((((((((((((((((( Files Created from 2010-02-05 to 2010-03-05 )))))))))))))))))))))))))))))))
.

2010-02-15 22:18 . 2010-02-15 22:19 ——– d—–w- c:\program files\iTunes
2010-02-12 00:14 . 2010-02-12 00:14 ——– d—–w- c:\windows\system32\LogFiles
2010-02-08 06:19 . 2010-02-08 06:19 ——– d—–w- c:\program files\Hobbyist Software
2010-02-07 22:52 . 2010-02-07 22:54 ——– d—–w- c:\documents and settings\Allie\Application Data\ManyCam
2010-02-07 22:52 . 2010-02-10 23:50 ——– d—–w- c:\program files\ManyCam 2.4
2010-02-07 22:52 . 2010-02-21 14:01 ——– d—–w- c:\program files\Ask.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-05 19:10 . 2009-04-12 18:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-03-05 19:08 . 2009-04-12 18:57 6216 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-03-05 19:08 . 2009-04-12 18:57 5117984 –sha-w- c:\windows\system32\drivers\fidbox.dat
2010-03-05 19:08 . 2009-04-12 18:57 42112 –sha-w- c:\windows\system32\drivers\fidbox.idx
2010-03-05 19:08 . 2009-04-12 18:57 1196064 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-03-04 05:56 . 2004-11-29 04:19 ——– d—–w- c:\program files\MUSICMATCH
2010-03-04 05:50 . 2004-11-29 04:16 ——– d—–w- c:\program files\Dell
2010-03-04 05:44 . 2009-04-08 00:31 1026 —-a-w- c:\windows\Lxukepubike.dat
2010-03-04 05:36 . 2008-08-12 07:36 ——– d—–w- c:\documents and settings\Allie\Application Data\uTorrent
2010-02-17 07:04 . 2009-05-15 07:44 ——– d—–w- c:\documents and settings\Allie\Application Data\dvdcss
2010-02-15 22:18 . 2005-11-29 21:17 ——– d—–w- c:\program files\iPod
2010-02-15 22:18 . 2007-09-26 05:57 ——– d—–w- c:\program files\Common Files\Apple
2010-02-12 20:34 . 2008-09-01 10:46 ——– d—–w- c:\documents and settings\Allie\Application Data\vlc
2010-02-03 19:55 . 2005-11-03 05:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Kodak
2010-02-03 18:51 . 2005-11-03 05:10 ——– d—–w- c:\program files\Kodak
2010-02-03 08:44 . 2005-01-02 00:20 ——– d—–w- c:\program files\Common Files\Adobe
2010-02-02 06:42 . 2010-02-02 06:42 91128 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-01 03:57 . 2005-09-08 23:02 ——– d—–w- c:\documents and settings\Allie\Application Data\Apple Computer
2010-02-01 03:55 . 2007-09-26 05:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2010-01-19 01:05 . 2010-01-19 01:04 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-01-19 01:02 . 2008-09-19 05:05 ——– d—–w- c:\program files\Bonjour
2010-01-19 01:01 . 2010-01-19 01:00 ——– d—–w- c:\program files\QuickTime
2010-01-18 06:13 . 2010-01-18 06:13 ——– d—–w- c:\program files\ANI
2010-01-18 06:13 . 2004-11-29 04:16 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-18 06:11 . 2010-01-18 06:11 ——– d—–w- c:\program files\D-Link
2010-01-18 06:11 . 2010-01-18 06:11 ——– d—–w- c:\documents and settings\Allie\Application Data\InstallShield
2010-01-05 10:00 . 2004-08-04 11:00 832512 —-a-w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 11:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 11:00 17408 ——w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-04 11:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2004-08-04 11:00 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-16 08:02 . 2009-12-16 08:02 495104 —-a-w- c:\windows\system32\sqlite3.dll
2009-12-14 07:08 . 2004-08-04 11:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 1980-01-01 06:00 2145280 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 1980-01-01 06:00 2023936 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-04-07 23:01 . 2009-04-07 23:01 9405 –sha-w- c:\windows\SYSTEM32\tumavuzu.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI DeviceDetect"="c:\program files\ATI Multimedia\main\ATIDtct.EXE" [2004-07-30 69705]
"ATI Remote Control"="c:\program files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-07-08 196608]
"ATI Scheduler"="c:\program files\ATI Multimedia\MAIN\ATISched.EXE" [2004-07-30 45131]
"kdx"="c:\windows\kdx\KHost.exe" [2005-04-01 2605056]
"PaperQuote '01"="c:\program files\PaperQuote\PQ.exe" [2001-03-25 453672]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-02-24 180269]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-10-20 208616]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"D-Link D-Link RangeBooster N DWA-140"="c:\program files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe" [2007-08-20 1671168]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
NETGEAR WG111T Smart Wizard.lnk - c:\program files\NETGEAR\WG111T\wlan111t.exe [2006-8-28 884840]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINDOWS\\kdx\\khost.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\SYSTEM32\DRIVERS\klbg.sys [1/29/2008 5:29 PM 33808]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 6:20 PM 24652]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\SYSTEM32\DRIVERS\klim5.sys [4/30/2008 5:06 PM 24592]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\SYSTEM32\DRIVERS\ManyCam.sys [1/14/2008 4:06 AM 21632]
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\SYSTEM32\DRIVERS\rt2870.sys [1/18/2010 12:11 AM 517632]
S3 atinysxx;ATI USB 2.0 TV Audio Crossbar;c:\windows\SYSTEM32\DRIVERS\atinysxx.sys [1/1/2005 6:17 PM 93696]
S3 atinyvxx;ATI TV WONDER USB2.0 Video & Audio;c:\windows\SYSTEM32\DRIVERS\atinyvxx.sys [1/1/2005 6:17 PM 185344]
S3 ATITUNEP2;ATI TV WONDER USB2.0 TV Tuner;c:\windows\SYSTEM32\DRIVERS\atinyuxx.sys [1/1/2005 6:17 PM 75776]
S3 ATIUTD;ATI TV WONDER USB2.0 Device Driver;c:\windows\SYSTEM32\DRIVERS\ATIUTD.sys [1/1/2005 6:17 PM 38912]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\SYSTEM32\DNINDIS5.sys [8/28/2006 3:20 PM 17149]
S3 TTDec;ATI TV WONDER USB2.0 Teletext Decoder;c:\windows\SYSTEM32\DRIVERS\atinyttx.sys [1/1/2005 6:17 PM 13824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-03-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2004-12-12 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\system32\OOBE\OOBEBALN.EXE [2004-08-04 00:12]

2010-03-05 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-04 22:50]

2010-03-05 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-06-04 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.myspace.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Viewpoint Search - c:\program files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Allie\Application Data\Mozilla\Firefox\Profiles\4i4cbzui.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: browser.startup.homepage - myspace.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: c:\documents and settings\Allie\Application Data\Mozilla\Firefox\Profiles\4i4cbzui.default\extensions\[removed]\components\coolirisstub.dll
FF - plugin: c:\documents and settings\Allie\Application Data\Mozilla\Firefox\Profiles\4i4cbzui.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJPI142_06.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava11.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava12.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJPI141_04.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeBridge - (no file)
HKLM-Run-1A:Stardock TrayMonitor - (no file)
HKLM-Run-Wvowekajomowapu - c:\windows\anikavupil.dll
Notify-NavLogon - (no file)
AddRemove-Dell Photo AIO Printer 922 - c:\windows\system32\spool\drivers\w32x86\3\DLBTUNST.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-05 13:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1440)
c:\windows\system32\CLBCATQ.DLL

- - - - - - - > 'explorer.exe'(3560)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Maxtor\Sync\SyncServices.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\dwwin.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\AIM6\aolsoftware.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\MsiExec.exe
.
**************************************************************************
.
Completion time: 2010-03-05 13:21:40 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-05 19:21

Pre-Run: 5,507,735,552 bytes free
Post-Run: 14,553,636,864 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 2F2783AAB9033B5A59EF61EF823F69B4
1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Ask.com
Viewpoint


After the above:

Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    If you used DeFogger
    You must remember to re-enable your Emulation drivers once we are finished, double click DeFogger to run the tool.

    • The application window will appear
    • Click the Re-enable button to re-enable your CD Emulation drivers
    • Click Yes to continue
    • A 'Finished!' message will appear
    • Click OK
    • DeFogger will now ask to reboot the machine - click OK
    IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

    Your Emulation drivers are now re-enabled.


    To be on the safe side, I would also change all my passwords.



    Here's my usual all clean post

    Log looks good :D


    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      • From within Internet Explorer click on the Tools menu and then click on Options.
      • Click once on the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.


I would suggest you read How to Prevent Malware:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI