Spyware / Malware / Virus Removal

[Resolved] browser redirect

12 min read

Looking for the outcome? Ask AI

-Adam. Topic Starter

Post #1April 5, 2010, 6:45 PM UTC

Hello, My Names Adam.
I have been having this problem for about 2 days now.
I have run the Norton scans in and out of safe mode, also MBAM in and out of safe mode.
Still being redirected.

My DDS File.

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 14:18:37.54 on Mon 04/05/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_19
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1022.447 [GMT -4:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Adam\Desktop\dds.com
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.4.1.27.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton security suite\engine\3.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton security suite\engine\3.8.0.41\IPSBHO.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton security suite\engine\3.8.0.41\coIEPlg.dll
uRun: [SandboxieControl] "c:\program files\sandboxie\SbieCtrl.exe"
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.4.1.27.dll/206
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton security suite\engine\3.8.0.41\CoIEPlg.dll
Hosts: 59.53.91.102 www.google.com
Hosts: 59.53.91.102 google.com
Hosts: 59.53.91.102 www.google.com
Hosts: 59.53.91.102 google.com
Hosts: 59.53.91.102 www.google.com

Note: multiple HOSTS entries found. Please refer to Attach.txt

================= FIREFOX ===================

FF - ProfilePath - c:\users\adam\appdata\roaming\mozilla\firefox\profiles\lb18vm8m.default\
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-3-7 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-3-7 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-3-7 482432]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100326.001\IDSvix86.sys [2010-3-26 343088]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2010-3-25 8576]
R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\3.8.0.41\ccSvcHst.exe [2010-3-7 117640]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-2-3 115432]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\n360\0308000.029\symndisv.sys [2010-3-7 48688]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-3-24 27192]

=============== Created Last 30 ================

2010-04-05 13:02:27 0 d—–w- c:\users\adam\appdata\roaming\Malwarebytes
2010-04-05 13:02:10 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-05 13:02:07 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-05 13:02:07 0 d—–w- c:\programdata\Malwarebytes
2010-04-05 13:02:06 0 d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-04 16:57:10 68888 —-a-w- c:\windows\system32\xinput1_3.dll
2010-04-04 16:57:10 2414360 —-a-w- c:\windows\system32\d3dx9_31.dll
2010-04-04 16:55:39 0 d—–w- c:\programdata\Microsoft Games
2010-04-04 16:54:30 0 d—–w- c:\users\adam\appdata\roaming\Microsoft Game Studios
2010-04-04 00:44:28 0 d—–w- c:\programdata\Sun
2010-04-04 00:42:44 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-04-02 04:18:12 0 d—–w- c:\programdata\HipSoft
2010-04-02 04:17:31 0 d—–w- c:\program files\LeeGTs Games
2010-04-02 02:14:33 0 d—–w- c:\programdata\Shockwave
2010-04-02 02:13:32 0 d—a-w- c:\programdata\TEMP
2010-03-31 09:01:38 977920 —-a-w- c:\windows\system32\wininet.dll
2010-03-30 01:40:20 0 d—–w- c:\program files\common files\DivX Shared
2010-03-30 01:39:32 0 d—–w- c:\program files\DivX
2010-03-30 01:32:32 0 d—–w- c:\programdata\DivX
2010-03-28 22:42:45 0 d—–w- c:\program files\common files\Blizzard Entertainment
2010-03-28 22:33:47 0 d—–w- c:\programdata\Blizzard
2010-03-26 00:53:32 8576 —-a-w- c:\windows\system32\drivers\VCdRom.sys
2010-03-25 22:03:14 8576 —-a-w- c:\windows\system32\VCdRom.sys
2010-03-25 21:51:40 0 d—–w- c:\program files\common files\Macrovision Shared
2010-03-25 21:50:23 0 d—–w- c:\programdata\Rosetta Stone
2010-03-25 21:50:23 0 d—–w- c:\program files\Rosetta Stone
2010-03-25 01:18:00 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2010-03-25 01:17:57 0 d—–w- c:\program files\VS Revo Group
2010-03-24 18:20:49 0 d—–w- C:\Downloads
2010-03-24 18:20:41 0 d—–w- c:\users\adam\appdata\roaming\BitComet
2010-03-24 18:19:48 0 d—–w- c:\program files\BitComet
2010-03-24 17:59:18 0 d—–w- c:\programdata\Azureus
2010-03-24 17:59:07 0 d—–w- c:\users\adam\appdata\roaming\Azureus
2010-03-24 17:55:15 0 d—–w- c:\program files\common files\i4j_jres
2010-03-19 12:43:14 0 d—–w- c:\programdata\Adobe
2010-03-19 12:42:40 0 d—–w- c:\programdata\McAfee
2010-03-19 12:40:32 0 d—–w- c:\programdata\NOS
2010-03-17 03:00:55 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-03-15 03:18:12 266552 —-a-w- c:\windows\system32\HMIPCore.dll
2010-03-12 00:26:49 36226 —-a-w- c:\windows\DIIUnin.dat
2010-03-12 00:26:43 94208 —-a-w- c:\windows\DIIUnin.exe
2010-03-12 00:26:43 2829 —-a-w- c:\windows\DIIUnin.pif
2010-03-11 03:40:16 0 d—–w- c:\program files\Diablo II - Sand Boxed
2010-03-11 02:52:50 0 d—–w- c:\program files\Diablo II
2010-03-09 03:14:36 0 d—–w- c:\users\adam\appdata\roaming\Uniblue
2010-03-09 03:06:34 0 d—–w- c:\program files\Direct X
2010-03-09 02:20:20 3955288 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-03-09 02:20:20 3899464 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-03-09 02:20:20 292864 —-a-w- c:\windows\system32\apphelp.dll
2010-03-08 01:25:46 21840 —-atw- c:\windows\system32\SIntfNT.dll
2010-03-08 01:25:46 17212 —-atw- c:\windows\system32\SIntf32.dll
2010-03-08 01:25:45 12067 —-atw- c:\windows\system32\SIntf16.dll
2010-03-08 01:09:48 1606 —-a-w- c:\windows\Sandboxie.ini
2010-03-08 01:08:33 0 d—–w- c:\program files\Sandboxie
2010-03-07 22:40:10 0 d—–w- c:\program files\Sony
2010-03-07 21:50:29 0 d—–w- c:\programdata\Symantec
2010-03-07 21:42:49 0 d—–w- c:\programdata\Hewlett-Packard
2010-03-06 23:04:36 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-03-06 23:04:36 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2010-03-06 23:04:33 25648 —-a-r- c:\windows\system32\drivers\SymIMV.sys
2010-03-06 23:04:28 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-03-06 23:04:28 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-03-06 23:04:28 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-03-06 23:04:23 0 d—–w- c:\program files\Symantec
2010-03-06 23:04:23 0 d—–w- c:\program files\common files\Symantec Shared
2010-03-06 23:03:49 0 d—–w- c:\windows\system32\drivers\N360
2010-03-06 23:03:47 0 d—–w- c:\program files\Norton Security Suite
2010-03-06 23:03:46 0 d—–w- c:\programdata\Norton
2010-03-06 23:03:33 0 d—–w- c:\programdata\NortonInstaller
2010-03-06 23:03:33 0 d—–w- c:\program files\NortonInstaller

==================== Find3M ====================

2010-03-28 17:37:39 39554 —-a-w- c:\windows\fonts\EUDC.EUF
2010-03-28 17:37:39 112128 —-a-w- c:\windows\fonts\EUDC.TTE
2010-03-06 01:52:25 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-02-24 14:16:06 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-02 07:45:54 2048 —-a-w- c:\windows\system32\tzres.dll
2010-01-18 23:29:31 85504 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-18 23:29:31 85504 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-18 23:29:31 365568 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-18 23:29:30 369152 —-a-w- c:\windows\system32\secproc.dll
2010-01-18 23:28:33 324608 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-18 23:28:33 277504 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-18 23:28:30 320512 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-18 23:28:30 280064 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-12 04:03:33 9388648 —-a-w- c:\windows\system32\nvd3dum.dll
2010-01-12 04:03:33 795104 —-a-w- c:\windows\system32\dpinst.exe
2010-01-12 04:03:33 68200 —-a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03:33 4077672 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03:33 4061800 —-a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03:33 2243176 —-a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03:33 182888 —-a-w- c:\windows\system32\nvcod189.dll
2010-01-12 04:03:33 182888 —-a-w- c:\windows\system32\nvcod.dll
2010-01-12 04:03:33 14924392 —-a-w- c:\windows\system32\nvoglv32.dll
2010-01-12 04:03:33 1280616 —-a-w- c:\windows\system32\nvapi.dll
2010-01-12 04:03:33 11639400 —-a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 03:18:00 962664 —-a-w- c:\windows\system32\nvsvc.dll
2010-01-12 03:18:00 66664 —-a-w- c:\windows\system32\nvshext.dll
2010-01-12 03:18:00 13679720 —-a-w- c:\windows\system32\nvcpl.dll
2010-01-12 03:18:00 129640 —-a-w- c:\windows\system32\nvvsvc.exe
2010-01-12 03:18:00 110696 —-a-w- c:\windows\system32\nvmctray.dll
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 –sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 –sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 14:19:51.05 ===============

My Gmer.txt file.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-05 14:37:19
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\Adam\AppData\Local\Temp\kxldrpoc.sys

—- System - GMER 1.0.15 —-

SSDT 85292EB0 ZwAlertResumeThread
SSDT 85292F90 ZwAlertThread
SSDT 852913F0 ZwAllocateVirtualMemory
SSDT 851F9A50 ZwAlpcConnectPort
SSDT 85293E90 ZwAssignProcessToJobObject
SSDT 85292C00 ZwCreateMutant
SSDT 85293BB0 ZwCreateSymbolicLinkObject
SSDT 85288378 ZwCreateThread
SSDT 85293CA0 ZwCreateThreadEx
SSDT 85293F70 ZwDebugActiveProcess
SSDT 85291CE8 ZwDuplicateObject
SSDT 85291250 ZwFreeVirtualMemory
SSDT 85292CF0 ZwImpersonateAnonymousToken
SSDT 85292DD0 ZwImpersonateThread
SSDT 851EEBE8 ZwLoadDriver
SSDT 85291170 ZwMapViewOfSection
SSDT 85292B20 ZwOpenEvent
SSDT 85293108 ZwOpenProcess
SSDT 852570A8 ZwOpenProcessToken
SSDT 85292960 ZwOpenSection
SSDT 85291DB8 ZwOpenThread
SSDT 85293DA0 ZwProtectVirtualMemory
SSDT 85293598 ZwResumeThread
SSDT 8528DC08 ZwSetContextThread
SSDT 8528DCC8 ZwSetInformationProcess
SSDT 85292818 ZwSetSystemInformation
SSDT 85292A40 ZwSuspendProcess
SSDT 8528D948 ZwSuspendThread
SSDT 852885C0 ZwTerminateProcess
SSDT 8528DAA8 ZwTerminateThread
SSDT 852883D0 ZwUnmapViewOfSection
SSDT 85291320 ZwWriteVirtualMemory

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82827AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82827104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828273F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8280FFB4
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828271DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82827958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828276F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82827F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828281A8

Code 915FCC4C ZwTraceEvent
Code 915FCC4B NtTraceEvent

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004f halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

—- EOF - GMER 1.0.15 —-

I would also like to say that the system restore point tool, douse not work on windows 7 (wich i am using)

Hope to hear from you soon, hope i did what i was spoused to here.
Thanks
-Adam.

Attachments:

📎Attach.txt

LDTate

Post #2April 5, 2010, 9:26 PM UTC last edited April 5, 2010, 9:27 PM UTC

[external image: Posted Image]

Post the MBAM scan results

-Adam.

Post #3April 5, 2010, 10:24 PM UTC

I Ran a scan this morning in windows, and then again in safe mode. posting both Windows. Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 3956 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 4/5/2010 11:16:46 AM mbam-log-2010-04-05 (11-16-46).txt Scan type: Full scan (C:\|) Objects scanned: 246952 Time elapsed: 2 hour(s), 10 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: c:\Windows\System32\Iasex.dll (Backdoor.Bot) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ias (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Windows\System32\Iasex.dll (Backdoor.Bot) -> Delete on reboot. Safe Mode. Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 3956 Windows 6.1.7600 (Safe Mode) Internet Explorer 8.0.7600.16385 4/5/2010 12:15:12 PM mbam-log-2010-04-05 (12-15-12).txt Scan type: Full scan (A:\|C:\|D:\|E:\|F:\|G:\|H:\|) Objects scanned: 244904 Time elapsed: 44 minute(s), 23 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

LDTate

Post #4April 5, 2010, 10:29 PM UTC

(Backdoor.Bot)

Whether you wish to continue with cleaning or not, you should be aware that you may have been infected by a backdoor trojan. This type of program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

Please post back to let me know how you wish to proceed.

-Adam.

Post #5April 5, 2010, 11:25 PM UTC

I do wish to clean my computer as much as possible. i have a question about maybe a restore point. As far as i can tell. Windows 7 has a restore points. i have the option of restoring to the 4th, 3ed, and 2ed. i tried and it failed, saying my anti virus may have stopped it. I'm kinda scared to disable my anti-virus for as far as i know its the only thing keeping out, what ever the redirect, is trying to put in. Whats next… =-)>" I am taking the time between post, now, to change passwords on an uninfected. Thanks -Adam.

LDTate

Post #6April 5, 2010, 11:33 PM UTC

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

-Adam.

Post #7April 6, 2010, 12:32 AM UTC

My computer is acting kinda slow. almost like a bit of lag. This is my combofix.exe results. ComboFix 10-04-04.01 - Adam 04/05/2010 20:11:46.2.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1022.359 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2010-03-06 to 2010-04-06 ))))))))))))))))))))))))))))))) . 2010-04-06 00:22 . 2010-04-06 00:22 ——– d—–w- c:\users\Public\AppData\Local\temp 2010-04-06 00:22 . 2010-04-06 00:22 ——– d—–w- c:\users\Guest\AppData\Local\temp 2010-04-06 00:22 . 2010-04-06 00:22 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-04-06 00:09 . 2010-04-06 00:09 ——– d—–w- C:\32788R22FWJFW 2010-04-05 23:38 . 2010-03-06 08:40 84912 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVENG.SYS 2010-04-05 23:38 . 2010-03-06 08:40 177520 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVENG32.DLL 2010-04-05 23:38 . 2010-03-06 08:40 1647984 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVEX32A.DLL 2010-04-05 23:38 . 2010-03-06 08:40 1324720 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVEX15.SYS 2010-04-05 23:38 . 2010-03-06 08:40 371248 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\EECTRL.SYS 2010-04-05 23:38 . 2010-03-06 08:40 2747440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\CCERASER.DLL 2010-04-05 23:38 . 2010-03-06 08:40 259440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\ECMSVR32.DLL 2010-04-05 23:38 . 2010-03-06 08:40 102448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\ERASER.SYS 2010-04-05 21:23 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSvix86.sys 2010-04-05 21:23 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\Scxpx86.dll 2010-04-05 21:23 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSxpx86.dll 2010-04-05 21:23 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSviA64.sys 2010-04-05 21:23 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSXpx86.sys 2010-04-05 20:48 . 2010-02-12 22:41 558448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll 2010-04-05 20:48 . 2010-02-02 00:20 165240 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll 2010-04-05 20:44 . 2010-04-06 00:22 ——– d—–w- c:\users\Adam\AppData\Local\temp 2010-04-05 18:04 . 2010-04-05 19:58 ——– d—–w- c:\program files\ERUNT 2010-04-05 17:02 . 2010-04-05 17:02 0 —-a-w- c:\windows\nsreg.dat 2010-04-05 16:50 . 2010-04-05 16:50 ——– d—–w- c:\users\Adam\AppData\Local\Symantec 2010-04-05 13:02 . 2010-04-05 13:02 ——– d—–w- c:\users\Adam\AppData\Roaming\Malwarebytes 2010-04-05 13:02 . 2010-03-29 19:24 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-05 13:02 . 2010-04-05 13:02 ——– d—–w- c:\programdata\Malwarebytes 2010-04-05 13:02 . 2010-03-29 19:24 20824 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-04-05 13:02 . 2010-04-05 19:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-04-05 12:59 . 2010-04-05 12:59 ——– d—–w- c:\users\Adam\AppData\Local\ElevatedDiagnostics 2010-04-05 01:30 . 2010-03-06 08:40 84912 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVENG.SYS 2010-04-05 01:30 . 2010-03-06 08:40 177520 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVENG32.DLL 2010-04-05 01:30 . 2010-03-06 08:40 1647984 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVEX32A.DLL 2010-04-05 01:30 . 2010-03-06 08:40 1324720 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVEX15.SYS 2010-04-05 01:30 . 2010-03-06 08:40 371248 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\EECTRL.SYS 2010-04-05 01:30 . 2010-03-06 08:40 259440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\ECMSVR32.DLL 2010-04-05 01:30 . 2010-03-06 08:40 102448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\ERASER.SYS 2010-04-05 01:30 . 2010-03-06 08:40 2747440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\CCERASER.DLL 2010-04-04 16:57 . 2006-09-28 20:05 2414360 —-a-w- c:\windows\system32\d3dx9_31.dll 2010-04-04 16:57 . 2006-09-28 20:04 68888 —-a-w- c:\windows\system32\xinput1_3.dll 2010-04-04 16:56 . 2010-04-04 16:56 ——– d—–w- c:\users\Adam\AppData\Local\Microsoft Game Studios 2010-04-04 16:55 . 2010-04-05 19:58 ——– d—–w- c:\programdata\Microsoft Games 2010-04-04 16:54 . 2010-04-04 16:54 ——– d—–w- c:\users\Adam\AppData\Roaming\Microsoft Game Studios 2010-04-04 00:45 . 2010-04-04 00:45 ——– d—–w- c:\windows\Sun 2010-04-04 00:44 . 2010-04-04 00:44 ——– d—–w- c:\program files\Common Files\Java 2010-04-04 00:42 . 2010-04-04 00:41 411368 —-a-w- c:\windows\system32\deploytk.dll 2010-04-04 00:41 . 2010-04-04 00:41 ——– d—–w- c:\program files\Java 2010-04-02 04:18 . 2010-04-02 04:18 ——– d—–w- c:\programdata\HipSoft 2010-04-02 04:17 . 2010-04-05 16:55 ——– d—–w- c:\program files\LeeGTs Games 2010-04-02 02:14 . 2010-04-02 02:14 ——– d—–w- c:\programdata\Shockwave 2010-04-01 08:24 . 2010-04-01 08:24 ——– d—–w- c:\users\Guest\AppData\Local\Mozilla 2010-03-31 09:01 . 2010-02-23 07:56 977920 —-a-w- c:\windows\system32\wininet.dll 2010-03-30 01:40 . 2010-03-30 01:32 754984 —-a-w- c:\programdata\DivX\Setup\Resource.dll 2010-03-30 01:40 . 2010-03-22 15:36 986904 —-a-w- c:\programdata\DivX\Setup\DivXSetup.exe 2010-03-30 01:40 . 2010-03-30 01:40 56766 —-a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 56978 —-a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 57409 —-a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 53600 —-a-w- c:\programdata\DivX\Update\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 52963 —-a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 54073 —-a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 ——– d—–w- c:\program files\Common Files\DivX Shared 2010-03-30 01:39 . 2010-03-30 01:40 ——– d—–w- c:\program files\DivX 2010-03-30 01:32 . 2010-03-30 01:41 ——– d—–w- c:\programdata\DivX 2010-03-29 02:46 . 2010-03-29 02:46 ——– d—–w- c:\users\Adam\AppData\Local\Blizzard Entertainment 2010-03-28 22:42 . 2010-03-29 02:27 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment 2010-03-28 22:42 . 2010-03-29 02:27 ——– d—–w- c:\users\Public\Games 2010-03-28 22:33 . 2010-03-28 22:33 ——– d—–w- c:\programdata\Blizzard 2010-03-26 05:57 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSvix86.sys 2010-03-26 05:57 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSXpx86.sys 2010-03-26 05:57 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\Scxpx86.dll 2010-03-26 05:57 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSxpx86.dll 2010-03-26 05:57 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSviA64.sys 2010-03-26 00:53 . 2001-12-19 15:45 8576 —-a-w- c:\windows\system32\drivers\VCdRom.sys 2010-03-25 22:03 . 2001-12-19 15:45 8576 —-a-w- c:\windows\system32\VCdRom.sys 2010-03-25 21:51 . 2010-03-25 21:51 ——– d—–w- c:\program files\Common Files\Macrovision Shared 2010-03-25 21:50 . 2010-03-28 19:49 ——– d—–w- c:\programdata\Rosetta Stone 2010-03-25 21:50 . 2010-03-25 21:50 ——– d—–w- c:\program files\Rosetta Stone 2010-03-25 07:14 . 2010-03-25 07:14 ——– d—–w- c:\users\Adam\AppData\Local\Diagnostics 2010-03-25 01:18 . 2010-03-25 01:18 ——– d—–w- c:\users\Adam\AppData\Local\VS Revo Group 2010-03-25 01:18 . 2009-12-30 15:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys 2010-03-25 01:17 . 2010-03-25 01:17 ——– d—–w- c:\program files\VS Revo Group 2010-03-24 18:20 . 2010-04-05 19:58 ——– d—–w- C:\Downloads 2010-03-24 18:20 . 2010-04-05 21:08 ——– d—–w- c:\users\Adam\AppData\Roaming\BitComet 2010-03-24 17:59 . 2010-03-24 17:59 ——– d—–w- c:\programdata\Azureus 2010-03-24 17:59 . 2010-03-24 18:12 ——– d—–w- c:\users\Adam\AppData\Roaming\Azureus 2010-03-24 17:55 . 2010-03-24 17:55 ——– d—–w- c:\program files\Common Files\i4j_jres 2010-03-19 12:47 . 2010-02-01 01:45 38784 —-a-w- c:\users\Adam\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-03-19 12:45 . 2010-03-19 12:46 ——– d—–w- c:\program files\Common Files\Adobe 2010-03-19 12:43 . 2010-02-01 01:45 38784 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-03-19 12:43 . 2010-03-19 12:43 ——– d—–w- c:\program files\Common Files\Adobe AIR 2010-03-19 12:42 . 2010-03-19 12:42 ——– d—–w- c:\programdata\McAfee 2010-03-19 12:41 . 2010-03-19 12:51 ——– d—–w- c:\users\Adam\AppData\Local\Adobe 2010-03-19 12:41 . 2010-03-19 12:41 86016 —-a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe 2010-03-19 12:40 . 2010-03-24 18:06 ——– d—–w- c:\programdata\NOS 2010-03-15 03:18 . 2010-01-30 14:48 266552 —-a-w- c:\windows\system32\HMIPCore.dll 2010-03-14 22:32 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\Scxpx86.dll 2010-03-14 22:32 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSXpx86.sys 2010-03-14 22:32 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSxpx86.dll 2010-03-14 22:31 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSvix86.sys 2010-03-14 22:31 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSviA64.sys 2010-03-12 00:26 . 2010-03-12 01:27 36226 —-a-w- c:\windows\DIIUnin.dat 2010-03-12 00:26 . 2010-03-12 00:26 94208 —-a-w- c:\windows\DIIUnin.exe 2010-03-12 00:26 . 2010-03-12 00:26 2829 —-a-w- c:\windows\DIIUnin.pif 2010-03-11 03:40 . 2010-03-12 01:16 ——– d—–w- c:\program files\Diablo II - Sand Boxed 2010-03-11 02:52 . 2010-04-05 19:58 ——– d—–w- c:\program files\Diablo II 2010-03-09 03:14 . 2010-03-09 03:14 ——– d—–w- c:\users\Adam\AppData\Roaming\Uniblue 2010-03-09 03:06 . 2010-03-09 03:07 ——– d—–w- c:\program files\Direct X 2010-03-09 02:20 . 2009-12-08 11:40 3955288 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-03-09 02:20 . 2009-12-08 11:40 3899464 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-03-09 02:20 . 2009-12-08 11:32 292864 —-a-w- c:\windows\system32\apphelp.dll 2010-03-08 19:08 . 2010-03-08 19:08 ——– d—–w- c:\windows\system32\Macromed 2010-03-08 01:25 . 2010-03-12 01:08 21840 —-atw- c:\windows\system32\SIntfNT.dll 2010-03-08 01:25 . 2010-03-12 01:08 17212 —-atw- c:\windows\system32\SIntf32.dll 2010-03-08 01:08 . 2010-04-05 19:58 ——– d—–w- c:\program files\Sandboxie 2010-03-08 01:03 . 2010-03-08 01:03 57560 —-a-w- c:\users\Adam\AppData\Local\GDIPFONTCACHEV1.DAT 2010-03-07 22:40 . 2010-03-07 23:07 ——– d—–w- c:\program files\Sony 2010-03-07 22:40 . 2010-03-07 22:40 ——– d–h–w- c:\program files\InstallShield Installation Information 2010-03-07 22:39 . 2010-03-07 22:39 ——– d—–w- c:\program files\Common Files\InstallShield 2010-03-07 21:50 . 2010-03-07 21:50 ——– d—–w- c:\programdata\Symantec 2010-03-07 21:42 . 2010-03-07 21:42 ——– d—–w- c:\programdata\Hewlett-Packard 2010-03-07 21:42 . 2009-07-14 01:15 280064 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzppw71.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-04 16:57 . 2009-07-14 04:52 ——– d—–w- c:\program files\Microsoft Games 2010-03-17 03:00 . 2010-03-17 03:00 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2010-03-06 23:26 . 2010-03-06 23:04 ——– d—–w- c:\program files\Common Files\Symantec Shared 2010-03-06 23:05 . 2010-03-06 23:03 ——– d—–w- c:\programdata\Norton 2010-03-06 23:04 . 2010-03-06 23:04 ——– d—–w- c:\program files\Symantec 2010-03-06 23:04 . 2010-03-06 23:04 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF 2010-03-06 23:04 . 2010-03-06 23:04 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT 2010-03-06 23:04 . 2010-03-06 23:04 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2010-03-06 23:04 . 2010-03-06 23:04 25648 —-a-r- c:\windows\system32\drivers\SymIMV.sys 2010-03-06 23:04 . 2010-03-06 23:04 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys 2010-03-06 23:04 . 2010-03-06 23:04 1291104 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll 2010-03-06 23:04 . 2010-03-06 23:04 136840 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll 2010-03-06 23:04 . 2010-03-06 23:04 107368 —-a-r- c:\windows\system32\GEARAspi.dll 2010-03-06 23:04 . 2010-03-06 23:04 776952 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll 2010-03-06 23:04 . 2010-03-06 23:03 ——– d—–w- c:\program files\Norton Security Suite 2010-03-06 23:03 . 2010-03-06 23:03 ——– d—–w- c:\programdata\NortonInstaller 2010-03-06 23:03 . 2010-03-06 23:03 ——– d—–w- c:\program files\NortonInstaller 2010-03-06 22:55 . 2010-03-06 00:28 ——– d—–w- c:\program files\DriverGenius 2010-03-06 01:52 . 2010-03-06 01:52 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf 2010-03-06 00:23 . 2010-03-06 00:23 ——– d—–w- c:\programdata\NVIDIA 2010-03-06 00:23 . 2010-03-06 00:22 ——– d—–w- c:\program files\NVIDIA Corporation 2010-03-06 00:08 . 2010-03-06 00:08 ——– d—–w- c:\program files\SystemRequirementsLab 2010-02-24 14:16 . 2010-03-05 23:39 181632 ——w- c:\windows\system32\MpSigStub.exe 2010-02-02 07:45 . 2010-03-05 23:40 2048 —-a-w- c:\windows\system32\tzres.dll 2010-02-01 01:45 . 2010-03-22 02:41 38784 —-a-w- c:\users\Guest\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-01-18 23:29 . 2010-03-05 23:40 85504 —-a-w- c:\windows\system32\secproc_ssp_isv.dll 2010-01-18 23:29 . 2010-03-05 23:40 85504 —-a-w- c:\windows\system32\secproc_ssp.dll 2010-01-18 23:29 . 2010-03-05 23:40 365568 —-a-w- c:\windows\system32\secproc_isv.dll 2010-01-18 23:29 . 2010-03-05 23:40 369152 —-a-w- c:\windows\system32\secproc.dll 2010-01-18 23:28 . 2010-03-05 23:40 324608 —-a-w- c:\windows\system32\RMActivate_isv.exe 2010-01-18 23:28 . 2010-03-05 23:40 277504 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe 2010-01-18 23:28 . 2010-03-05 23:40 320512 —-a-w- c:\windows\system32\RMActivate.exe 2010-01-18 23:28 . 2010-03-05 23:40 280064 —-a-w- c:\windows\system32\RMActivate_ssp.exe 2010-01-12 04:03 . 2010-03-06 00:22 795104 —-a-w- c:\windows\system32\dpinst.exe 2010-01-12 04:03 . 2010-03-06 00:22 68200 —-a-w- c:\windows\system32\OpenCL.dll 2010-01-12 04:03 . 2010-03-06 00:22 14924392 —-a-w- c:\windows\system32\nvoglv32.dll 2010-01-12 04:03 . 2010-03-06 00:22 11586280 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys 2010-01-12 04:03 . 2010-03-06 00:22 9388648 —-a-w- c:\windows\system32\nvd3dum.dll 2010-01-12 04:03 . 2010-03-06 00:22 4077672 —-a-w- c:\windows\system32\nvcuvenc.dll 2010-01-12 04:03 . 2010-03-06 00:22 4061800 —-a-w- c:\windows\system32\nvcuda.dll 2010-01-12 04:03 . 2010-03-06 00:22 2243176 —-a-w- c:\windows\system32\nvcuvid.dll 2010-01-12 04:03 . 2010-03-06 00:22 182888 —-a-w- c:\windows\system32\nvcod189.dll 2010-01-12 04:03 . 2010-03-06 00:22 182888 —-a-w- c:\windows\system32\nvcod.dll 2010-01-12 04:03 . 2010-03-06 00:22 1280616 —-a-w- c:\windows\system32\nvapi.dll 2010-01-12 04:03 . 2010-03-06 00:22 11639400 —-a-w- c:\windows\system32\nvcompiler.dll 2010-01-12 03:18 . 2010-01-12 03:18 962664 —-a-w- c:\windows\system32\nvsvc.dll 2010-01-12 03:18 . 2010-01-12 03:18 66664 —-a-w- c:\windows\system32\nvshext.dll 2010-01-12 03:18 . 2010-01-12 03:18 13679720 —-a-w- c:\windows\system32\nvcpl.dll 2010-01-12 03:18 . 2010-01-12 03:18 129640 —-a-w- c:\windows\system32\nvvsvc.exe 2010-01-12 03:18 . 2010-01-12 03:18 110696 —-a-w- c:\windows\system32\nvmctray.dll 2010-01-08 03:18 . 2010-03-05 23:42 221184 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-01-08 03:17 . 2010-03-05 23:42 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ((((((((((((((((((((((((((((( SnapShot@2010-04-05_20.40.27 ))))))))))))))))))))))))))))))))))))))))) . + 2010-03-06 00:02 . 2010-04-05 20:50 18948 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 04:55 . 2010-04-05 20:50 40224 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2010-03-06 02:02 . 2010-04-05 12:59 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-06 02:02 . 2010-04-05 23:30 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-06 02:02 . 2010-04-05 23:30 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-03-06 02:02 . 2010-04-05 12:59 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:41 . 2010-04-05 12:59 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:41 . 2010-04-05 23:30 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-13 10:11 . 2010-04-06 00:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat - 2010-03-13 10:11 . 2010-04-05 20:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat - 2010-03-13 10:11 . 2010-04-05 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat + 2010-03-13 10:11 . 2010-04-06 00:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat - 2010-03-13 10:11 . 2010-04-05 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat + 2010-03-13 10:11 . 2010-04-06 00:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-06 00:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-03-05 23:26 . 2010-04-05 20:50 6446 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3973659962-2508152415-2587932275-1000_UserData.bin - 2010-04-05 19:59 . 2010-04-05 19:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2010-04-05 20:48 . 2010-04-05 20:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2010-04-05 19:59 . 2010-04-05 19:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2010-04-05 20:48 . 2010-04-05 20:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 02:03 . 2010-04-05 20:13 6815744 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT + 2009-07-14 02:03 . 2010-04-05 22:26 6815744 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2010-02-03 394984] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys] @="FSFilter Activity Monitor" R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SYMEFA.SYS [2010-03-06 310320] S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2010-03-06 259632] S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2010-03-06 482432] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100402.001\IDSvix86.sys [2009-10-28 343088] S1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\System32\drivers\VCdRom.sys [2001-12-19 8576] S2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe [2010-03-06 117640] S3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\N360\0308000.029\SYMNDISV.SYS [2010-03-06 48688] — Other Services/Drivers In Memory — *Deregistered* - EraserUtilDrvI9 . . ——- Supplementary Scan ——- . FF - ProfilePath - c:\users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\lb18vm8m.default\ FF - prefs.js: browser.startup.homepage - hxxp://forums.whatthetech.com/Infections_Removal_f27.html FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll —- FIREFOX POLICIES —- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360] "ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2010-04-05 20:26:38 ComboFix-quarantined-files.txt 2010-04-06 00:26 Pre-Run: 51,065,589,760 bytes free Post-Run: 50,783,490,048 bytes free - - End Of File - - 86A18EEEC88EE689A1F7120329C6D098 Thanks. -Adam.

LDTate

Post #8April 6, 2010, 12:50 AM UTC

Only thing I see is a leftover McAfee folder

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::


Folder::
c:\programdata\McAfee

Driver::

Registry::

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

-Adam.

Post #9April 6, 2010, 1:39 AM UTC

The Computer seams to be running, "ok" not as laggy as it was, but still its running like it should. ComboFix 10-04-04.01 - Adam 04/05/2010 21:16:47.3.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1022.449 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Adam\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\McAfee c:\programdata\McAfee\MCLOGS\Common\McCHSvc\McCHSvc000.log c:\programdata\McAfee\MCLOGS\McUICnt\McUICnt\McUICnt000.log c:\programdata\McAfee\MCLOGS\PartnerCustom\McCHSvc\McCHSvc000.log c:\programdata\McAfee\MCLOGS\PartnerCustom\McUICnt\McUICnt000.log c:\programdata\McAfee\MCLOGS\PartnerCustom\SecurityScan_Release\SecurityScan_Release000.log c:\programdata\McAfee\MCLOGS\PartnerCustom\SSScheduler\SSScheduler000.log c:\programdata\McAfee\MCLOGS\SecurityScanner\McUICnt\McUICnt000.log . ((((((((((((((((((((((((( Files Created from 2010-03-06 to 2010-04-06 ))))))))))))))))))))))))))))))) . 2010-04-06 01:30 . 2010-04-06 01:30 ——– d—–w- c:\users\Public\AppData\Local\temp 2010-04-06 01:30 . 2010-04-06 01:30 ——– d—–w- c:\users\Guest\AppData\Local\temp 2010-04-06 01:30 . 2010-04-06 01:30 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-04-05 23:38 . 2010-03-06 08:40 84912 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVENG.SYS 2010-04-05 23:38 . 2010-03-06 08:40 177520 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVENG32.DLL 2010-04-05 23:38 . 2010-03-06 08:40 1647984 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVEX32A.DLL 2010-04-05 23:38 . 2010-03-06 08:40 1324720 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\NAVEX15.SYS 2010-04-05 23:38 . 2010-03-06 08:40 371248 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\EECTRL.SYS 2010-04-05 23:38 . 2010-03-06 08:40 2747440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\CCERASER.DLL 2010-04-05 23:38 . 2010-03-06 08:40 259440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\ECMSVR32.DLL 2010-04-05 23:38 . 2010-03-06 08:40 102448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100405.023\ERASER.SYS 2010-04-05 21:23 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSvix86.sys 2010-04-05 21:23 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\Scxpx86.dll 2010-04-05 21:23 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSxpx86.dll 2010-04-05 21:23 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSviA64.sys 2010-04-05 21:23 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSXpx86.sys 2010-04-05 20:48 . 2010-02-12 22:41 558448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll 2010-04-05 20:48 . 2010-02-02 00:20 165240 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll 2010-04-05 20:44 . 2010-04-06 01:30 ——– d—–w- c:\users\Adam\AppData\Local\temp 2010-04-05 18:04 . 2010-04-05 19:58 ——– d—–w- c:\program files\ERUNT 2010-04-05 17:02 . 2010-04-05 17:02 0 —-a-w- c:\windows\nsreg.dat 2010-04-05 16:50 . 2010-04-05 16:50 ——– d—–w- c:\users\Adam\AppData\Local\Symantec 2010-04-05 13:02 . 2010-04-05 13:02 ——– d—–w- c:\users\Adam\AppData\Roaming\Malwarebytes 2010-04-05 13:02 . 2010-03-29 19:24 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-05 13:02 . 2010-04-05 13:02 ——– d—–w- c:\programdata\Malwarebytes 2010-04-05 13:02 . 2010-03-29 19:24 20824 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-04-05 13:02 . 2010-04-05 19:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-04-05 12:59 . 2010-04-05 12:59 ——– d—–w- c:\users\Adam\AppData\Local\ElevatedDiagnostics 2010-04-05 01:30 . 2010-03-06 08:40 84912 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVENG.SYS 2010-04-05 01:30 . 2010-03-06 08:40 177520 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVENG32.DLL 2010-04-05 01:30 . 2010-03-06 08:40 1647984 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVEX32A.DLL 2010-04-05 01:30 . 2010-03-06 08:40 1324720 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\NAVEX15.SYS 2010-04-05 01:30 . 2010-03-06 08:40 371248 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\EECTRL.SYS 2010-04-05 01:30 . 2010-03-06 08:40 259440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\ECMSVR32.DLL 2010-04-05 01:30 . 2010-03-06 08:40 102448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\ERASER.SYS 2010-04-05 01:30 . 2010-03-06 08:40 2747440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100404.020\CCERASER.DLL 2010-04-04 16:57 . 2006-09-28 20:05 2414360 —-a-w- c:\windows\system32\d3dx9_31.dll 2010-04-04 16:57 . 2006-09-28 20:04 68888 —-a-w- c:\windows\system32\xinput1_3.dll 2010-04-04 16:56 . 2010-04-04 16:56 ——– d—–w- c:\users\Adam\AppData\Local\Microsoft Game Studios 2010-04-04 16:55 . 2010-04-05 19:58 ——– d—–w- c:\programdata\Microsoft Games 2010-04-04 16:54 . 2010-04-04 16:54 ——– d—–w- c:\users\Adam\AppData\Roaming\Microsoft Game Studios 2010-04-04 00:45 . 2010-04-04 00:45 ——– d—–w- c:\windows\Sun 2010-04-04 00:44 . 2010-04-04 00:44 ——– d—–w- c:\program files\Common Files\Java 2010-04-04 00:42 . 2010-04-04 00:41 411368 —-a-w- c:\windows\system32\deploytk.dll 2010-04-04 00:41 . 2010-04-04 00:41 ——– d—–w- c:\program files\Java 2010-04-02 04:18 . 2010-04-02 04:18 ——– d—–w- c:\programdata\HipSoft 2010-04-02 04:17 . 2010-04-05 16:55 ——– d—–w- c:\program files\LeeGTs Games 2010-04-02 02:14 . 2010-04-02 02:14 ——– d—–w- c:\programdata\Shockwave 2010-04-01 08:24 . 2010-04-01 08:24 ——– d—–w- c:\users\Guest\AppData\Local\Mozilla 2010-03-31 09:01 . 2010-02-23 07:56 977920 —-a-w- c:\windows\system32\wininet.dll 2010-03-30 01:40 . 2010-03-30 01:32 754984 —-a-w- c:\programdata\DivX\Setup\Resource.dll 2010-03-30 01:40 . 2010-03-22 15:36 986904 —-a-w- c:\programdata\DivX\Setup\DivXSetup.exe 2010-03-30 01:40 . 2010-03-30 01:40 56766 —-a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 56978 —-a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 57409 —-a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 53600 —-a-w- c:\programdata\DivX\Update\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 52963 —-a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 54073 —-a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe 2010-03-30 01:40 . 2010-03-30 01:40 ——– d—–w- c:\program files\Common Files\DivX Shared 2010-03-30 01:39 . 2010-03-30 01:40 ——– d—–w- c:\program files\DivX 2010-03-30 01:32 . 2010-03-30 01:41 ——– d—–w- c:\programdata\DivX 2010-03-29 02:46 . 2010-03-29 02:46 ——– d—–w- c:\users\Adam\AppData\Local\Blizzard Entertainment 2010-03-28 22:42 . 2010-03-29 02:27 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment 2010-03-28 22:42 . 2010-03-29 02:27 ——– d—–w- c:\users\Public\Games 2010-03-28 22:33 . 2010-03-28 22:33 ——– d—–w- c:\programdata\Blizzard 2010-03-26 05:57 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSvix86.sys 2010-03-26 05:57 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSXpx86.sys 2010-03-26 05:57 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\Scxpx86.dll 2010-03-26 05:57 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSxpx86.dll 2010-03-26 05:57 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100326.001\IDSviA64.sys 2010-03-26 00:53 . 2001-12-19 15:45 8576 —-a-w- c:\windows\system32\drivers\VCdRom.sys 2010-03-25 22:03 . 2001-12-19 15:45 8576 —-a-w- c:\windows\system32\VCdRom.sys 2010-03-25 21:51 . 2010-03-25 21:51 ——– d—–w- c:\program files\Common Files\Macrovision Shared 2010-03-25 21:50 . 2010-03-28 19:49 ——– d—–w- c:\programdata\Rosetta Stone 2010-03-25 21:50 . 2010-03-25 21:50 ——– d—–w- c:\program files\Rosetta Stone 2010-03-25 07:14 . 2010-03-25 07:14 ——– d—–w- c:\users\Adam\AppData\Local\Diagnostics 2010-03-25 01:18 . 2010-03-25 01:18 ——– d—–w- c:\users\Adam\AppData\Local\VS Revo Group 2010-03-25 01:18 . 2009-12-30 15:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys 2010-03-25 01:17 . 2010-03-25 01:17 ——– d—–w- c:\program files\VS Revo Group 2010-03-24 18:20 . 2010-04-05 19:58 ——– d—–w- C:\Downloads 2010-03-24 18:20 . 2010-04-05 21:08 ——– d—–w- c:\users\Adam\AppData\Roaming\BitComet 2010-03-24 17:59 . 2010-03-24 17:59 ——– d—–w- c:\programdata\Azureus 2010-03-24 17:59 . 2010-03-24 18:12 ——– d—–w- c:\users\Adam\AppData\Roaming\Azureus 2010-03-24 17:55 . 2010-03-24 17:55 ——– d—–w- c:\program files\Common Files\i4j_jres 2010-03-19 12:47 . 2010-02-01 01:45 38784 —-a-w- c:\users\Adam\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-03-19 12:45 . 2010-03-19 12:46 ——– d—–w- c:\program files\Common Files\Adobe 2010-03-19 12:43 . 2010-02-01 01:45 38784 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-03-19 12:43 . 2010-03-19 12:43 ——– d—–w- c:\program files\Common Files\Adobe AIR 2010-03-19 12:41 . 2010-03-19 12:51 ——– d—–w- c:\users\Adam\AppData\Local\Adobe 2010-03-19 12:41 . 2010-03-19 12:41 86016 —-a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe 2010-03-19 12:40 . 2010-03-24 18:06 ——– d—–w- c:\programdata\NOS 2010-03-15 03:18 . 2010-01-30 14:48 266552 —-a-w- c:\windows\system32\HMIPCore.dll 2010-03-14 22:32 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\Scxpx86.dll 2010-03-14 22:32 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSXpx86.sys 2010-03-14 22:32 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSxpx86.dll 2010-03-14 22:31 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSvix86.sys 2010-03-14 22:31 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSviA64.sys 2010-03-12 00:26 . 2010-03-12 01:27 36226 —-a-w- c:\windows\DIIUnin.dat 2010-03-12 00:26 . 2010-03-12 00:26 94208 —-a-w- c:\windows\DIIUnin.exe 2010-03-12 00:26 . 2010-03-12 00:26 2829 —-a-w- c:\windows\DIIUnin.pif 2010-03-11 03:40 . 2010-03-12 01:16 ——– d—–w- c:\program files\Diablo II - Sand Boxed 2010-03-11 02:52 . 2010-04-05 19:58 ——– d—–w- c:\program files\Diablo II 2010-03-09 03:14 . 2010-03-09 03:14 ——– d—–w- c:\users\Adam\AppData\Roaming\Uniblue 2010-03-09 03:06 . 2010-03-09 03:07 ——– d—–w- c:\program files\Direct X 2010-03-09 02:20 . 2009-12-08 11:40 3955288 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-03-09 02:20 . 2009-12-08 11:40 3899464 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-03-09 02:20 . 2009-12-08 11:32 292864 —-a-w- c:\windows\system32\apphelp.dll 2010-03-08 19:08 . 2010-03-08 19:08 ——– d—–w- c:\windows\system32\Macromed 2010-03-08 01:25 . 2010-03-12 01:08 21840 —-atw- c:\windows\system32\SIntfNT.dll 2010-03-08 01:25 . 2010-03-12 01:08 17212 —-atw- c:\windows\system32\SIntf32.dll 2010-03-08 01:08 . 2010-04-05 19:58 ——– d—–w- c:\program files\Sandboxie 2010-03-08 01:03 . 2010-03-08 01:03 57560 —-a-w- c:\users\Adam\AppData\Local\GDIPFONTCACHEV1.DAT 2010-03-07 22:40 . 2010-03-07 23:07 ——– d—–w- c:\program files\Sony 2010-03-07 22:40 . 2010-03-07 22:40 ——– d–h–w- c:\program files\InstallShield Installation Information 2010-03-07 22:39 . 2010-03-07 22:39 ——– d—–w- c:\program files\Common Files\InstallShield 2010-03-07 21:50 . 2010-03-07 21:50 ——– d—–w- c:\programdata\Symantec 2010-03-07 21:42 . 2010-03-07 21:42 ——– d—–w- c:\programdata\Hewlett-Packard 2010-03-07 21:42 . 2009-07-14 01:15 280064 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzppw71.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-04 16:57 . 2009-07-14 04:52 ——– d—–w- c:\program files\Microsoft Games 2010-03-17 03:00 . 2010-03-17 03:00 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2010-03-06 23:26 . 2010-03-06 23:04 ——– d—–w- c:\program files\Common Files\Symantec Shared 2010-03-06 23:05 . 2010-03-06 23:03 ——– d—–w- c:\programdata\Norton 2010-03-06 23:04 . 2010-03-06 23:04 ——– d—–w- c:\program files\Symantec 2010-03-06 23:04 . 2010-03-06 23:04 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF 2010-03-06 23:04 . 2010-03-06 23:04 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT 2010-03-06 23:04 . 2010-03-06 23:04 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2010-03-06 23:04 . 2010-03-06 23:04 25648 —-a-r- c:\windows\system32\drivers\SymIMV.sys 2010-03-06 23:04 . 2010-03-06 23:04 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys 2010-03-06 23:04 . 2010-03-06 23:04 1291104 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll 2010-03-06 23:04 . 2010-03-06 23:04 136840 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll 2010-03-06 23:04 . 2010-03-06 23:04 107368 —-a-r- c:\windows\system32\GEARAspi.dll 2010-03-06 23:04 . 2010-03-06 23:04 776952 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll 2010-03-06 23:04 . 2010-03-06 23:03 ——– d—–w- c:\program files\Norton Security Suite 2010-03-06 23:03 . 2010-03-06 23:03 ——– d—–w- c:\programdata\NortonInstaller 2010-03-06 23:03 . 2010-03-06 23:03 ——– d—–w- c:\program files\NortonInstaller 2010-03-06 22:55 . 2010-03-06 00:28 ——– d—–w- c:\program files\DriverGenius 2010-03-06 01:52 . 2010-03-06 01:52 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf 2010-03-06 00:23 . 2010-03-06 00:23 ——– d—–w- c:\programdata\NVIDIA 2010-03-06 00:23 . 2010-03-06 00:22 ——– d—–w- c:\program files\NVIDIA Corporation 2010-03-06 00:08 . 2010-03-06 00:08 ——– d—–w- c:\program files\SystemRequirementsLab 2010-02-24 14:16 . 2010-03-05 23:39 181632 ——w- c:\windows\system32\MpSigStub.exe 2010-02-02 07:45 . 2010-03-05 23:40 2048 —-a-w- c:\windows\system32\tzres.dll 2010-02-01 01:45 . 2010-03-22 02:41 38784 —-a-w- c:\users\Guest\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-01-18 23:29 . 2010-03-05 23:40 85504 —-a-w- c:\windows\system32\secproc_ssp_isv.dll 2010-01-18 23:29 . 2010-03-05 23:40 85504 —-a-w- c:\windows\system32\secproc_ssp.dll 2010-01-18 23:29 . 2010-03-05 23:40 365568 —-a-w- c:\windows\system32\secproc_isv.dll 2010-01-18 23:29 . 2010-03-05 23:40 369152 —-a-w- c:\windows\system32\secproc.dll 2010-01-18 23:28 . 2010-03-05 23:40 324608 —-a-w- c:\windows\system32\RMActivate_isv.exe 2010-01-18 23:28 . 2010-03-05 23:40 277504 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe 2010-01-18 23:28 . 2010-03-05 23:40 320512 —-a-w- c:\windows\system32\RMActivate.exe 2010-01-18 23:28 . 2010-03-05 23:40 280064 —-a-w- c:\windows\system32\RMActivate_ssp.exe 2010-01-12 04:03 . 2010-03-06 00:22 795104 —-a-w- c:\windows\system32\dpinst.exe 2010-01-12 04:03 . 2010-03-06 00:22 68200 —-a-w- c:\windows\system32\OpenCL.dll 2010-01-12 04:03 . 2010-03-06 00:22 14924392 —-a-w- c:\windows\system32\nvoglv32.dll 2010-01-12 04:03 . 2010-03-06 00:22 11586280 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys 2010-01-12 04:03 . 2010-03-06 00:22 9388648 —-a-w- c:\windows\system32\nvd3dum.dll 2010-01-12 04:03 . 2010-03-06 00:22 4077672 —-a-w- c:\windows\system32\nvcuvenc.dll 2010-01-12 04:03 . 2010-03-06 00:22 4061800 —-a-w- c:\windows\system32\nvcuda.dll 2010-01-12 04:03 . 2010-03-06 00:22 2243176 —-a-w- c:\windows\system32\nvcuvid.dll 2010-01-12 04:03 . 2010-03-06 00:22 182888 —-a-w- c:\windows\system32\nvcod189.dll 2010-01-12 04:03 . 2010-03-06 00:22 182888 —-a-w- c:\windows\system32\nvcod.dll 2010-01-12 04:03 . 2010-03-06 00:22 1280616 —-a-w- c:\windows\system32\nvapi.dll 2010-01-12 04:03 . 2010-03-06 00:22 11639400 —-a-w- c:\windows\system32\nvcompiler.dll 2010-01-12 03:18 . 2010-01-12 03:18 962664 —-a-w- c:\windows\system32\nvsvc.dll 2010-01-12 03:18 . 2010-01-12 03:18 66664 —-a-w- c:\windows\system32\nvshext.dll 2010-01-12 03:18 . 2010-01-12 03:18 13679720 —-a-w- c:\windows\system32\nvcpl.dll 2010-01-12 03:18 . 2010-01-12 03:18 129640 —-a-w- c:\windows\system32\nvvsvc.exe 2010-01-12 03:18 . 2010-01-12 03:18 110696 —-a-w- c:\windows\system32\nvmctray.dll 2010-01-08 03:18 . 2010-03-05 23:42 221184 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-01-08 03:17 . 2010-03-05 23:42 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ((((((((((((((((((((((((((((( SnapShot@2010-04-05_20.40.27 ))))))))))))))))))))))))))))))))))))))))) . + 2010-03-06 00:02 . 2010-04-05 20:50 18948 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 04:55 . 2010-04-05 20:50 40224 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2010-03-06 02:02 . 2010-04-05 12:59 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-06 02:02 . 2010-04-05 23:30 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-06 02:02 . 2010-04-05 23:30 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-03-06 02:02 . 2010-04-05 12:59 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:41 . 2010-04-05 12:59 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:41 . 2010-04-05 23:30 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-03-13 10:11 . 2010-04-06 01:01 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat - 2010-03-13 10:11 . 2010-04-05 20:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat - 2010-03-13 10:11 . 2010-04-05 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat + 2010-03-13 10:11 . 2010-04-06 01:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat - 2010-03-13 10:11 . 2010-04-05 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat + 2010-03-13 10:11 . 2010-04-06 01:01 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat + 2010-03-07 21:43 . 2010-04-06 01:01 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:05 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-03-07 21:43 . 2010-04-05 20:49 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-03-07 21:43 . 2010-04-05 20:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-03-05 23:26 . 2010-04-05 20:50 6446 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3973659962-2508152415-2587932275-1000_UserData.bin - 2010-04-05 19:59 . 2010-04-05 19:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2010-04-05 20:48 . 2010-04-05 20:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2010-04-05 19:59 . 2010-04-05 19:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2010-04-05 20:48 . 2010-04-05 20:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 02:03 . 2010-04-05 20:13 6815744 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT + 2009-07-14 02:03 . 2010-04-05 22:26 6815744 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2010-02-03 394984] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys] @="FSFilter Activity Monitor" R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SYMEFA.SYS [2010-03-06 310320] S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2010-03-06 259632] S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2010-03-06 482432] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100402.001\IDSvix86.sys [2009-10-28 343088] S1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\System32\drivers\VCdRom.sys [2001-12-19 8576] S2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe [2010-03-06 117640] S3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\N360\0308000.029\SYMNDISV.SYS [2010-03-06 48688] — Other Services/Drivers In Memory — *Deregistered* - EraserUtilDrvI9 . . ——- Supplementary Scan ——- . FF - ProfilePath - c:\users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\lb18vm8m.default\ FF - prefs.js: browser.startup.homepage - hxxp://forums.whatthetech.com/Infections_Removal_f27.html FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll —- FIREFOX POLICIES —- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360] "ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2010-04-05 21:37:26 ComboFix-quarantined-files.txt 2010-04-06 01:37 ComboFix2.txt 2010-04-06 00:26 Pre-Run: 55,107,416,064 bytes free Post-Run: 54,186,119,168 bytes free - - End Of File - - E7E7C35E21F25BDA6B928AD4A702F381

LDTate

Post #10April 6, 2010, 1:42 AM UTC

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.

-Adam.

Post #11April 6, 2010, 8:28 AM UTC last edited April 6, 2010, 8:30 AM UTC

Sorry it took so long to reply ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=a8cede943135494bbc61080bbae3cc2d # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-04-06 04:42:42 # local_time=2010-04-06 12:42:42 (-0500, Eastern Daylight Time) # country="United States" # lang=9 # osver=6.1.7600 NT # compatibility_mode=3589 16777213 80 100 0 6330656 0 0 # compatibility_mode=5893 16776574 100 94 1917327 22065900 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=219694 # found=0 # cleaned=0 # scan_time=7852 EDIT: also this took a really long time to finish. the 2ed time, the first time it never finished. Thanks -Adam.

LDTate

Post #12April 6, 2010, 12:25 PM UTC

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:
You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve performance.

-Adam.

Post #13April 6, 2010, 2:06 PM UTC

ooook. did as instructed. Rebooted. Computer is running better. however i am now i am being asked to download setup_1770.exe from google.com

LDTate

Post #14April 6, 2010, 2:13 PM UTC

What is: setup_1770.exe?

-Adam.

Post #15April 6, 2010, 2:18 PM UTC

i dont know. thats what google is redirecting me to download.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] browser redirect

✨ Ask AI

Ask AI