This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Help with redirects

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hello! Over the past 48 hours, Malwarebytes' Anti-Malware has been effectively blocking what I believe (assume?) to be redirects. Two additional issues that I'm not sure is related or not: (1) Google Chrome will not display ANY pages, gives me only the "kill or wait" choices. (2) Was unable to put laptop into hibernate, last night, but was able to perform a shutdown. From the Malwarebytes' log, this morning: 00:00:14 Mike IP-BLOCK 213.163.89.104 00:00:17 Mike IP-BLOCK 213.163.89.104 00:00:23 Mike IP-BLOCK 213.163.89.104 00:11:32 Mike IP-BLOCK 61.61.20.132 00:11:35 Mike IP-BLOCK 61.61.20.132 00:11:41 Mike IP-BLOCK 61.61.20.132 00:19:35 Mike IP-BLOCK 213.163.89.104 00:19:38 Mike IP-BLOCK 213.163.89.104 00:19:44 Mike IP-BLOCK 213.163.89.104 07:52:34 Mike MESSAGE Protection started successfully 07:52:43 Mike MESSAGE IP Protection started successfully 07:53:36 Mike IP-BLOCK 91.212.226.7 07:53:39 Mike IP-BLOCK 91.212.226.7 07:53:45 Mike IP-BLOCK 91.212.226.7 07:54:20 Mike MESSAGE IP Protection stopped 07:54:31 Mike MESSAGE Database updated successfully 07:54:34 Mike MESSAGE IP Protection started successfully 07:58:34 Mike IP-BLOCK 213.163.89.104 07:58:37 Mike IP-BLOCK 213.163.89.104 07:58:43 Mike IP-BLOCK 213.163.89.104 08:09:03 Mike IP-BLOCK 91.212.226.7 08:09:06 Mike IP-BLOCK 91.212.226.7 08:09:12 Mike IP-BLOCK 91.212.226.7 08:23:55 Mike IP-BLOCK 213.163.89.104 08:23:58 Mike IP-BLOCK 213.163.89.104 08:24:04 Mike IP-BLOCK 213.163.89.104 DDS.txt results: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 8:13:42.65 on Sun 05/30/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1144 [GMT -4:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\Ati2evxx.exe svchost.exe svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\ASNA\ADB Engine 5.0\adbntsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe C:\WINDOWS\system32\StacSV.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Smith Micro\StuffIt\ArcNameService.exe C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Apoint\Apoint.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Program Files\Wave Systems Corp\SecureUpgrade.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Safari\Safari.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Documents and Settings\Mike\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.dogpile.com/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\ibm\java50\jre\bin\ssv.dll BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll uRun: [Google Update] "c:\documents and settings\mike\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe mRun: [SecureUpgrade] c:\program files\wave systems corp\SecureUpgrade.exe mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe" mRun: [ECenter] c:\dell\e-center\EULALauncher.exe mRun: [Client Access Service] "c:\program files\ibm\client access\cwbsvstr.exe" mRun: [Client Access Help Update] "c:\program files\ibm\client access\cwbinhlp.exe" mRun: [Client Access Check Version] "c:\program files\ibm\client access\cwbckver.exe" LOGIN mRun: [Client Access Express Welcome] "c:\program files\ibm\client access\cwbwlwiz.exe" mRun: [Client Access PC5250 Sound] "c:\program files\ibm\client access\emulator\pcssnd.exe" mRun: [Acrobat Synchronizer] "c:\program files\adobe\acrobat 8.0\acrobat\AdobeCollabSync.exe" mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [EPSON Stylus CX6400] c:\windows\system32\spool\drivers\w32x86\3\E_S4I2L1.EXE /P19 "EPSON Stylus CX6400" /O5 "LPT1:" /M "Stylus CX6400" mRun: [\\macdaddy\EPSON Stylus CX6400] c:\windows\system32\spool\drivers\w32x86\3\e_s4i2l1.exe /p30 "\\macdaddy\epson stylus cx6400" /o30 "\\macdaddy\EPSON Stylus CX6400" /M "Stylus CX6400" mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon mRun: [] mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe" mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe" mRun: [\\192.168.1.5\EPSON Stylus CX6400] c:\windows\system32\spool\drivers\w32x86\3\e_s4i2l1.exe /p33 "\\192.168.1.5\epson stylus cx6400" /o33 "\\192.168.1.5\EPSON Stylus CX6400" /M "Stylus CX6400" mRun: [\\192.168.1.3\EPSON Stylus CX6400] c:\windows\system32\spool\drivers\w32x86\3\e_s4i2l1.exe /p33 "\\192.168.1.3\epson stylus cx6400" /o33 "\\192.168.1.3\EPSON Stylus CX6400" /M "Stylus CX6400" mRun: [\\MACDADDY-2\EPSON Stylus CX6400] c:\windows\system32\spool\drivers\w32x86\3\e_s4i2l1.exe /p32 "\\macdaddy-2\epson stylus cx6400" /o32 "\\macdaddy-2\EPSON Stylus CX6400" /M "Stylus CX6400" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html IE: {8E3DCE4C-76F6-40CD-A8B9-6D4739CB8F27} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB DPF: {1ACECAFE-0015-0000-0000-ABCDEFFEDCBA} - hxxp:// DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/33.06/uploader2.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp:// DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp:// DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp:// DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll Handler: x-owacid - {0215258f-f0a8-49de-bf1b-0ff02eda8807} - c:\program files\microsoft\outlook web access smime client\mimectl.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll Notify: gemsafe - c:\program files\gemplus\gemsafe libraries\bin\WLEventNotify.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll AppInit_DLLs: c:\windows\system32\avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL LSA: Authentication Packages = msv1_0 wvauth ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-9-14 335240] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-9-14 27784] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656] R2 Acceler8DB Server;Acceler8DB Server;c:\program files\asna\adb engine 5.0\adbntsvc.exe [2008-3-17 620224] R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2006-12-19 79432] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-9-14 297752] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2008-12-21 304464] R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2010-5-28 91456] R2 Stuffit Archive Name Service;Stuffit Archive Name Service;c:\program files\smith micro\stuffit\ArcNameService.exe [2008-1-31 157016] R2 Wave UCSPlus;Wave UCSPlus;c:\windows\system32\dllhost.exe [2004-8-11 5120] R3 DXEC01;DXEC01;c:\windows\system32\drivers\dxec01.sys [2006-11-2 97536] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-12-21 20952] S2 RoxLiveShare10;LiveShare P2P Server 10;"c:\program files\common files\roxio shared\10.0\sharedcom\roxliveshare10.exe" –> c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [?] S2 SessionLauncher;SessionLauncher;c:\docume~1\mike\locals~1\temp\dx9\sessionlauncher.exe –> c:\docume~1\mike\locals~1\temp\dx9\SessionLauncher.exe [?] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys –> c:\windows\system32\drivers\motccgp.sys [?] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys –> c:\windows\system32\drivers\motccgpfl.sys [?] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys –> c:\windows\system32\drivers\motodrv.sys [?] =============== Created Last 30 ================ 2010-05-29 19:35 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2010-05-29 19:34 –d—– c:\program files\SUPERAntiSpyware 2010-05-29 13:58 –d—– c:\program files\iPod 2010-05-29 13:58 –d—– c:\program files\iTunes 2010-05-29 13:52 –d—– c:\program files\Bonjour 2010-05-29 10:23 2 a–shrot c:\windows\winstart.bat 2010-05-29 10:23 –d—– c:\program files\UnHackMe 2010-05-29 00:39 711,168 a——- c:\windows\is-GNOQQ.exe 2010-05-29 00:39 10,562 a——- c:\windows\is-GNOQQ.msg 2010-05-29 00:39 399 a——- c:\windows\is-GNOQQ.lst 2010-05-22 13:38 –d—– c:\program files\ESET ==================== Find3M ==================== 2010-04-29 15:39 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 15:39 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-04-08 13:20 107,808 a——- c:\windows\system32\dns-sd.exe 2010-04-08 13:20 91,424 a——- c:\windows\system32\dnssd.dll 2010-03-10 02:15 420,352 ——– c:\windows\system32\vbscript.dll 2010-03-10 02:15 420,352 ——– c:\windows\system32\dllcache\vbscript.dll 2010-02-20 20:29 87,608 a——- c:\docume~1\mike\applic~1\inst.exe 2010-02-20 20:29 47,360 a——- c:\docume~1\mike\applic~1\pcouffin.sys 2009-09-06 19:32 94,208 a——- c:\docume~1\mike\applic~1\ezplay.sys ============= FINISH: 8:15:39.43 =============== Attach.txt Results: UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 3/17/2008 1:40:47 PM System Uptime: 5/30/2010 7:47:54 AM (1 hours ago) Motherboard: Dell Inc. | | 0XM006 Processor: Mobile AMD Sempron™ Processor 3600+ | Microprocessor | 1994/100mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 74 GiB total, 39.464 GiB free. D: is CDROM () E: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP478: 5/29/2010 5:29:26 PM - System Checkpoint ==== Installed Programs ====================== A-Ray Scanner 2.0.2.3 Acceler8DB Engine 5.0 Adobe Acrobat 8 Standard Adobe Acrobat 8.1.2 Security Update 1 (KB403742) Adobe Acrobat 8.1.2 Standard Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Apple Application Support Apple Mobile Device Support Apple Software Update ASNA Visual RPG 4.0 ATI Catalyst Control Center ATI Display Driver AuthenTec Fingerprint Sensor Minimum Install Avanquest update AVG Free 8.5 biolsp patch BlackBerry Desktop Software 5.0.1 BlackBerry Device Software Updater BlackBerry Device Software v4.5.0 for the BlackBerry 8800 smartphone BlackBerry Media Sync BlackBerry® Media Sync Bonjour Broadcom ASF Management Applications Broadcom Management Programs Browser Address Error Redirector Canon Camera Access Library Canon Camera Support Core Library Canon CanoScan LiDE 100 User Registration Canon G.726 WMP-Decoder Canon MovieEdit Task for ZoomBrowser EX Canon MP Navigator EX 2.0 Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon Utilities CameraWindow Canon Utilities CameraWindow DC Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX Canon Utilities File Viewer Utility 1.2 Canon Utilities MyCamera Canon Utilities MyCamera DC Canon Utilities PhotoStitch Canon Utilities RemoteCapture 2.7 Canon Utilities RemoteCapture DC Canon Utilities RemoteCapture Task for ZoomBrowser EX Canon Utilities Solution Menu Canon Utilities ZoomBrowser EX Canon ZoomBrowser EX Memory Card Utility CanoScan LiDE 100 Scanner Driver CCleaner CDDRV_Installer Conexant HDA D330 MDC V.92 Modem Dell Drivers MSI Dell Embassy Trust Suite by Wave Systems Dell Touchpad Dell Wireless WLAN Card Digital Line Detect DirectXInstallService Disney Toontown Online Document Manager Lite DVD2one V2.4.0 DVDFab 6.2.1.8 (31/12/2009) EMBASSY Security Center EMBASSY Security Setup EMBASSY Trust Suite by Wave Systems EMC 10 Content EPSON Printer Software ESC Home Page Plugin ESET Online Scanner v3 File Viewer Utility 1.2 FileZilla Client 3.3.2 Gemalto GemSafe Standard Edition 5.1 Google Talk Plugin Handbrake 0.9.4 HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows XP (KB954550-v5) IBM 32-bit Runtime Environment for Java 2, v5.0 IBM iSeries Access for Windows Inkjet Printer/Scanner Extended Survey Program IntelliSonic Speech Enhancement iPhone Configuration Utility iTunes Java™ 6 Update 14 KhalInstallWrapper LightScribe System Software LightScribe Template Labeler Logitech SetPoint Malwarebytes' Anti-Malware MapleStory MFCLOC Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office 2003 Web Components Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Basic 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Outlook Web Access S/MIME (2007) Microsoft Report Viewer Redistributable 2005 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Modem Diagnostic Tool Motorola Driver Installation 4.6.0 Motorola Phone Tools Motorola Software Update MS Access 97 Runtime Edition MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 8 Essentials neroxml Netflix Movie Viewer NetWaiting NTRU TCG Software Stack OGA Notifier 2.0.0048.0 ORS Nasco Electronic Price Book Picasa 3 PowerDVD Preboot Manager Private Information Manager QuickSet QuickTime RapidShare Manager RemoteCapture 2.7.5 Roxio Activation Module Roxio Media Manager Safari SearchAssist Secure Update Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for 2007 Microsoft Office System (KB978380) Security Update for CAPICOM (KB931906) Security Update for Microsoft Office Excel 2007 (KB978382) Security Update for Microsoft Office Outlook 2007 (KB972363) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Internet Explorer 8 (KB974455) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Internet Explorer 8 (KB978207) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB923689) Security Wizards SmartSound Quicktracks Plugin StuffIt 12 SUPERAntiSpyware TBWoods Drives Trusted Drive Manager tsp patch Update for 2007 Microsoft Office System (KB967642) Update for 2007 Microsoft Office System (KB981715) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office InfoPath 2007 (KB976416) Update for Outlook 2007 Junk Email Filter (kb981726) Update for Windows Internet Explorer 8 (KB968220) Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB976749) Update for Windows Internet Explorer 8 (KB980182) upekmsi VCRedistSetup Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 Visual C++ 8.0 ATL (x86) WinSXS MSM Visual C++ 8.0 CRT (x86) WinSXS MSM VLC media player 1.0.3 Wave Infrastructure Installer Wave Support Software WebFldrs XP Windows Desktop Search 3.01 Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 3 WinRAR archiver WOT for Internet Explorer ==== Event Viewer Messages From Past Week ======== 5/27/2010 8:25:47 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory. 5/27/2010 8:25:39 PM, error: NETLOGON [5719] - No Domain Controller is available for domain RICHMOND.COM due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator. 5/27/2010 6:12:20 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver. 5/23/2010 11:35:07 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) ==== End Of File =========================== Thank You!
Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4155 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 5/31/2010 9:21:12 AM mbam-log-2010-05-31 (09-21-12).txt Scan type: Full scan (C:\|) Objects scanned: 239020 Time elapsed: 1 hour(s), 15 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Protection log (MBAM) 00:02:40 Mike IP-BLOCK 213.163.89.104 00:02:43 Mike IP-BLOCK 213.163.89.104 00:02:49 Mike IP-BLOCK 213.163.89.104 00:25:36 Mike IP-BLOCK 213.163.89.106 00:25:39 Mike IP-BLOCK 213.163.89.106 00:25:45 Mike IP-BLOCK 213.163.89.106 00:25:57 Mike IP-BLOCK 213.163.89.106 00:26:00 Mike IP-BLOCK 213.163.89.106 00:26:06 Mike IP-BLOCK 213.163.89.106 00:26:19 Mike IP-BLOCK 213.163.89.107 00:26:21 Mike IP-BLOCK 213.163.89.107 00:26:27 Mike IP-BLOCK 213.163.89.107 00:26:40 Mike IP-BLOCK 213.163.89.107 00:26:43 Mike IP-BLOCK 213.163.89.107 00:26:49 Mike IP-BLOCK 213.163.89.107 00:27:01 Mike IP-BLOCK 213.163.89.105 00:27:04 Mike IP-BLOCK 213.163.89.105 00:27:10 Mike IP-BLOCK 213.163.89.105 00:32:01 Mike IP-BLOCK 213.163.89.104 00:32:04 Mike IP-BLOCK 213.163.89.104 00:32:10 Mike IP-BLOCK 213.163.89.104 06:59:14 Mike MESSAGE Protection started successfully 06:59:22 Mike MESSAGE IP Protection started successfully 07:00:33 Mike IP-BLOCK 91.212.226.7 07:00:36 Mike IP-BLOCK 91.212.226.7 07:00:42 Mike IP-BLOCK 91.212.226.7 07:05:33 Mike IP-BLOCK 213.163.89.104 07:05:36 Mike IP-BLOCK 213.163.89.104 07:05:42 Mike IP-BLOCK 213.163.89.104 07:34:54 Mike IP-BLOCK 213.163.89.104 07:34:57 Mike IP-BLOCK 213.163.89.104 07:35:03 Mike IP-BLOCK 213.163.89.104 07:49:15 Mike IP-BLOCK 213.163.89.104 07:49:18 Mike IP-BLOCK 213.163.89.104 07:49:24 Mike IP-BLOCK 213.163.89.104 07:51:39 Mike IP-BLOCK 216.18.239.157 07:51:39 Mike IP-BLOCK 216.18.239.157 07:51:39 Mike IP-BLOCK 216.18.239.157 07:51:40 Mike IP-BLOCK 216.18.239.157 07:51:42 Mike IP-BLOCK 216.18.239.157 07:51:42 Mike IP-BLOCK 216.18.239.157 07:51:43 Mike IP-BLOCK 216.18.239.157 07:51:48 Mike IP-BLOCK 216.18.239.157 07:51:48 Mike IP-BLOCK 216.18.239.157 07:51:49 Mike IP-BLOCK 216.18.239.157 07:52:00 Mike IP-BLOCK 216.18.239.157 07:52:00 Mike IP-BLOCK 216.18.239.157 07:52:01 Mike IP-BLOCK 216.18.239.157 07:52:01 Mike IP-BLOCK 216.18.239.157 07:52:03 Mike IP-BLOCK 216.18.239.157 07:52:03 Mike IP-BLOCK 216.18.239.157 07:52:03 Mike IP-BLOCK 216.18.239.157 07:52:04 Mike IP-BLOCK 216.18.239.157 07:52:04 Mike IP-BLOCK 216.18.239.157 07:52:06 Mike IP-BLOCK 216.18.239.157 07:52:09 Mike IP-BLOCK 216.18.239.157 07:52:09 Mike IP-BLOCK 216.18.239.157 07:52:10 Mike IP-BLOCK 216.18.239.157 07:52:10 Mike IP-BLOCK 216.18.239.157 07:52:12 Mike IP-BLOCK 216.18.239.157 07:52:22 Mike IP-BLOCK 216.18.239.157 07:52:22 Mike IP-BLOCK 216.18.239.157 07:52:22 Mike IP-BLOCK 216.18.239.157 07:52:24 Mike IP-BLOCK 216.18.239.157 07:52:25 Mike IP-BLOCK 216.18.239.157 07:52:25 Mike IP-BLOCK 216.18.239.157 07:52:26 Mike IP-BLOCK 216.18.239.157 07:52:27 Mike IP-BLOCK 216.18.239.157 07:52:29 Mike IP-BLOCK 216.18.239.157 07:52:31 Mike IP-BLOCK 216.18.239.157 07:52:31 Mike IP-BLOCK 216.18.239.157 07:52:33 Mike IP-BLOCK 216.18.239.157 07:52:35 Mike IP-BLOCK 216.18.239.157 07:52:44 Mike IP-BLOCK 216.18.239.157 07:52:44 Mike IP-BLOCK 216.18.239.157 07:52:44 Mike IP-BLOCK 216.18.239.157 07:52:46 Mike IP-BLOCK 216.18.239.157 07:52:47 Mike IP-BLOCK 216.18.239.157 07:52:47 Mike IP-BLOCK 216.18.239.157 07:52:47 Mike IP-BLOCK 216.18.239.157 07:52:49 Mike IP-BLOCK 216.18.239.157 07:52:52 Mike IP-BLOCK 216.18.239.157 07:52:53 Mike IP-BLOCK 216.18.239.157 07:52:53 Mike IP-BLOCK 216.18.239.157 07:52:53 Mike IP-BLOCK 216.18.239.157 07:52:55 Mike IP-BLOCK 216.18.239.157 07:52:55 Mike IP-BLOCK 216.18.239.157 07:53:01 Mike IP-BLOCK 216.18.239.157 07:53:06 Mike IP-BLOCK 216.18.239.157 07:53:06 Mike IP-BLOCK 216.18.239.157 07:53:06 Mike IP-BLOCK 216.18.239.157 07:53:08 Mike IP-BLOCK 216.18.239.157 07:53:09 Mike IP-BLOCK 216.18.239.157 07:53:09 Mike IP-BLOCK 216.18.239.157 07:53:09 Mike IP-BLOCK 216.18.239.157 07:53:10 Mike IP-BLOCK 216.18.239.157 07:53:11 Mike IP-BLOCK 216.18.239.157 07:53:13 Mike IP-BLOCK 216.18.239.157 07:53:15 Mike IP-BLOCK 216.18.239.157 07:53:15 Mike IP-BLOCK 216.18.239.157 07:53:15 Mike IP-BLOCK 216.18.239.157 07:53:17 Mike IP-BLOCK 216.18.239.157 07:53:18 Mike IP-BLOCK 216.18.239.157 07:53:19 Mike IP-BLOCK 216.18.239.157 07:53:24 Mike IP-BLOCK 216.18.239.157 07:53:27 Mike IP-BLOCK 216.18.239.157 07:53:28 Mike IP-BLOCK 216.18.239.157 07:53:29 Mike IP-BLOCK 216.18.239.157 07:53:30 Mike IP-BLOCK 216.18.239.157 07:53:31 Mike IP-BLOCK 216.18.239.157 07:53:31 Mike IP-BLOCK 216.18.239.157 07:53:32 Mike IP-BLOCK 216.18.239.157 07:53:34 Mike IP-BLOCK 216.18.239.157 07:53:36 Mike IP-BLOCK 216.18.239.157 07:53:37 Mike IP-BLOCK 216.18.239.157 07:53:37 Mike IP-BLOCK 216.18.239.157 07:53:37 Mike IP-BLOCK 216.18.239.157 07:53:38 Mike IP-BLOCK 216.18.239.157 07:53:40 Mike IP-BLOCK 216.18.239.157 07:53:40 Mike IP-BLOCK 216.18.239.157 07:53:43 Mike IP-BLOCK 216.18.239.157 07:53:46 Mike IP-BLOCK 216.18.239.157 07:53:50 Mike IP-BLOCK 216.18.239.157 07:53:50 Mike IP-BLOCK 216.18.239.157 07:53:51 Mike IP-BLOCK 216.18.239.157 07:53:52 Mike IP-BLOCK 216.18.239.157 07:53:53 Mike IP-BLOCK 216.18.239.157 07:53:54 Mike IP-BLOCK 216.18.239.157 07:53:56 Mike IP-BLOCK 216.18.239.157 07:53:56 Mike IP-BLOCK 216.18.239.157 07:53:58 Mike IP-BLOCK 216.18.239.157 07:53:59 Mike IP-BLOCK 216.18.239.157 07:53:59 Mike IP-BLOCK 216.18.239.157 07:53:59 Mike IP-BLOCK 216.18.239.157 07:54:00 Mike IP-BLOCK 216.18.239.157 07:54:02 Mike IP-BLOCK 216.18.239.157 07:54:05 Mike IP-BLOCK 216.18.239.157 07:54:05 Mike IP-BLOCK 216.18.239.157 07:54:11 Mike IP-BLOCK 216.18.239.157 07:54:11 Mike IP-BLOCK 216.18.239.157 07:54:11 Mike IP-BLOCK 216.18.239.157 07:54:14 Mike IP-BLOCK 216.18.239.157 07:54:14 Mike IP-BLOCK 216.18.239.157 07:54:14 Mike IP-BLOCK 216.18.239.157 07:54:17 Mike IP-BLOCK 216.18.239.157 07:54:18 Mike IP-BLOCK 216.18.239.157 07:54:20 Mike IP-BLOCK 216.18.239.157 07:54:20 Mike IP-BLOCK 216.18.239.157 07:54:20 Mike IP-BLOCK 216.18.239.157 07:54:21 Mike IP-BLOCK 216.18.239.157 07:54:23 Mike IP-BLOCK 216.18.239.157 07:54:23 Mike IP-BLOCK 216.18.239.157 07:54:24 Mike IP-BLOCK 216.18.239.157 07:54:27 Mike IP-BLOCK 216.18.239.157 07:54:28 Mike IP-BLOCK 216.18.239.157 07:54:29 Mike IP-BLOCK 216.18.239.157 07:54:33 Mike IP-BLOCK 216.18.239.157 07:54:33 Mike IP-BLOCK 216.18.239.157 07:54:33 Mike IP-BLOCK 216.18.239.157 07:54:35 Mike IP-BLOCK 216.18.239.157 07:54:36 Mike IP-BLOCK 216.18.239.157 07:54:36 Mike IP-BLOCK 216.18.239.157 07:54:38 Mike IP-BLOCK 216.18.239.157 07:54:41 Mike IP-BLOCK 216.18.239.157 07:54:41 Mike IP-BLOCK 216.18.239.157 07:54:42 Mike IP-BLOCK 216.18.239.157 07:54:42 Mike IP-BLOCK 216.18.239.157 07:54:43 Mike IP-BLOCK 216.18.239.157 07:54:44 Mike IP-BLOCK 216.18.239.157 07:54:44 Mike IP-BLOCK 216.18.239.157 07:54:48 Mike IP-BLOCK 216.18.239.157 07:54:49 Mike IP-BLOCK 216.18.239.157 07:54:50 Mike IP-BLOCK 216.18.239.157 07:54:51 Mike IP-BLOCK 216.18.239.157 07:54:55 Mike IP-BLOCK 216.18.239.157 07:54:57 Mike IP-BLOCK 216.18.239.157 07:54:57 Mike IP-BLOCK 216.18.239.157 07:54:58 Mike IP-BLOCK 216.18.239.157 07:55:02 Mike IP-BLOCK 216.18.239.157 07:55:02 Mike IP-BLOCK 216.18.239.157 07:55:02 Mike IP-BLOCK 216.18.239.157 07:55:05 Mike IP-BLOCK 216.18.239.157 07:55:05 Mike IP-BLOCK 216.18.239.157 07:55:05 Mike IP-BLOCK 216.18.239.157 07:55:11 Mike IP-BLOCK 216.18.239.157 07:55:11 Mike IP-BLOCK 216.18.239.157 07:55:11 Mike IP-BLOCK 216.18.239.157 07:55:24 Mike IP-BLOCK 216.18.239.157 07:55:24 Mike IP-BLOCK 216.18.239.157 07:55:24 Mike IP-BLOCK 216.18.239.157 07:55:25 Mike IP-BLOCK 216.18.239.157 07:55:27 Mike IP-BLOCK 216.18.239.157 07:55:27 Mike IP-BLOCK 216.18.239.157 07:55:27 Mike IP-BLOCK 216.18.239.157 07:55:27 Mike IP-BLOCK 216.18.239.157 07:55:28 Mike IP-BLOCK 216.18.239.157 07:55:31 Mike IP-BLOCK 216.18.239.157 07:55:33 Mike IP-BLOCK 216.18.239.157 07:55:33 Mike IP-BLOCK 216.18.239.157 07:55:33 Mike IP-BLOCK 216.18.239.157 07:55:34 Mike IP-BLOCK 216.18.239.157 07:55:37 Mike IP-BLOCK 216.18.239.157 07:55:46 Mike IP-BLOCK 216.18.239.157 07:55:46 Mike IP-BLOCK 216.18.239.157 07:55:49 Mike IP-BLOCK 216.18.239.157 07:55:49 Mike IP-BLOCK 216.18.239.157 07:55:55 Mike IP-BLOCK 216.18.239.157 07:55:55 Mike IP-BLOCK 216.18.239.157 07:58:24 Mike IP-BLOCK 216.18.239.157 07:58:27 Mike IP-BLOCK 216.18.239.157 07:58:33 Mike IP-BLOCK 216.18.239.157 07:58:45 Mike IP-BLOCK 216.18.239.157 07:58:46 Mike IP-BLOCK 216.18.239.157 07:58:48 Mike IP-BLOCK 216.18.239.157 07:58:49 Mike IP-BLOCK 216.18.239.157 07:58:49 Mike IP-BLOCK 216.18.239.157 07:58:54 Mike IP-BLOCK 216.18.239.157 07:58:55 Mike IP-BLOCK 216.18.239.157 07:58:55 Mike IP-BLOCK 216.18.239.157 08:11:36 Mike IP-BLOCK 213.163.89.104 08:11:39 Mike IP-BLOCK 213.163.89.104 08:11:45 Mike IP-BLOCK 213.163.89.104 08:27:57 Mike IP-BLOCK 213.163.89.104 08:28:00 Mike IP-BLOCK 213.163.89.104 08:28:06 Mike IP-BLOCK 213.163.89.104 08:44:18 Mike IP-BLOCK 213.163.89.104 08:44:21 Mike IP-BLOCK 213.163.89.104 08:44:27 Mike IP-BLOCK 213.163.89.104 09:07:39 Mike IP-BLOCK 213.163.89.104 09:07:42 Mike IP-BLOCK 213.163.89.104 09:07:48 Mike IP-BLOCK 213.163.89.104 09:19:01 Mike IP-BLOCK 213.163.89.104 09:19:04 Mike IP-BLOCK 213.163.89.104 09:19:10 Mike IP-BLOCK 213.163.89.104
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:


Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

    Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.
Hibernate is working again.
Have not had any site block warnings from MBAM in the past 30 minutes.

Thank you for all of your help. :)

Combofix log:


ComboFix 10-05-30.09 - Mike 05/31/2010 10:54:53.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1202 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Mike\Application Data\inst.exe
c:\program files\Error Repair Professional
c:\program files\Error Repair Professional\Backups\Backup_22-15-5_15-9-2009.reg
c:\program files\Error Repair Professional\Backups\Backup_22-23-33_20-7-2009.reg
c:\program files\Error Repair Professional\Backups\Backup_22-3-38_20-7-2009.reg
c:\program files\Error Repair Professional\Backups\Backup_22-32-3_20-7-2009.reg
c:\program files\Error Repair Professional\Backups\Backup_22-33-37_26-8-2009.reg
c:\program files\Error Repair Professional\Backups\Backup_9-43-44_29-8-2009.reg
c:\windows\system32\st325602.dll

Infected copy of c:\windows\system32\drivers\mouclass.sys was found and disinfected
Restored copy from - Kitty had a snack :P
.
((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-31 )))))))))))))))))))))))))))))))
.

2010-05-31 02:04 . 2010-05-31 02:04 ——– d—–w- c:\windows\Cache
2010-05-31 02:04 . 2010-05-31 02:04 ——– d—–w- c:\program files\Coupons
2010-05-30 20:04 . 2010-05-30 20:05 ——– d—–w- c:\documents and settings\Mike\Application Data\vlc
2010-05-29 23:35 . 2010-05-30 11:55 63488 —-a-w- c:\documents and settings\Mike\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-05-29 23:35 . 2010-05-29 23:35 52224 —-a-w- c:\documents and settings\Mike\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-05-29 23:35 . 2010-05-30 11:55 117760 —-a-w- c:\documents and settings\Mike\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-29 23:35 . 2010-05-29 23:35 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-05-29 23:34 . 2010-05-29 23:34 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-05-29 17:58 . 2010-05-29 17:58 ——– d—–w- c:\program files\iPod
2010-05-29 17:58 . 2010-05-29 17:59 ——– d—–w- c:\program files\iTunes
2010-05-29 17:52 . 2010-05-29 17:52 ——– d—–w- c:\program files\Bonjour
2010-05-29 17:50 . 2010-05-29 17:50 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe
2010-05-29 14:23 . 2010-05-29 14:23 2 –shatr- c:\windows\winstart.bat
2010-05-29 14:23 . 2010-05-29 20:02 ——– d—–w- c:\program files\UnHackMe
2010-05-29 14:20 . 2010-05-29 14:20 ——– d—–w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-29 04:39 . 2010-05-29 04:39 711168 —-a-w- c:\windows\is-GNOQQ.exe
2010-05-22 17:38 . 2010-05-22 17:38 ——– d—–w- c:\program files\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-31 14:52 . 2008-03-17 17:46 0 —-a-w- c:\documents and settings\Mike\Local Settings\Application Data\WavXMapDrive.bat
2010-05-31 03:12 . 2008-09-14 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-05-29 23:35 . 2008-12-21 16:00 ——– d—–w- c:\documents and settings\Mike\Application Data\SUPERAntiSpyware.com
2010-05-29 20:03 . 2010-02-21 00:08 ——– d—–w- c:\program files\Yahoo!
2010-05-29 20:02 . 2009-07-01 00:51 ——– d—–w- c:\program files\SpywareGuard
2010-05-29 20:00 . 2009-06-25 16:33 ——– d—–w- c:\program files\Pando Networks
2010-05-29 19:58 . 2008-03-04 02:21 ——– d—–w- c:\program files\Google
2010-05-29 19:51 . 2008-12-21 14:52 ——– d—–w- c:\program files\CCleaner
2010-05-29 17:58 . 2008-03-22 21:15 ——– d—–w- c:\program files\Common Files\Apple
2010-05-29 14:26 . 2008-12-21 15:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-19 00:09 . 2009-02-12 00:55 ——– d—–w- c:\program files\Motorola Phone Tools
2010-05-19 00:06 . 2009-02-12 01:09 ——– d—–w- c:\program files\Motorola
2010-05-18 23:59 . 2009-02-12 01:02 ——– d—–w- c:\program files\Avanquest update
2010-05-11 23:36 . 2008-03-04 02:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-29 19:39 . 2008-12-21 15:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2008-12-21 15:07 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-24 17:09 . 2010-04-24 17:08 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-24 17:02 . 2010-04-24 17:01 ——– d—–w- c:\program files\QuickTime
2010-04-24 16:43 . 2008-03-22 04:29 ——– d—–w- c:\program files\Safari
2010-04-24 16:36 . 2010-04-24 16:36 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-04-19 18:59 . 2010-04-19 18:59 255472 —-a-w- c:\documents and settings\Mike\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-04-11 00:21 . 2010-04-11 00:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2010-04-10 03:09 . 2008-05-15 23:35 ——– d—–w- c:\program files\ORS Nasco EPB
2010-04-08 17:20 . 2010-04-08 17:20 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-04-08 17:20 . 2010-04-08 17:20 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-03-12 21:13 . 2010-03-12 21:13 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-03-10 06:15 . 2004-08-11 23:00 420352 ——w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Mike\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-08 133104]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-05-18 2397424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-04-16 159744]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2007-09-10 92160]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2007-09-14 218424]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-10-09 2183168]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-24 17920]
"Client Access Service"="c:\program files\IBM\Client Access\cwbsvstr.exe" [2004-01-23 20530]
"Client Access Help Update"="c:\program files\IBM\Client Access\cwbinhlp.exe" [2004-01-23 24626]
"Client Access Check Version"="c:\program files\IBM\Client Access\cwbckver.exe" [2004-01-23 45106]
"Client Access Express Welcome"="c:\program files\IBM\Client Access\cwbwlwiz.exe" [2004-01-23 20480]
"Client Access PC5250 Sound"="c:\program files\IBM\Client Access\Emulator\pcssnd.exe" [2004-01-23 40960]
"Acrobat Synchronizer"="c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe" [2007-05-11 738968]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"EPSON Stylus CX6400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE" [2003-06-03 99840]
"\\macdaddy\EPSON Stylus CX6400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE" [2003-06-03 99840]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-06-08 128560]
"\\192.168.1.5\EPSON Stylus CX6400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE" [2003-06-03 99840]
"\\192.168.1.3\EPSON Stylus CX6400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE" [2003-06-03 99840]
"\\MACDADDY-2\EPSON Stylus CX6400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2L1.EXE" [2003-06-03 99840]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-9-12 805392]
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-2-5 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-17 19:46 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gemsafe]
2006-11-16 21:20 73728 —-a-w- c:\program files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 06:42 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-09-25 15:12 90112 —-a-w- c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 13:14 206112 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2009-10-16 17:51 2363392 —-a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 01:53 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-05-21 15:34 148888 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Documents and Settings\\Mike\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Mike\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/14/2008 7:52 PM 335240]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 Acceler8DB Server;Acceler8DB Server;c:\program files\ASNA\ADB Engine 5.0\adbntsvc.exe [3/17/2008 5:20 PM 620224]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [12/19/2006 4:21 PM 79432]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/14/2008 7:52 PM 297752]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/21/2008 11:07 AM 304464]
R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [5/28/2010 11:44 PM 91456]
R2 Wave UCSPlus;Wave UCSPlus;c:\windows\system32\dllhost.exe [8/11/2004 7:00 PM 5120]
R3 DXEC01;DXEC01;c:\windows\system32\drivers\dxec01.sys [11/2/2006 2:32 PM 97536]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/21/2008 11:07 AM 20952]
S2 RoxLiveShare10;LiveShare P2P Server 10;"c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe" –> c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [?]
S2 SessionLauncher;SessionLauncher;c:\docume~1\Mike\LOCALS~1\Temp\DX9\SessionLauncher.exe –> c:\docume~1\Mike\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys –> c:\windows\system32\DRIVERS\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys –> c:\windows\system32\DRIVERS\motccgpfl.sys [?]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys –> c:\windows\system32\DRIVERS\motodrv.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [9/6/2009 7:42 PM 223128]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/6/2009 5:29 PM 721904]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-10-16 17:49 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-05-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-05-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-599609648-1583942630-1237804090-1026Core.job
- c:\documents and settings\Mike\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-08 04:04]

2010-05-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-599609648-1583942630-1237804090-1026UA.job
- c:\documents and settings\Mike\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-08 04:04]

2010-05-31 c:\windows\Tasks\User_Feed_Synchronization-{5B449BE2-693E-4295-81CB-8CDBF5FA59E4}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.dogpile.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {{8E3DCE4C-76F6-40CD-A8B9-6D4739CB8F27}
DPF: {1ACECAFE-0015-0000-0000-ABCDEFFEDCBA} - hxxp://
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-31 11:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\ASNA\Shared\Security Provider*Wrong guess again!]
""="{EAA39388-6E10-4FB4-ADD8-876AFA05E34D}"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(892)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'lsass.exe'(956)
c:\windows\system32\wvauth.dll
c:\windows\system32\biolsp.dll
.
Completion time: 2010-05-31 11:09:06
ComboFix-quarantined-files.txt 2010-05-31 15:09

Pre-Run: 49,486,032,896 bytes free
Post-Run: 49,527,742,464 bytes free

Current=4 Default=4 Failed=3 LastKnownGood=1 Sets=1,2,3,4
- - End Of File - - E13CEBA58F363AD7564A5AD4BBE3DD9E
Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

c:\windows\is-GNOQQ.exe


Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


Do the same for:

c:\windows\winstart.bat



If virscan.org is too busy you can try these.

http://virscan.org/

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html
Filename: is-GNOQQ.exe Status: Scan finished. 0 out of 19 scanners reported malware. Scan taken on: Mon 31 May 2010 18:08:30 (CET) Permalink File size: 711168 bytes Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: 296a2fac6a99515a8a57d6af147890e6 SHA1: 44e5e5bedf8527fd15a25ff0fab1cd8cd34b82a8 c:\windows\winstart.bat ?? I not finding this with either a physical search or using the search function of Windows.
Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

If you used DeFogger
You must remember to re-enable your Emulation drivers once we are finished, double click DeFogger to run the tool.

  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.


To be on the safe side, I would also change all my passwords.



Here's my usual all clean post

Log looks good :D


  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
    5. Change the Download signed ActiveX controls to Prompt
    6. Change the Download unsigned ActiveX controls to Disable
    7. Change the Initialize and script ActiveX controls not marked as safe to Disable
    8. Change the Installation of desktop items to Prompt
    9. Change the Launching programs and files in an IFRAME to Prompt
    10. Change the Navigate sub-frames across different domains to Prompt
    11. When all these settings have been made, click on the OK button.
    12. If it prompts you as to whether or not you want to save the settings, press the Yes button.

  • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.


I would suggest you read How to Prevent Malware:
ComboFix uninstalled. Did not use Defogger. The IE Security Settings were already set to your suggestions. Windows Firewall was already on with a small list of exceptions. I presently have the freeware AVG, freeware SuperAntiSpyware and the "shareware" MBAM. Too many? Too little? Thank you!

I presently have the freeware AVG, freeware SuperAntiSpyware and the "shareware" MBAM.

Too many? Too little?

That should be fine. Run MBAM once a wekk or if anything starts acting strange

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI