What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Microsoft did not Fix

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Satchfan, Sorry for the delay. I kept on going to the site and refreshing the page but did not see any response. I later found out another page was automatically started so did not see your response for awhile. I ran ESET. It found one Trojan. I cannot find the log.for ESET. I looked on my desktop where I saved the original ESET. I then did a search for "ESET log". It just found a chinese language log. I then copy and pasted the file you said it was located. It found over 52000 files until I stopped it. I also could not restart Avast. GB
Post #2
Hi gbsk

Please Note: To make sure you are notified when I reply to this topic, please click on "Track This Topic" at the top right of your original thread.


Please check these locations: one of them is where your Eset log should be:

C:\Program Files\EsetOnlineScanner\log.txt

OR

C:\Program Files\ESET\log.txt

When you locate it, please send it with your next reply.

Satchfan
Post #3
Satchfan, I did a search and found it with the last file you had. ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=1fd18f613e92894e9b7b6d5bda9d197a # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-05-21 05:10:23 # local_time=2010-05-21 09:10:23 (-0900, Alaskan Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=512 16777215 100 0 3688465 3688465 0 0 # compatibility_mode=768 16777175 100 0 10076810 10076810 0 0 # compatibility_mode=3073 16777214 0 89 24832201 24835036 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=90966 # found=1 # cleaned=0 # scan_time=13601 C:\Program Files\PowerTools Lite\Backups\0001D9\35217071-261c0e95
Post #4
Satchfan, I clicked on Options and clicked to track this topic. Here is the error message I got. Sorry, an error occurred. If you are unsure on how to use a feature, or don't know why you got this error message, try looking through the help files for more information. The error returned was: You are already subscribed to this topic or forum.
Post #5
Hi gbsk

Sorry, an error occurred. If you are unsure on how to use a feature, or don't know why you got this error message, try looking through the help files for more information.
The error returned was:

You are already subscribed to this topic or forum.

That means that you will automatically be informed when there is a reply for you and the link to the current topic will be in the message.

The previous links you had will no longer work, so only use the current one contained in the e-mail message.


Submit a file to VirusTotal

Go to VirusTotal and submit this file for analysis:

C:\Program Files\PowerTools Lite\Backups\0001D9\35217071-261c0e95

To do this:• Click on Browse
• Click on the arrow and choose Local Disc (C:)
🖼Click to load external image (Posted Image)
• Below, double-click on Program Files
• Double-click on the PowerTools Litefolder, the Backups folder and then the 0001D9 folder
• Locate the file 35217071-261c0e95, click on it and then on Open
• Click on Send File.
You will get a report back, post the report into this thread for me to see.

Is Avast now OK? It should have returned after a reboot?

Satchfan
Post #6
Satchfan I did not see any "Browse " on the site. I did submit the file and this report apppeared on the screen. I copied it. here it is. I could not save the report. File 35217071-261c0e95 received on 2010.05.25 10:54:41 (UTC) Current status: finished Result: 11/41 (26.83%) Compact Print results Antivirus Version Last Update Result a-squared 4.5.0.50 2010.05.10 - AhnLab-V3 2010.05.25.00 2010.05.25 - AntiVir 8.2.1.242 2010.05.25 - Antiy-AVL 2.0.3.7 2010.05.25 - Authentium 5.2.0.5 2010.05.25 - Avast 4.8.1351.0 2010.05.25 - Avast5 5.0.332.0 2010.05.25 - AVG 9.0.0.787 2010.05.25 - BitDefender 7.2 2010.05.25 - CAT-QuickHeal 10.00 2010.05.25 - ClamAV 0.96.0.3-git 2010.05.25 - Comodo 4939 2010.05.25 - DrWeb 5.0.2.03300 2010.05.25 - eSafe 7.0.17.0 2010.05.24 - eTrust-Vet 35.2.7508 2010.05.25 Java/ByteVerify!exploit F-Prot 4.6.0.103 2010.05.24 - F-Secure 9.0.15370.0 2010.05.25 - Fortinet 4.1.133.0 2010.05.23 - GData 21 2010.05.25 - Ikarus T3.1.1.84.0 2010.05.25 Trojan-Downloader.Java.Agent Jiangmin 13.0.900 2010.05.24 - Kaspersky 7.0.0.125 2010.05.25 Exploit.Java.Agent.f McAfee 5.400.0.1158 2010.05.25 Exploit-CVE2008-5353 McAfee-GW-Edition 2010.1 2010.05.25 Exploit-CVE2008-5353 Microsoft 1.5802 2010.05.25 Trojan:Java/Selace.E NOD32 5143 2010.05.25 a variant of Java/TrojanDownloader.Agent.NAI Norman 6.04.12 2010.05.25 - nProtect 2010-05-25.01 2010.05.25 - Panda 10.0.2.7 2010.05.25 - PCTools 7.0.3.5 2010.05.25 Trojan.Generic Prevx 3.0 2010.05.25 - Rising 22.49.01.04 2010.05.25 Trojan.DL.Java.Selace.a Sophos 4.53.0 2010.05.25 Troj/JavaDl-V Sunbelt 6352 2010.05.25 - Symantec 20101.1.0.89 2010.05.25 Trojan Horse TheHacker 6.5.2.0.287 2010.05.25 - TrendMicro 9.120.0.1004 2010.05.25 - TrendMicro-HouseCall 9.120.0.1004 2010.05.25 - VBA32 3.12.12.5 2010.05.25 - ViRobot 2010.5.20.2326 2010.05.25 - VirusBuster 5.0.27.0 2010.05.24 - Additional information File size: 3819 bytes MD5…: 7f6b1e52279996bb16ef0de727fa5cf1 SHA1..: dd6832639adc558915daea9ea846e18e7dcb70ee SHA256: 93856fc7431bd1bd3689c0ef23ad56eec222a791f9ffac1f280b836db51d4d34 ssdeep: 96:DByDJWLxPbq3sPzdFDhz6MHk0Ca/EIum58bF:D4Dw5i6tfkAYmibF PEiD..: - PEInfo: - RDS…: NSRL Reference Data Set - pdfid.: - trid..: Java Archive (78.3%) ZIP compressed archive (21.6%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
Post #8
gbsk

Open ComboFix

Please do the following:
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the codebox below into it:
File::
C:\Program Files\PowerTools Lite\Backups\0001D9\35217071-261c0e95

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.


Re Avast

Try uninstalling Avast via Add/Remove programs: it could be conflicting with Microsoft Security Essentials. You can always reinstall Avast later if you wish.

Let me know how your computer running when you send the ComboFix log.

Satchfan
Post #9
gbsk Can you please reply and let me know if you still require help. If I don't hear from you, this topic wil be closed in 24 hours. Satchfan
Post #10
Satchfan

The ComboFix ran twice. It only had one log though so I used that. Avast will still not start. Here is the log.

ComboFix 10-05-28.02 - Owner 05/28/2010 15:22:41.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.1057 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner.KHALSA-FAMILY\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-28 )))))))))))))))))))))))))))))))
.

2010-05-24 07:01 . 2010-05-24 07:01 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcp71.dll
2010-05-24 07:01 . 2010-05-24 07:01 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\jmc.dll
2010-05-24 07:01 . 2010-05-24 07:01 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-sse.dll
2010-05-24 07:01 . 2010-05-24 07:01 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcr71.dll
2010-05-24 07:01 . 2010-05-24 07:01 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-d3d.dll
2010-05-21 13:16 . 2010-05-21 13:16 ——– d—–w- c:\program files\ESET
2010-05-21 07:12 . 2010-05-21 07:12 56 —ha-w- c:\wixp\system32\ezsidmv.dat
2010-05-18 04:58 . 2010-05-21 16:55 1 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 04:58 . 2010-05-18 04:58 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\JRE
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\OpenOffice.org 3
2010-05-08 21:36 . 2004-08-04 07:07 59264 -c–a-w- c:\wixp\system32\dllcache\usbaudio.sys
2010-05-08 21:36 . 2004-08-04 07:07 59264 —-a-w- c:\wixp\system32\drivers\USBAUDIO.sys
2010-05-08 21:36 . 2004-08-04 07:08 31616 -c–a-w- c:\wixp\system32\dllcache\usbccgp.sys
2010-05-08 21:36 . 2004-08-04 07:08 31616 —-a-w- c:\wixp\system32\drivers\usbccgp.sys
2010-05-07 08:56 . 2004-05-04 20:53 1645320 —-a-w- c:\wixp\system32\gdiplus.dll
2010-05-07 08:56 . 2010-05-07 08:56 ——– d—–w- c:\program files\BurnAware Free
2010-05-07 05:05 . 2010-05-28 19:43 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\skypePM
2010-05-07 04:17 . 2010-05-28 21:46 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Skype
2010-05-07 00:39 . 2010-05-07 00:39 ——– d—–w- C:\finalburner
2010-05-07 00:31 . 2010-05-07 00:32 ——– d—–w- c:\program files\FinalBurner
2010-05-06 21:55 . 2010-05-06 21:55 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Skype
2010-05-06 00:42 . 2009-10-22 21:54 37392 —-a-w- c:\wixp\system32\drivers\83335002.sys
2010-05-06 00:42 . 2009-10-10 07:31 315408 —-a-w- c:\wixp\system32\drivers\8333500.sys
2010-05-06 00:42 . 2009-09-26 01:59 128016 —-a-w- c:\wixp\system32\drivers\83335001.sys
2010-05-02 21:29 . 2010-05-02 21:29 ——– d—–w- C:\_OTL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-23 21:41 . 2009-12-22 12:33 18008 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-21 17:21 . 2010-03-20 23:33 ——– d—–w- c:\program files\xplorer2
2010-05-18 04:35 . 2009-08-04 18:12 ——– d—–w- c:\program files\Java
2010-05-14 14:49 . 2009-12-24 04:05 ——– d—–w- c:\program files\Google
2010-05-12 21:43 . 2009-12-23 06:33 117760 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-08 03:26 . 2010-01-24 08:41 ——– d—–w- c:\program files\McAfee
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–r- c:\program files\Skype
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–w- c:\program files\Common Files\Skype
2010-04-26 05:43 . 2010-04-26 05:43 ——– d—–w- c:\program files\Common Files\Java
2010-04-26 04:48 . 2010-04-26 04:48 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcp71.dll
2010-04-26 04:48 . 2010-04-26 04:48 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\jmc.dll
2010-04-26 04:48 . 2010-04-26 04:48 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcr71.dll
2010-04-26 04:48 . 2010-04-26 04:48 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-sse.dll
2010-04-26 04:48 . 2010-04-26 04:48 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-d3d.dll
2010-04-26 04:47 . 2010-04-26 04:47 411368 —-a-w- c:\wixp\system32\deployJava1.dll
2010-04-23 12:41 . 2010-04-23 12:41 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Kaspersky Lab Setup Files
2010-04-20 21:56 . 2010-04-20 21:56 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Foxit Software
2010-04-07 20:49 . 2010-04-07 20:49 ——– d—–w- c:\program files\Trend Micro
2010-04-06 05:11 . 2009-06-15 21:26 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-04-06 05:06 . 2010-04-06 05:06 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\IObit
1601-01-01 00:00 . 1601-01-01 00:00 0 –sha-w- c:\wixp\Temp\swvdvrr3.TMP
.

((((((((((((((((((((((((((((( SnapShot@2010-05-13_00.41.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-21 06:00 . 2010-05-21 06:00 16384 c:\wixp\Temp\Perflib_Perfdata_530.dat
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ARPPRODUCTICON.exe
+ 2010-02-02 08:22 . 2010-02-02 08:22 655872 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 568832 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 224768 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
- 2010-04-26 04:47 . 2010-04-26 04:47 153376 c:\wixp\system32\javaws.exe
+ 2010-05-18 04:35 . 2010-04-26 04:47 153376 c:\wixp\system32\javaws.exe
+ 2010-05-18 04:35 . 2010-04-26 04:47 145184 c:\wixp\system32\javaw.exe
- 2010-04-26 04:47 . 2010-04-26 04:47 145184 c:\wixp\system32\javaw.exe
- 2010-04-26 04:47 . 2010-04-26 04:47 145184 c:\wixp\system32\java.exe
+ 2010-05-18 04:35 . 2010-04-26 04:47 145184 c:\wixp\system32\java.exe
+ 2009-12-21 15:13 . 2010-05-21 06:00 115768 c:\wixp\system32\FNTCACHE.DAT
+ 2010-05-18 04:35 . 2010-05-18 04:35 577536 c:\wixp\Installer\1057e2ea.msi
+ 2010-05-14 14:51 . 2010-05-14 14:51 1235968 c:\wixp\Installer\1692ac23.msi
+ 2010-05-18 04:39 . 2010-05-18 04:39 7424000 c:\wixp\Installer\{6ADD0603-16EF-400D-9F9E-486432835002}\soffice.exe
+ 2010-05-18 04:39 . 2010-05-18 04:39 10174464 c:\wixp\Installer\1057e2f1.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db35fda8-77e3-4784-92c2-ee7345e91af4}]
2010-05-21 17:21 2515552 —-a-w- c:\program files\xplorer2\tbxpl0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DB35FDA8-77E3-4784-92C2-EE7345E91AF4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" [2010-04-06 2010864]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-04-20 26192680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\wixp\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\wixp\system32\hkcmd.exe" [2004-02-10 118784]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2010-01-26 02:20 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIXP^Start Menu^Programs^Startup^BounceBack Launcher.lnk]
backup=c:\wixp\pss\BounceBack Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner.KHALSA-FAMILY^Start Menu^Programs^Startup^TimeLeft.lnk]
backup=c:\wixp\pss\TimeLeft.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-12-24 04:05 135664 —-atw- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-09 00:50 54576 —-a-w- c:\program files\Hp\HP Software Update\hpwuschd2.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Giganology\\Gigaget\\Gigaget.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 83335002;83335002 Boot Guard Driver;c:\wixp\system32\drivers\83335002.sys [5/5/2010 4:42 PM 37392]
R1 83335001;83335001;c:\wixp\system32\drivers\83335001.sys [5/5/2010 4:42 PM 128016]
R1 aswSP;aswSP;c:\wixp\system32\drivers\aswSP.sys [1/23/2010 3:17 PM 162512]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [5/26/2009 10:05 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 66632]
R1 setup_9.0.0.722_06.05.2010_03-24drv;setup_9.0.0.722_06.05.2010_03-24drv;c:\wixp\system32\drivers\8333500.sys [5/5/2010 4:42 PM 315408]
R2 aswFsBlk;aswFsBlk;c:\wixp\system32\drivers\aswFsBlk.sys [1/23/2010 3:17 PM 19024]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [1/24/2010 12:42 AM 93320]
R2 portD;CMS PortIO Service;c:\wixp\system32\drivers\portd2k.sys [1/13/2010 2:43 PM 7424]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 12872]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/23/2009 8:05 PM 135664]
S3 BIOSCHK;BIOSCHK;\??\c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS –> c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS [?]
.
Contents of the 'Scheduled Tasks' folder

2010-05-28 c:\wixp\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-05-28 c:\wixp\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-05-28 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003Core.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-05-28 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003UA.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: {{21196042-830F-419f-A594-F9D456A6C29A} - {21196042-830F-419f-A594-F9D456A6C29A} c:\program files\TimeLeft3\TLIntergIE.html - c:\program files\timeleft3\tlintergie.html\inprocserver32 does not exist!
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: DirectAnimation Java Classes - file://c:\wixp\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\wixp\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-28 15:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(500)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(4028)
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\wixp\system32\browselc.dll
c:\wixp\system32\WPDShServiceObj.dll
c:\wixp\system32\PortableDeviceTypes.dll
c:\wixp\system32\PortableDeviceApi.dll
.
Completion time: 2010-05-28 15:31:37
ComboFix-quarantined-files.txt 2010-05-28 23:31
ComboFix2.txt 2010-05-28 22:09
ComboFix3.txt 2010-05-15 16:26
ComboFix4.txt 2010-05-13 00:44

Pre-Run: 20,161,515,520 bytes free
Post-Run: 20,147,970,048 bytes free

- - End Of File - - 73C224CEE7E29844D3578659917E5AE3
Post #11
Hello gbsk

Open ComboFix

Please do the following:
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the codebox below into it:
File::
c:\wixp\Temp\swvdvrr3.TMP

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.


Remove Kaspersky’s AVP tool

Try to remove it through Add/Remove programs.

If this does not work, follow the instructions here to uninstall it.


When this is done, try running Avast. If it is still not working, do the following:


Remove Avast1. Remove Avast using Add/Remove programs
2. Download aswclear5.exe to your desktop
3. Start Windows in Safe Mode
4. Double-click aswClear5.exe
5. Click REMOVE
6. Restart your computer
Download Avast5 here and install it.


Please do the following:
1. Let me know if Avast is now working.
2. Tell me how your computer is running and if you think there are still problems, what the symptoms are.
3. Post the ComboFix log
Thanks

Satchfan
Post #12
Satchfan

I ran ComboFix. I saved it. However, I then installed the program to uninstall Avast. I started it in Safe Mode. I then could not log on as an owner but only as administrator since i could not type anything in login box. I thus could not access the uninstallation program on the desktop since adminstrator only has a few basic programs and not all the programs as an owner would. I tried a regular uninstallation but it took forever so I aborted it.I don't even think the it started to uninstall. I then restarted the computer. Then, it was supposed to start normally. I waited at least 5 minutes and just had a black screen after it started. This happened 3 tiems. I then restarted in safe mode with networking which I am doing now. The computer has been very slow as soon as I tried to uninstall Avast and it has not worked well at all since then.

Kaspersky was uninstalled quite a few days ago. Whenever I start the computer it read "BIOS not installed". It has been like this for a long time. My wife has not been able to access her Hotmail for awhile or access Craigslist. Some sites that require Java do not open up. However, the computer has been doing this for awhile also. Below is the log. I will try again to start in normal mode and uninstall Avast using Add/Change progarams. I ran malwarebytes but it found nothing.

ComboFix 10-05-28.02 - Owner 06/02/2010 18:13:35.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.1059 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner.KHALSA-FAMILY\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Created a new restore point

FILE ::
"c:\wixp\Temp\swvdvrr3.TMP"
.

((((((((((((((((((((((((( Files Created from 2010-05-03 to 2010-06-03 )))))))))))))))))))))))))))))))
.

2010-05-24 07:01 . 2010-05-24 07:01 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcp71.dll
2010-05-24 07:01 . 2010-05-24 07:01 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\jmc.dll
2010-05-24 07:01 . 2010-05-24 07:01 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-sse.dll
2010-05-24 07:01 . 2010-05-24 07:01 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcr71.dll
2010-05-24 07:01 . 2010-05-24 07:01 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-d3d.dll
2010-05-21 13:16 . 2010-05-21 13:16 ——– d—–w- c:\program files\ESET
2010-05-21 07:12 . 2010-05-21 07:12 56 —ha-w- c:\wixp\system32\ezsidmv.dat
2010-05-18 04:58 . 2010-05-30 21:50 1 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 04:58 . 2010-05-18 04:58 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\JRE
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\OpenOffice.org 3
2010-05-08 21:36 . 2004-08-04 07:07 59264 -c–a-w- c:\wixp\system32\dllcache\usbaudio.sys
2010-05-08 21:36 . 2004-08-04 07:07 59264 —-a-w- c:\wixp\system32\drivers\USBAUDIO.sys
2010-05-08 21:36 . 2004-08-04 07:08 31616 -c–a-w- c:\wixp\system32\dllcache\usbccgp.sys
2010-05-08 21:36 . 2004-08-04 07:08 31616 —-a-w- c:\wixp\system32\drivers\usbccgp.sys
2010-05-07 08:56 . 2004-05-04 20:53 1645320 —-a-w- c:\wixp\system32\gdiplus.dll
2010-05-07 08:56 . 2010-05-07 08:56 ——– d—–w- c:\program files\BurnAware Free
2010-05-07 05:05 . 2010-06-03 00:00 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\skypePM
2010-05-07 04:17 . 2010-06-03 02:22 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Skype
2010-05-07 00:39 . 2010-05-07 00:39 ——– d—–w- C:\finalburner
2010-05-07 00:31 . 2010-05-07 00:32 ——– d—–w- c:\program files\FinalBurner
2010-05-06 21:55 . 2010-05-06 21:55 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Skype
2010-05-06 00:42 . 2009-10-22 21:54 37392 —-a-w- c:\wixp\system32\drivers\83335002.sys
2010-05-06 00:42 . 2009-10-10 07:31 315408 —-a-w- c:\wixp\system32\drivers\8333500.sys
2010-05-06 00:42 . 2009-09-26 01:59 128016 —-a-w- c:\wixp\system32\drivers\83335001.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-23 21:41 . 2009-12-22 12:33 18008 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-21 17:21 . 2010-03-20 23:33 ——– d—–w- c:\program files\xplorer2
2010-05-18 04:35 . 2009-08-04 18:12 ——– d—–w- c:\program files\Java
2010-05-14 14:49 . 2009-12-24 04:05 ——– d—–w- c:\program files\Google
2010-05-12 21:43 . 2009-12-23 06:33 117760 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-08 03:26 . 2010-01-24 08:41 ——– d—–w- c:\program files\McAfee
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–r- c:\program files\Skype
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–w- c:\program files\Common Files\Skype
2010-04-26 05:43 . 2010-04-26 05:43 ——– d—–w- c:\program files\Common Files\Java
2010-04-26 04:48 . 2010-04-26 04:48 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcp71.dll
2010-04-26 04:48 . 2010-04-26 04:48 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\jmc.dll
2010-04-26 04:48 . 2010-04-26 04:48 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcr71.dll
2010-04-26 04:48 . 2010-04-26 04:48 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-sse.dll
2010-04-26 04:48 . 2010-04-26 04:48 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-d3d.dll
2010-04-26 04:47 . 2010-04-26 04:47 411368 —-a-w- c:\wixp\system32\deployJava1.dll
2010-04-23 12:41 . 2010-04-23 12:41 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Kaspersky Lab Setup Files
2010-04-20 21:56 . 2010-04-20 21:56 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Foxit Software
2010-04-07 20:49 . 2010-04-07 20:49 ——– d—–w- c:\program files\Trend Micro
2010-04-06 05:11 . 2009-06-15 21:26 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-04-06 05:06 . 2010-04-06 05:06 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\IObit
.

((((((((((((((((((((((((((((( SnapShot@2010-05-13_00.41.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-21 06:00 . 2010-05-21 06:00 16384 c:\wixp\Temp\Perflib_Perfdata_530.dat
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ARPPRODUCTICON.exe
+ 2010-02-02 08:22 . 2010-02-02 08:22 655872 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 568832 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 224768 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
- 2010-04-26 04:47 . 2010-04-26 04:47 153376 c:\wixp\system32\javaws.exe
+ 2010-05-18 04:35 . 2010-04-26 04:47 153376 c:\wixp\system32\javaws.exe
+ 2010-05-18 04:35 . 2010-04-26 04:47 145184 c:\wixp\system32\javaw.exe
- 2010-04-26 04:47 . 2010-04-26 04:47 145184 c:\wixp\system32\javaw.exe
- 2010-04-26 04:47 . 2010-04-26 04:47 145184 c:\wixp\system32\java.exe
+ 2010-05-18 04:35 . 2010-04-26 04:47 145184 c:\wixp\system32\java.exe
+ 2009-12-21 15:13 . 2010-05-21 06:00 115768 c:\wixp\system32\FNTCACHE.DAT
+ 2010-05-18 04:35 . 2010-05-18 04:35 577536 c:\wixp\Installer\1057e2ea.msi
+ 2010-05-14 14:51 . 2010-05-14 14:51 1235968 c:\wixp\Installer\1692ac23.msi
+ 2010-05-18 04:39 . 2010-05-18 04:39 7424000 c:\wixp\Installer\{6ADD0603-16EF-400D-9F9E-486432835002}\soffice.exe
+ 2010-05-18 04:39 . 2010-05-18 04:39 10174464 c:\wixp\Installer\1057e2f1.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db35fda8-77e3-4784-92c2-ee7345e91af4}]
2010-05-21 17:21 2515552 —-a-w- c:\program files\xplorer2\tbxpl0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DB35FDA8-77E3-4784-92C2-EE7345E91AF4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" [2010-04-06 2010864]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-04-20 26192680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\wixp\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\wixp\system32\hkcmd.exe" [2004-02-10 118784]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
setup_9.0.0.722_06.05.2010_03-24.lnk - c:\documents and settings\Owner.KHALSA-FAMILY\Desktop\Virus Removal Tool\setup_9.0.0.722_06.05.2010_03-24\startup.exe [2010-5-5 72208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2010-01-26 02:20 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIXP^Start Menu^Programs^Startup^BounceBack Launcher.lnk]
backup=c:\wixp\pss\BounceBack Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner.KHALSA-FAMILY^Start Menu^Programs^Startup^TimeLeft.lnk]
backup=c:\wixp\pss\TimeLeft.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-12-24 04:05 135664 —-atw- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-09 00:50 54576 —-a-w- c:\program files\Hp\HP Software Update\hpwuschd2.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Giganology\\Gigaget\\Gigaget.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 83335002;83335002 Boot Guard Driver;c:\wixp\system32\drivers\83335002.sys [5/5/2010 4:42 PM 37392]
R1 83335001;83335001;c:\wixp\system32\drivers\83335001.sys [5/5/2010 4:42 PM 128016]
R1 aswSP;aswSP;c:\wixp\system32\drivers\aswSP.sys [1/23/2010 3:17 PM 162512]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [5/26/2009 10:05 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 66632]
R1 setup_9.0.0.722_06.05.2010_03-24drv;setup_9.0.0.722_06.05.2010_03-24drv;c:\wixp\system32\drivers\8333500.sys [5/5/2010 4:42 PM 315408]
R2 aswFsBlk;aswFsBlk;c:\wixp\system32\drivers\aswFsBlk.sys [1/23/2010 3:17 PM 19024]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [1/24/2010 12:42 AM 93320]
R2 portD;CMS PortIO Service;c:\wixp\system32\drivers\portd2k.sys [1/13/2010 2:43 PM 7424]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 12872]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/23/2009 8:05 PM 135664]
S3 BIOSCHK;BIOSCHK;\??\c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS –> c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS [?]
.
Contents of the 'Scheduled Tasks' folder

2010-06-02 c:\wixp\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-06-03 c:\wixp\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-06-02 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003Core.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-06-03 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003UA.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: {{21196042-830F-419f-A594-F9D456A6C29A} - {21196042-830F-419f-A594-F9D456A6C29A} c:\program files\TimeLeft3\TLIntergIE.html - c:\program files\timeleft3\tlintergie.html\inprocserver32 does not exist!
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: DirectAnimation Java Classes - file://c:\wixp\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\wixp\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-02 18:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(500)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
Completion time: 2010-06-02 18:25:48
ComboFix-quarantined-files.txt 2010-06-03 02:25
ComboFix2.txt 2010-05-28 23:31
ComboFix3.txt 2010-05-28 22:09
ComboFix4.txt 2010-05-15 16:26
ComboFix5.txt 2010-06-03 02:11

Pre-Run: 20,084,613,120 bytes free
Post-Run: 20,080,705,536 bytes free

- - End Of File - - 1171A9091075C57B8542C1F94AAE5316
Post #13
Satchfan I was able to start computer in normal mode. However, it has been running slow ever since I restarted it in safe mode. Actually I did find Kaspersky and uninstalled it. On this page, there is no scroll bar. When I started this in safe mode with networking in IE, there was a scroll bar. On a few other sites there is no scroll bar also. There used to be scroll bars there. That is just to let you know how it is working. I will now download Avast.
Post #15
Hi gbsk

Your ComboFix log shows Kaspersky still on the system – did you uninstall it after running ComboFix? If not, please uninstall it by following the previous instructions.

When you say you started Avast, did you uninstall and re-install Avast? Is it now working?

If you need to uninstall it, make sure you disable Avast's selfprotection first, then it should uninstall easily.

To disable selfprotection:

Avast4
• Right click the "a" icon > program settings.
• Click Troubleshooting and check Disable Avast! self-defence module
• Click OK.
Avast 5
• Right click the "a" icon
• Open avast user interface.
• Click settings in the upper right hand corner
• Click Troubleshooting and uncheck Enable Avast! self-defence module.
• Click OK.

I notice that GoogleEarth has been installed. I suggest it is not used while you are having problems: it uses a lot of resources and this you can do without until the computer is behaving normally.

Also, I asked that you do not install or uninstall anything until this problem is solved – please also relay this message to anyone else that is using this computer. When checking your logs, one of the things we look for is any changes that occur which could be caused by infections. If the user is also making changes to the system it makes our job more difficult – I hope you understand.


Remove Java and re-install it.

Download the latest version Here save it to your desktop but do not install it yet.

JRE 6 Update 20 <–This is what you need

  • Go to your Add Remove Programs in the Control Panel and uninstall ALL instances of Java including JRE
  • Reboot your computer
  • Install the latest version

When you have done this, please send a new ComboFix log.

Thanks

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI