What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Antivirus XP

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello whatthetech,

I've come back from holiday to find my parent's laptop in a bit of a state. Unfortunately they fell for all of Antivirus XP's prompts to click here and click there and it's gotten a bit nasty.
I should have consulted people here first but I did download Malwarebytes anti Malware and Windows Defender (a little too late!) and for about a day there was no sign of Antivirus XP, it seems to come up very randomly and as I type it isn't giving me any bother, however the laptop remains VERY sluggish indeed.
I should also mention that after installing Windows updates, upon restarting the mousepad and keyboard are no longer functional. I don't know if this is related. Sorry I can't give anymore relevant information, my parents aren't the most tech savvy in the world!

Here are the logs and thankyou so so much in advance, I really would appreciate any help you can offer.


DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 18:52:09.10 on 23/04/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.222.21 [GMT 1:00]

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Documents and Settings\clive hutchison\Local Settings\Application Data\ave.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Documents and Settings\clive hutchison\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.msn.co.uk
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Toshiba Hotkey Utility] "c:\program files\toshiba\windows utilities\Hotkey.exe" /lang en
mRun: [TPSMain] TPSMain.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
mRun: [PadTouch] c:\program files\toshiba\touch and launch\PadExe.exe
mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,_RunDLLEntry@16
mRun: [dlccmon.exe] "c:\program files\dell photo aio printer 924\dlccmon.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
StartupFolder: c:\docume~1\cliveh~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office11\ONENOTEM.EXE
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\cliveh~1\applic~1\mozilla\firefox\profiles\g9cnpr7o.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - component: c:\documents and settings\clive hutchison\application data\mozilla\firefox\profiles\g9cnpr7o.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============


============== File Associations ===============

.exe=secfile

=============== Created Last 30 ================

2010-04-22 22:18:46 0 d—–w- c:\program files\MSECache
2010-04-22 18:47:59 0 d—–w- c:\windows\ie8updates
2010-04-22 18:31:43 353792 -c—-w- c:\windows\system32\dllcache\srv.sys
2010-04-22 18:19:37 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll
2010-04-22 18:18:16 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2010-04-22 18:18:15 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll
2010-04-22 18:16:00 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-04-22 18:16:00 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-04-22 18:15:59 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-04-22 18:15:59 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-04-22 18:15:54 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-04-22 18:13:42 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2010-04-22 17:53:17 0 d—–w- c:\docume~1\cliveh~1\applic~1\Malwarebytes
2010-04-22 17:52:59 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-22 17:52:56 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-04-22 17:52:50 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-22 17:52:50 0 d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-20 16:39:15 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-04-20 16:16:23 0 d—–w- c:\windows\system32\scripting
2010-04-20 16:16:21 0 d—–w- c:\windows\l2schemas
2010-04-20 16:16:20 0 d—–w- c:\windows\system32\en
2010-04-20 16:16:20 0 d—–w- c:\windows\system32\bits
2010-04-20 16:09:00 0 d—–w- c:\windows\network diagnostic
2010-04-20 15:47:33 21504 —-a-w- c:\windows\system32\hidserv.dll
2010-04-20 15:47:19 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-04-20 15:36:32 0 d-sh–w- c:\documents and settings\clive hutchison\IETldCache
2010-04-20 15:22:43 0 dc-h–w- c:\windows\ie8
2010-04-18 18:30:27 0 d—–w- c:\docume~1\alluse~1\applic~1\avG
2010-04-18 18:02:03 552 —-a-w- c:\windows\system32\d3d8caps.dat
2010-04-18 18:01:59 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-04-14 21:26:26 455680 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-29 21:43:17 0 d—–w- c:\documents and settings\clive hutchison\Tracing

==================== Find3M ====================

2010-04-21 10:42:20 24576 —-a-w- c:\windows\system32\drivers\kbdclass.sys
2010-03-10 06:15:52 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24:37 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11:07 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 08:10:28 2189952 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25:04 2066816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03:03 293376 ——w- c:\windows\system32\browserchoice.exe
2010-02-12 04:33:11 100864 —-a-w- c:\windows\system32\6to4svc.dll

============= FINISH: 18:54:12.06 ===============







GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-24 18:17:13
Windows 5.1.2600 Service Pack 3
Running: 1u9f7yu8.exe; Driver: C:\DOCUME~1\CLIVEH~1\LOCALS~1\Temp\kwaorpob.sys


—- Kernel code sections - GMER 1.0.15 —-

.rsrc C:\WINDOWS\system32\DRIVERS\kbdclass.sys entry point in ".rsrc" section [0xFA245E14]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\svchost.exe[972] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 006D000A
.text C:\WINDOWS\System32\svchost.exe[972] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 006E000A
.text C:\WINDOWS\System32\svchost.exe[972] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 006C000C
.text C:\WINDOWS\System32\svchost.exe[972] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 01DE000A
.text C:\WINDOWS\System32\svchost.exe[972] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 01D0000A
.text C:\WINDOWS\Explorer.EXE[1928] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B7000A
.text C:\WINDOWS\Explorer.EXE[1928] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00BD000A
.text C:\WINDOWS\Explorer.EXE[1928] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B6000C
.text C:\WINDOWS\system32\wuauclt.exe[2012] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0092000A
.text C:\WINDOWS\system32\wuauclt.exe[2012] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0093000A
.text C:\WINDOWS\system32\wuauclt.exe[2012] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0091000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[3180] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0131000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3180] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0132000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3180] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0130000C

—- Devices - GMER 1.0.15 —-

Device -> \Driver\atapi \Device\Harddisk0\DR0 FFB0EAC8

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\DRIVERS\kbdclass.sys suspicious modification
File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-




THANKYOU!
Tyrone

Attachments:

Post #2 last edited
Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

1.Please do not run any other tool untill instructed to do so!
2.Please reply to this thread, do not start another!
3.Please tell me about any problems that have occurred during the fix.
4.Please tell me of any other symptoms you may be having as these can help also.
5.Please try as much as possible not to run anything while executing a fix.

If you follow these instructions, everything should go smoothly.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Scan with exeHelper:

Please download exeHelper to your desktop.

  • Double-click on exeHelper.com to run the fix.
  • A black window should pop up, press any key to close once the fix is completed.
  • Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Run Combofix:

Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode.
This allows us to more easily help you should your computer have a problem after an attempted removal of malware.
It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.
Please continue as follows:

  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the report in your next post:

C:\ComboFix.txt

"information and logs"

  • In your next post I need the following

  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
Post #3
Hello Gringo, thankyou for your reply!

I followed your instructions and everything appears to have gone according to plan, here are the logs.

exeHelper by Raktor
Build 20100414
Run at 15:40:02 on 04/25/10
Now searching…
Checking for numerical processes…
Checking for sysguard processes…
Checking for bad processes…
Checking for bad files…
Checking for bad registry entries…
Resetting filetype association for .exe
Removing HKCR\secfile
Resetting filetype association for .com
Removing HKCR\secfile
Resetting userinit and shell values…
Resetting policies…
–Finished–

ComboFix 10-04-21.01 - clive hutchison 25/04/2010 16:09:17.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.222.14 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

Infected copy of c:\windows\system32\drivers\kbdclass.sys was found and disinfected
Restored copy from - Kitty had a snack :P
.
((((((((((((((((((((((((( Files Created from 2010-03-25 to 2010-04-25 )))))))))))))))))))))))))))))))
.

2010-04-24 08:07 . 2010-04-24 08:07 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-04-23 17:44 . 2010-04-23 17:46 ——– d—–w- c:\program files\ERUNT
2010-04-22 22:18 . 2010-04-22 23:06 ——– d—–w- c:\program files\MSECache
2010-04-22 18:47 . 2010-04-22 18:47 ——– d—–w- c:\windows\ie8updates
2010-04-22 18:31 . 2009-12-31 16:50 353792 -c—-w- c:\windows\system32\dllcache\srv.sys
2010-04-22 18:19 . 2009-07-10 13:27 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll
2010-04-22 18:18 . 2009-10-15 16:28 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2010-04-22 18:18 . 2009-10-15 16:28 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll
2010-04-22 18:16 . 2010-02-25 06:24 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-04-22 18:16 . 2010-02-25 06:24 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-04-22 18:15 . 2010-02-25 06:24 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-04-22 18:15 . 2010-02-25 06:24 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-04-22 18:15 . 2010-02-25 06:24 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-04-22 18:13 . 2008-10-15 16:34 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2010-04-22 17:53 . 2010-04-22 17:53 ——– d—–w- c:\documents and settings\clive hutchison\Application Data\Malwarebytes
2010-04-22 17:52 . 2010-03-29 23:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-22 17:52 . 2010-04-22 17:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-22 17:52 . 2010-04-22 18:03 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-22 17:52 . 2010-03-29 23:45 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-20 16:39 . 2010-02-24 09:16 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-04-20 16:16 . 2010-04-20 16:16 ——– d—–w- c:\windows\system32\scripting
2010-04-20 16:16 . 2010-04-20 16:16 ——– d—–w- c:\windows\l2schemas
2010-04-20 16:16 . 2010-04-20 16:16 ——– d—–w- c:\windows\system32\en
2010-04-20 16:16 . 2010-04-20 16:16 ——– d—–w- c:\windows\system32\bits
2010-04-20 15:47 . 2008-04-14 00:11 21504 —-a-w- c:\windows\system32\hidserv.dll
2010-04-20 15:47 . 2008-04-13 18:39 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-04-20 15:42 . 2010-04-20 15:42 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-04-20 15:36 . 2010-04-20 15:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-04-20 15:36 . 2010-04-20 15:36 ——– d-sh–w- c:\documents and settings\clive hutchison\IETldCache
2010-04-20 15:22 . 2010-04-20 15:26 ——– dc-h–w- c:\windows\ie8
2010-04-20 15:07 . 2010-04-20 15:07 ——– d—–w- c:\program files\Windows Defender
2010-04-19 22:37 . 2010-04-19 22:37 ——– d—–w- c:\documents and settings\clive hutchison\Local Settings\Application Data\avG
2010-04-18 18:30 . 2010-04-18 18:30 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\avG
2010-04-18 18:30 . 2010-04-18 18:30 ——– d—–w- c:\documents and settings\All Users\Application Data\avG
2010-04-18 18:07 . 2010-04-18 18:07 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-04-18 18:02 . 2010-04-18 18:02 552 —-a-w- c:\windows\system32\d3d8caps.dat
2010-04-18 18:01 . 2010-04-20 12:16 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-04-18 17:16 . 2010-04-18 17:17 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-14 21:26 . 2010-02-24 13:11 455680 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-29 21:43 . 2010-04-25 13:56 ——– d—–w- c:\documents and settings\clive hutchison\Tracing

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 10:54 . 2004-08-03 22:58 24576 —-a-w- c:\windows\system32\drivers\kbdclass.sys
2010-04-23 09:29 . 2006-11-12 18:32 37592 —-a-w- c:\documents and settings\clive hutchison\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-20 16:25 . 2006-02-15 14:25 86995 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-04-20 13:46 . 2007-11-22 18:19 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-19 22:37 . 2007-08-28 17:55 ——– d—–w- c:\program files\Dl_cats
2010-04-18 18:08 . 2007-10-08 15:11 ——– d—–w- c:\program files\Google
2010-03-27 14:31 . 2006-02-16 13:55 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-03-26 08:08 . 2006-02-16 13:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-03-10 06:15 . 2006-02-15 13:09 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24 . 2006-02-15 13:09 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2006-02-15 13:09 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 08:10 . 2006-02-15 13:09 2189952 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-03 22:59 2066816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 10:03 . 2010-03-06 17:03 293376 ——w- c:\windows\system32\browserchoice.exe
2010-02-12 04:33 . 2006-02-15 13:09 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2006-02-15 13:09 226880 —-a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 65536]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-08 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]
"Toshiba Hotkey Utility"="c:\program files\Toshiba\Windows Utilities\Hotkey.exe" [2006-01-28 1589248]
"TPSMain"="TPSMain.exe" [2006-02-08 266240]
"NDSTray.exe"="NDSTray.exe" [BU]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-05-12 118784]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-12-21 1077330]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-06-07 69632]
"dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 425984]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]

c:\documents and settings\rita hutchison\Start Menu\Programs\Startup\
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]

c:\documents and settings\clive hutchison\Start Menu\Programs\Startup\
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Toshiba\\ConfigFree\\CFXFER.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [15/02/2006 21:53 225792]
.
Contents of the 'Scheduled Tasks' folder

2010-04-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.msn.co.uk
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\clive hutchison\Application Data\Mozilla\Firefox\Profiles\g9cnpr7o.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - component: c:\documents and settings\clive hutchison\Application Data\Mozilla\Firefox\Profiles\g9cnpr7o.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-25 16:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-04-25 16:26:12
ComboFix-quarantined-files.txt 2010-04-25 15:26

Pre-Run: 26,831,831,040 bytes free
Post-Run: 26,947,706,880 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - D064B643C6B3B5BCE91AE19D59E8C7D5


There is no sign of Antivirus XP or any google redirects, the keyboard and mousepad still aren't working. I'm not sure if this is related but it did happen during the virus' stay, I looked in device manager and this is the message displayed:

Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)

Could the virus be responsible? Is there anything else lurking about that I need to get rid of?

Thankyou so much for your help, I am indebted.

Tyrone
Post #4
Greetings TYRONE

"There is no sign of Antivirus XP or any google redirects",
that is good news!!

"the keyboard and mousepad still aren't working."
when we are finished and if it still does not work I will send you to the tech side and they should be able to fix it


Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..


uninstall some programs

1. click on start
2. then go to settings
3. after that you need control panel
4. look for the icon add/remove programs
click on the following programs

Adobe Reader 8.1.2
J2SE Runtime Environment 5.0 Update 6


and click on remove

Update Adobe Reader

Recently there have been vunerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

If you don't like Adobe Reader (33.5 MB), you can download Foxit PDF Reader(3.5MB) from here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.

Note: When installing FoxitReader, be carefull not to install anything to do with AskBar.

Your Java is out of date.

Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 20 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 20 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u20 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


TFC(Temp File Cleaner):

  • Please download TFC to your desktop,
  • Save any unsaved work. TFC will close all open application windows.
  • Double-click TFC.exe to run the program.
  • If prompted, click "Yes" to reboot.
Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

: Malwarebytes' Anti-Malware :

  • Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

:Kaspersky scan:

  • Please go to Kaspersky website and perform an online antivirus scan.

    • Read through the requirements and privacy statement and click on Accept button.
    • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    • When the downloads have finished, click on Settings.
    • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.

"information and logs"

  • In your next post I need the following

  • Log From MBAM
  • Log From Kaspersky
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
Post #5
Hello again! I had some issues with the kaspersky online scanner, it got about halfway through the scan and didn't get any further, I tried it again and pretty much the same thing happened. I will try one last time to see if it works and i'll let you know the result. The laptop is running incredibly slowly at times, though I note it's getting quite old now, hopefully once it's "clean", defragmenting and removing any removing unwanted programs might help slightly? Here's the mbam scan: Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 4040 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 26/04/2010 20:05:24 mbam-log-2010-04-26 (20-05-24).txt Scan type: Quick scan Objects scanned: 119996 Time elapsed: 6 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\clive hutchison\Local Settings\Application Data\ave.exe" /START "firefox.exe") Good: (firefox.exe) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\clive hutchison\Local Settings\Application Data\ave.exe" /START "iexplore.exe") Good: (iexplore.exe) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\clive hutchison\Local Settings\Application Data\ave.exe" /START "firefox.exe -safe-mode") Good: (firefox.exe -safe-mode) -> No action taken. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Thankyou thankyou thankyou! Tyrone
Post #6
Hello

if you still have problems with kaspersky try this one


Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.

gringo
Post #7
Hello

three day bump

It has been Three days since my last post.

  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 24hrs you have not replied to this thread then it will have to be closed!

Gringo

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI