This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Removing OTL, GMER, etc

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi, I was in here a few weeks back with my computer infected and I had someone helping me, but my computer kept giving me problems and I kept having trouble getting online. Well when I finally did my topic was closed. I know usually when you have helped sum one and their computer is cleaned you give them instructions on how to remove all the tools you used to clean it. Well I have several things on mine that were used to clean it up and I need to remove them. I know I can probably just delete them off my desktop but I'm not sure that is completely removing them from my system so I would really appreciate it if sum one could tell me how to remove them. I'm gonna list the things below that are still on it. Thanks! OTL Gmer HAMeb_check Helpasst_mebroot_fix
Hi

:welcome:

I'm martix and I'll be glad to assist you fix your problem.
Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
This may cause a delay in response time, but I will do my best to keep it as short as possible. I will reply back shortly with instructions.
Hi clgray75,

Before I proceed with an unistallation I would like to check what exactly is on your PC so please follow my instructions:

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt and Attach.txt report in your next reply
DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 22:50:42.46 on Fri 05/07/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.468 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\system32\agrsmsvc.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdkserv.exe C:\WINDOWS\system32\lxdkcoms.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\svchost.exe -k netsvcs C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Acer\Empowering Technology\eRecovery\eRAgent.exe C:\Program Files\Lexmark 5300 Series\lxdkamon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\IncrediMail\bin\IncMail.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PeoplePC\ISP8130\Browser\Bartshel.exe C:\Program Files\PhotoJoy\bin\PjApp.exe C:\PROGRA~1\PeoplePC\ISP8130\Browser\PPShared.exe C:\Program Files\IncrediMail\bin\IMApp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Christina\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://mystart.incredimail.com/ uSearch Page = uSearch Bar = hxxp://home.peoplepc.com/search mSearchAssistant = hxxp://home.peoplepc.com/search uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Accelerator Plugin: {656ec4b7-072b-4698-b504-2a414c1f0037} - c:\progra~1\people~1\PRPL_I~1.DLL BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: PeoplePal Toolbar: {a8fb8eb3-183b-4598-924d-86f0e5e37085} - c:\program files\peoplepc\toolbar\PPCToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: PeoplePal Toolbar: {a8fb8eb3-183b-4598-924d-86f0e5e37085} - c:\program files\peoplepc\toolbar\PPCToolbar.dll TB: {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - No File TB: {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - No File TB: {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - No File uRun: [IncrediMail] c:\program files\incredimail\bin\IncMail.exe /c uRun: [PhotoJoy] c:\program files\photojoy\bin\PhotoJoy.exe /c uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [BkupTray] "c:\program files\newtech infosystems\nti backup now 5\BkupTray.exe" mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe" mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0" mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter" mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [eRecoveryService] c:\acer\empowering technology\erecovery\eRAgent.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [lxdkmon.exe] "c:\program files\lexmark 5300 series\lxdkmon.exe" mRun: [lxdkamon] "c:\program files\lexmark 5300 series\lxdkamon.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Bart Station] c:\program files\peoplepc\isp8130\bin\PPCOLink.exe -STATION dRun: [IncrediMail] c:\program files\incredimail\bin\IncMail.exe /c StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Google Sidewiki… IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\christina\start menu\programs\imvu\Run IMVU.lnk IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: motive.com\patttbc.att DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} - hxxp://www.auctiva.com/Aurigma/ImageUploader55.cab DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12 ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\christ~1\applic~1\mozilla\firefox\profiles\em6shvh6.default\ FF - prefs.js: browser.search.selectedEngine - MyStart Search FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredimail.com/ FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar_im2_test_v2&search;= FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ —- FIREFOX POLICIES —- FF - user.js: protocol-handler.warn-external.dnUpdate - falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384] R2 lxdk_device;lxdk_device;c:\windows\system32\lxdkcoms.exe -service –> c:\windows\system32\lxdkcoms.exe -service [?] R2 lxdkCATSCustConnectService;lxdkCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdkserv.exe [2009-4-13 99248] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-7 50424] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-4 131072] S3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [2009-3-23 31128] S3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2009-3-23 257304] S3 PRISM_USB;IEEE 802.11 Wireless USB Driver;c:\windows\system32\drivers\ExpsUSB.sys [2010-2-20 609792] =============== Created Last 30 ================ 2010-05-07 13:11:38 0 d—–w- c:\docume~1\christ~1\applic~1\PeoplePal 2010-05-07 07:39:47 0 d—–w- c:\docume~1\christ~1\applic~1\AVG8 2010-05-07 07:13:24 0 d—–w- c:\docume~1\alluse~1\applic~1\PhotoMail 2010-05-07 07:13:22 0 d—–w- c:\program files\PhotoMail Maker 2010-05-06 18:57:59 0 d—–w- c:\docume~1\alluse~1\applic~1\PeoplePC 2010-05-06 07:17:37 0 d—–w- c:\docume~1\christ~1\applic~1\PeoplePC Online 2010-05-06 07:17:36 0 d—–w- c:\docume~1\alluse~1\applic~1\PeoplePC Online 2010-05-06 03:28:55 0 d—–w- c:\program files\PeoplePC Accelerated 2010-05-06 03:25:16 911 ——w- c:\windows\system32\unPPC6000.exe.manifest 2010-05-06 03:25:16 909 ——w- c:\windows\system32\PPCClean.exe.manifest 2010-05-06 03:25:16 69464 ——w- c:\windows\system32\unPPC6000.exe 2010-05-06 03:25:16 61440 ——w- c:\windows\system32\ppcpanel.cpl 2010-05-06 03:25:16 57168 ——w- c:\windows\system32\PPCOUNIN.exe 2010-05-06 03:25:16 40624 ——w- c:\windows\system32\PPCClean.exe 2010-05-06 03:25:16 29016 ——w- c:\windows\system32\PopWait.exe 2010-05-06 03:25:16 255320 ——w- c:\windows\system32\PPCInfo.exe 2010-05-06 03:25:16 0 d—–w- c:\program files\PeoplePC 2010-05-06 03:25:16 0 d—–w- c:\program files\common files\PeoplePC ==================== Find3M ==================== 2010-03-28 01:08:26 9728 —-a-w- c:\windows\system32\rnaph.dll 2010-03-20 03:09:20 96512 ——w- c:\windows\system32\drivers\atapi.sys 2010-03-15 04:17:20 503816 —-a-w- c:\docume~1\alluse~1\applic~1\phn.dat 2010-03-12 22:02:38 261632 —-a-w- c:\windows\PEV.exe 2010-03-10 06:15:52 420352 —-a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:24:37 916480 —-a-w- c:\windows\system32\wininet.dll 2010-02-24 03:20:07 10920 —-a-w- C:\aolconnfix.exe 2010-02-16 14:08:49 2146304 ——w- c:\windows\system32\ntoskrnl.exe 2010-02-16 13:25:04 2024448 ——w- c:\windows\system32\ntkrnlpa.exe 2010-02-12 04:33:11 100864 —-a-w- c:\windows\system32\6to4svc.dll 2010-01-25 20:27:14 32768 –sha-w- c:\windows\system32\config\systemprofile\application data\microsoft\internet explorer\userdata\index.dat 2008-10-29 01:14:20 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat ============= FINISH: 22:51:23.01 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-03-17.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 3/7/2009 7:08:40 PM System Uptime: 5/7/2010 8:12:38 PM (2 hours ago) Motherboard: eMachines | | WMCP61M Processor: AMD Athlon™ Processor 2650e | Socket AM2 | 1607/201mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 69 GiB total, 6.986 GiB free. D: is FIXED (NTFS) - 70 GiB total, 69.784 GiB free. E: is CDROM () F: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP50: 2/9/2010 9:14:47 PM - System Checkpoint RP51: 2/9/2010 10:55:58 PM - Installed LAN-Express IEEE 802.11b WLAN RP52: 2/9/2010 11:23:32 PM - Removed LAN-Express IEEE 802.11b WLAN RP53: 2/10/2010 1:26:11 AM - Installed BellSouth® Scan and Clean Tool RP54: 2/17/2010 9:17:34 PM - System Checkpoint RP55: 2/20/2010 9:17:23 PM - Installed LAN-Express IEEE 802.11b WLAN RP56: 2/23/2010 6:53:18 PM - System Checkpoint RP57: 2/24/2010 7:03:47 PM - System Checkpoint RP58: 2/25/2010 3:00:15 AM - Software Distribution Service 3.0 RP59: 2/27/2010 4:50:30 PM - System Checkpoint RP60: 2/28/2010 8:51:43 PM - System Checkpoint RP61: 3/1/2010 11:11:41 PM - System Checkpoint RP62: 3/3/2010 12:24:24 PM - System Checkpoint RP63: 3/4/2010 6:42:14 PM - System Checkpoint RP64: 3/5/2010 10:18:44 PM - System Checkpoint RP65: 3/6/2010 10:39:03 PM - System Checkpoint RP66: 3/7/2010 10:49:09 PM - System Checkpoint RP67: 3/8/2010 11:12:42 PM - System Checkpoint RP68: 3/10/2010 1:08:21 AM - System Checkpoint RP69: 3/11/2010 5:17:54 PM - System Checkpoint RP70: 3/12/2010 5:53:37 PM - System Checkpoint RP71: 3/13/2010 10:13:03 PM - Removed Trend Micro Internet Security RP72: 3/13/2010 11:34:13 PM - Installed Trend Micro Internet Security RP73: 3/13/2010 11:44:52 PM - Removed Trend Micro Internet Security RP74: 3/14/2010 7:34:19 PM - Installed AVG 9.0 RP75: 3/14/2010 7:44:25 PM - Installed AVG 9.0 RP76: 3/14/2010 8:30:02 PM - Avg Update RP77: 3/15/2010 9:52:02 PM - System Checkpoint RP78: 3/16/2010 8:25:56 PM - Avg Update RP79: 3/16/2010 10:59:05 PM - Restore Operation RP80: 3/16/2010 11:16:16 PM - Restore Operation RP81: 3/17/2010 7:42:44 PM - Restore Operation RP82: 3/19/2010 11:38:04 PM - System Checkpoint RP83: 3/20/2010 4:25:39 AM - Software Distribution Service 3.0 RP84: 3/21/2010 4:01:41 AM - Software Distribution Service 3.0 RP85: 3/21/2010 8:48:43 PM - Software Distribution Service 3.0 RP86: 3/22/2010 9:50:47 PM - System Checkpoint RP87: 3/23/2010 10:37:40 PM - System Checkpoint RP88: 3/24/2010 11:24:55 PM - System Checkpoint RP89: 3/26/2010 8:16:53 PM - System Checkpoint RP90: 3/27/2010 10:00:27 PM - System Checkpoint RP91: 3/28/2010 10:02:59 PM - System Checkpoint RP92: 3/30/2010 12:15:31 AM - System Checkpoint RP93: 4/1/2010 7:41:03 PM - System Checkpoint RP94: 4/1/2010 8:39:45 PM - Avg Update RP95: 4/1/2010 8:49:31 PM - Avg Update RP96: 4/3/2010 12:40:08 AM - System Checkpoint RP97: 4/4/2010 8:53:55 PM - System Checkpoint RP98: 4/7/2010 1:21:17 AM - System Checkpoint RP99: 4/9/2010 11:03:08 PM - System Checkpoint RP100: 4/11/2010 9:52:42 PM - System Checkpoint RP101: 4/12/2010 11:20:13 PM - System Checkpoint RP102: 4/15/2010 12:36:03 AM - System Checkpoint RP103: 4/15/2010 1:11:28 AM - Software Distribution Service 3.0 RP104: 4/16/2010 1:24:12 AM - System Checkpoint RP105: 4/17/2010 3:00:16 AM - Software Distribution Service 3.0 RP106: 4/19/2010 10:04:02 AM - System Checkpoint RP107: 4/23/2010 1:35:18 AM - System Checkpoint RP108: 5/3/2010 10:38:54 PM - System Checkpoint RP109: 5/5/2010 3:30:54 AM - Removed Compatibility Pack for the 2007 Office system RP110: 5/6/2010 2:49:32 AM - Configured BellSouth® Scan and Clean Tool RP111: 5/6/2010 2:53:09 AM - Removed AVG 9.0 RP112: 5/6/2010 2:54:57 AM - Installed AVG 9.0 RP113: 5/6/2010 3:00:14 AM - Software Distribution Service 3.0 RP114: 5/6/2010 3:15:54 PM - Software Distribution Service 3.0 RP115: 5/7/2010 8:38:51 PM - System Checkpoint ==== Installed Programs ====================== Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 8.1.6 Agere Systems PCI-SV92EX Soft Modem AOL You've Got Pictures Screensaver CCScore Critical Update for Windows Media Player 11 (KB959772) CyberLink DVD Suite CyberLink Power2Go CyberLink PowerDVD DivX Plus Web Player DVD Shrink 3.2 eMachines Games ESSBrwr ESSCDBK ESScore ESSgui ESSini ESSPCD ESSPDock ESSTOOLS essvatgt FrostWire 4.20.1 GearDrvs HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB932716-v2) Hotfix for Windows XP (KB945060-v3) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) IncrediMail IncrediMail 2.0 Java™ 6 Update 17 KODAK Camera Connection Software Help Kodak EasyShare software KODAK Memory Albums KODAK One Touch to Better Pictures LAN-Express IEEE 802.11b WLAN Lexmark 5300 Series LightScribe 1.4.142.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office Home and Student 2007 Trial Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works Mozilla Firefox (3.6) MSN MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) netbrdg NTI Backup Now 5 NTI Backup Now Standard NTI Media Maker 8 NVIDIA Drivers OfotoXMI Panda Internet Security 2010 PeoplePC Online PeoplePC Simple Switch PeoplePC:PeoplePal Toolbar 7.3 PhotoJoy PhotoMail Maker QuickTime Realtek High Definition Audio Driver Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB978380) Security Update for Microsoft Office Excel 2007 (KB978382) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Internet Explorer 8 (KB974455) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Internet Explorer 8 (KB978207) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165-v2) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB980232) SFR SHASTA skin0001 SKINXSDK Spybot - Search & Destroy staticcr tooltips Update for 2007 Microsoft Office System (KB967642) Update for 2007 Microsoft Office System (KB981715) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office InfoPath 2007 (KB976416) Update for Microsoft Office OneNote 2007 (KB980729) Update for Windows Internet Explorer 8 (KB968220) Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB976749) Update for Windows Internet Explorer 8 (KB980182) Update for Windows XP (KB898461) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VC80CRTRedist - 8.0.50727.4053 VideoLAN VLC media player 0.8.6d VPRINTOL WebFldrs XP Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Media Format 11 runtime Windows Media Player 11 WIRELESS Yahoo! Install Manager Yahoo! Messenger Yahoo! Software Update Yahoo! Toolbar ==== Event Viewer Messages From Past Week ======== 5/6/2010 3:15:27 AM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 805bc4fd, parameter3 bac1fce4, parameter4 00000000. 5/6/2010 2:56:48 AM, error: System Error [1003] - Error code 000000ea, parameter1 83c9fb88, parameter2 84ee1920, parameter3 850488e0, parameter4 00000001. 5/5/2010 3:31:28 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found. ==== End Of File ===========================
Hi,
Lets make some housekeeping!
  • Click START then RUN
  • Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

🖼Click to load external image (Posted Image)


Now to remove most of the tools that has been used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.
To remove Helpast please:

Go to Start > Run > copy/paste the bolded command into the run box –> OK

helpasst -cleanup

That is all! Do you have any questions or we can mark this topic as Resolved?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI