What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Is my laptop infected?

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

OK, what now lol?


Let's try a different one :)

Please run a free online scan with the ESET Online Scanner
Note: ESET was designed to run with Internet Explorer, compatibility with other browsers has been added recently but if you find difficulty, go to using Internet Explorer
  • Click the green ESET Online Scanner box
  • Tick the box next to YES, I accept the Terms of Use
  • You may see a panel towards the top of the screen telling you the website wants to install an addon… click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
  • Click Start and if your security program asks you if you want to allow the program, click yes.
  • If you anti-virus is active you may see a panel appear warning you that this may affect performance. Disabling the programs listed may speed things along.
  • Make sure that the options Remove found threats and Scan archives are checked (do not worry about advanced settings)
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt (open Notepad > File > Open and navigate to the log.txt)
  • Copy and paste that log as a reply to this topic
Post #17
Hey, I looked under the program files but could not find any document to save as txt. I did hit uninstall after scan without thinking. The program found nothing, at least visibly, while it scanned. It scanned all the way and said zero viruses detected.
Post #19 last edited
Hi, well it appears some of the symptoms are gone from my computer. I can finally listen to music again which is awesome, so thanks! Also, the windows defender does not come up on startup saying that my AVG is not working. So I'm assuming it is. I will run scans with it soon. The only problem I seem to be having now is accessing certain websites, such as my gmail will not load unless I wait for the screen to appear for basic non HTML mode or whatever and then it will load automatically. Also, I can't view my messages on Facebook, I can see them but cannot click on them, and cannot also seem to post comments on people'es facebook pages. Also some of the text on websites seems slightly notgood up. Which is all weird since this was not happening before. So glad I got my music back though. Any fixes for what is happening now? Thanks so much for all your help finally listening to some tunes is great :)
Post #20

Any fixes for what is happening now?


Hmm…

Try this:

Navigate to C:\_OTL\Moved Files and locate this file C:\Windows\ODBC.INI. Copy and past it back to C:\Windows\ODBC.INI. Exactly like that.

Come back and tell me if that has made a difference.

Next post we will go to clearing away the tools we have been using, all going well. :)
Post #21
Okay, I will try to do tihs right now. I forgot to mention that I did a system restore so I think that is why my music is working again because one of the windows updates seems to kill my music for some reason. Ok I wil let you know any difference. Thanks!
Post #22
I went into those files, but could not find the file you specified. However, IOBit is hiding in there somwhere along with Advanced System Care 3 which gave me trouble trying to get rid of it ealier.
Post #23

I did a system restore so


Oh okay, when did you do this was it before or after that last scan by ESET for example?

The reason for my question is that often malware can hide in System Restore. We don't touch that during the cleaning procedure. If something goes wrong we can always use System Restore (albeit reintroducing malware) to get your machine back. At the end of the cleaning procedure though (would have been next post) we reset System Restore to make sure that no malware is left behind. The same goes for the ones you saw in OTL moved files. As long as System Restore is not accessed malware can't access you computer from there. In this case however you have used it hence the need to check.

Now

Please use the System File Checker tool (SFC.exe) to check your system and replace files where necessary.

To do this, follow these steps:
  • To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  • If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.
  • Type the following command, and then press ENTER:
    sfc /scannow Please note that there is a single space between sfc and /scannow.
The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.

When you return please tell me about that System Restore and whether System File Checker has made any difference with your machines current symptoms. :)
Post #24 last edited
Hi, I did the system restore after all scans. I used the SFC program, it said it did not find any integrity problems. However I am still having these issues with Facebook and such. It seems to be any non-regular, not sure what they're called hyperlink, such as a button is needed. Like commenting on facebook, and I also can't it to go past a button on ebay as I was tryining to sell some items today. Hmmmm. Not what what to do about these issues, perhaps they will work themselves out on their own? Also, my gmail is still not loading unless I let it go to non HTML or whatever. Hmmm wtf happened to my computer lol? Thanks for all the help btw :)
Post #25
Hello again lindemannn327,

I did the system restore after all scans.


That means you will likely have reintroduced any malware that was there.

If you want to make sure your machine is clean we need to start from the beginning again. We won't know if your machines symptoms are malware related until we have done that.

Now

This time check with me first before you decide to restore or do anything else. ;)

You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here.

If you no-longer have Malwarebytes please download from Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy & Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

  • Close all windows and open OTL again.
  • Click Run Scan and let the program run uninterrupted
  • It will produce a log for you. Post the log here.
So when you return please post
  • MBAM scan results
  • OTL log
Post #26
Hey, sorry I did the restore without asking lol. At least it got my music working again though. OK, here are the logs:




Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4186

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

6/10/2010 2:08:18 PM
mbam-log-2010-06-10 (14-08-18).txt

Scan type: Quick scan
Objects scanned: 126232
Time elapsed: 5 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





================================================================================
===================





OTL logfile created on: 6/10/2010 2:16:00 PM - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Users\Christopher\Documents\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 55.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 173.32 Gb Free Space | 74.42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CHRISTOPHER-PC
Current User Name: Christopher
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/10 14:14:27 | 000,572,416 | —- | M] (OldTimer Tools) – C:\Users\Christopher\Documents\Downloads\OTL.exe
PRC - [2010/05/22 11:37:11 | 000,840,416 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/05/22 11:37:10 | 001,314,704 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2010/04/21 08:52:25 | 002,064,736 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/04/21 08:52:23 | 000,620,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/04/16 08:33:40 | 000,144,672 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/04/01 17:20:10 | 001,101,152 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/03/13 12:18:55 | 000,508,184 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/03/13 12:18:52 | 000,308,064 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/03/13 12:18:18 | 000,916,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/03/13 12:18:17 | 000,710,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2007/06/23 15:28:32 | 000,331,851 | —- | M] () – C:\Program Files\Dell\Dell Mobile Broadband\systray.exe
PRC - [2007/05/09 18:01:00 | 000,036,864 | —- | M] (Creative Technology Ltd.) – C:\Windows\OEM02Mon.exe


========== Modules (SafeList) ==========

MOD - [2010/06/10 14:14:27 | 000,572,416 | —- | M] (OldTimer Tools) – C:\Users\Christopher\Documents\Downloads\OTL.exe
MOD - [2010/03/13 12:18:54 | 000,012,464 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
MOD - [2009/04/11 02:21:38 | 001,686,016 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/20 22:24:37 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/05/22 11:37:10 | 001,314,704 | —- | M] (Lavasoft) [Auto | Running] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/04/16 08:33:40 | 000,144,672 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/03/13 12:18:52 | 000,308,064 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG9\avgwdsvc.exe – (avg9wd)
SRV - [2010/03/13 12:18:18 | 000,916,760 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG9\avgemc.exe – (avg9emc)
SRV - [2010/01/07 15:38:18 | 000,447,216 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\ZuneWlanCfgSvc.exe – (ZuneWlanCfgSvc)
SRV - [2010/01/07 15:38:08 | 005,950,704 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Zune\ZuneNss.exe – (ZuneNetworkSvc)
SRV - [2009/09/24 21:27:04 | 000,793,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2008/01/20 22:23:32 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)


========== Driver Services (SafeList) ==========

DRV - [2010/04/21 08:52:23 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\Drivers\avgtdix.sys – (AvgTdiX)
DRV - [2010/03/19 13:22:36 | 000,023,096 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\CamdAudio.sys – (CamdAudio)
DRV - [2010/03/13 12:18:54 | 000,029,512 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\Drivers\avgmfx86.sys – (AvgMfx86)
DRV - [2010/03/13 12:18:17 | 000,216,200 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\Drivers\avgldx86.sys – (AvgLdx86)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(5).sys – (WsAudio_DeviceS(5)) WsAudio_DeviceS(5)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(4).sys – (WsAudio_DeviceS(4)) WsAudio_DeviceS(4)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(3).sys – (WsAudio_DeviceS(3)) WsAudio_DeviceS(3)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(2).sys – (WsAudio_DeviceS(2)) WsAudio_DeviceS(2)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(1).sys – (WsAudio_DeviceS(1)) WsAudio_DeviceS(1)
DRV - [2010/02/04 11:53:02 | 000,064,288 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2009/12/21 15:34:24 | 000,037,920 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tbhsd.sys – (tbhsd)
DRV - [2008/02/11 20:36:10 | 002,302,976 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2008/01/20 22:23:49 | 000,007,680 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\umpass.sys – (UMPass)
DRV - [2008/01/20 22:23:27 | 000,386,616 | —- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasr.sys – (MegaSR)
DRV - [2008/01/20 22:23:27 | 000,149,560 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2008/01/20 22:23:27 | 000,031,288 | —- | M] (LSI Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2008/01/20 22:23:26 | 000,101,432 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2008/01/20 22:23:26 | 000,074,808 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2008/01/20 22:23:26 | 000,040,504 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2008/01/20 22:23:25 | 000,300,600 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2008/01/20 22:23:25 | 000,089,656 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2008/01/20 22:23:24 | 001,122,360 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2008/01/20 22:23:24 | 000,118,784 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2008/01/20 22:23:24 | 000,079,928 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2008/01/20 22:23:23 | 000,654,336 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\VSTCNXT3.SYS – (winachsf)
DRV - [2008/01/20 22:23:23 | 000,235,064 | —- | M] (Intel Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2008/01/20 22:23:23 | 000,130,616 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2008/01/20 22:23:23 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2008/01/20 22:23:23 | 000,079,416 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2008/01/20 22:23:22 | 000,987,648 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\VSTDPV3.SYS – (HSF_DPV)
DRV - [2008/01/20 22:23:22 | 000,342,584 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2008/01/20 22:23:22 | 000,200,704 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\VSTAZL3.SYS – (HSFHWAZL)
DRV - [2008/01/20 22:23:21 | 000,422,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2008/01/20 22:23:21 | 000,102,968 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2008/01/20 22:23:21 | 000,045,112 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2008/01/20 22:23:20 | 000,238,648 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2008/01/20 22:23:00 | 000,020,024 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/01/20 22:23:00 | 000,019,000 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/01/20 22:23:00 | 000,017,464 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/12/06 22:52:48 | 001,044,984 | —- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2007/12/06 22:52:48 | 001,044,984 | —- | M] (Broadcom Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XV)
DRV - [2007/12/06 10:51:00 | 000,298,496 | —- | M] (Marvell) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\yk60x86.sys – (yukonwlh)
DRV - [2007/10/10 18:03:00 | 000,235,648 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Dev.sys – (OEM02Dev)
DRV - [2007/06/01 14:57:18 | 000,178,176 | —- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NWADIenum.sys – (NWADI)
DRV - [2007/05/30 17:50:54 | 000,027,072 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\PCASp50.sys – (PCASp50)
DRV - [2007/03/05 11:45:04 | 000,007,424 | —- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Vfx.sys – (OEM02Vfx)
DRV - [2006/11/14 18:35:20 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/02 05:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 05:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 05:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 05:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 04:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


[2010/06/09 00:15:43 | 000,000,000 | —D | M] – C:\Users\Christopher\AppData\Roaming\Mozilla\Extensions
[2010/01/16 01:40:28 | 000,000,000 | —D | M] – C:\Users\Christopher\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/06/09 09:12:51 | 000,000,000 | —D | M] – C:\Users\Christopher\AppData\Roaming\Mozilla\Firefox\Profiles\urm013ag.default\extensions
[2010/06/09 02:00:34 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Christopher\AppData\Roaming\Mozilla\Firefox\Profiles\urm013ag.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/09 08:25:25 | 000,000,000 | —D | M] (BugMeNot) – C:\Users\Christopher\AppData\Roaming\Mozilla\Firefox\Profiles\urm013ag.default\extensions\{987311C6-B504-4aa2-90BF-60CC49808D42}
[2010/06/09 08:00:53 | 000,000,000 | —D | M] (No name found) – C:\Users\Christopher\AppData\Roaming\Mozilla\Firefox\Profiles\urm013ag.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/06/09 08:24:23 | 000,000,000 | —D | M] (LinkExtend) – C:\Users\Christopher\AppData\Roaming\Mozilla\Firefox\Profiles\urm013ag.default\extensions\{cf47767d-5f3a-4e32-9fce-5d79565c9702}
[2010/06/09 09:12:51 | 000,000,000 | —D | M] – C:\Users\Christopher\AppData\Roaming\Mozilla\Firefox\Profiles\urm013ag.default\extensions\[removed]
[2010/06/09 00:15:22 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [systray] C:\Program Files\Dell\Dell Mobile Broadband\systray.exe ()
O4 - Startup: C:\Users\Christopher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img17.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img17.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/09 09:12:51 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2010/06/09 05:28:27 | 000,000,000 | —D | C] – C:\Users\Christopher\Desktop\WhatThe Tech
[2010/06/09 00:15:20 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/06/07 21:11:44 | 000,000,000 | —D | C] – C:\_OTL
[2010/06/07 18:03:50 | 000,000,000 | —D | C] – C:\Users\Christopher\Desktop\Shoe Pics
[2010/06/06 20:21:04 | 000,000,000 | —D | C] – C:\ProgramData\WindowsSearch
[2010/05/31 14:20:04 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Local\Mozilla
[2010/05/31 14:14:51 | 000,000,000 | —D | C] – C:\Program Files\XeroBank
[2010/05/30 09:58:40 | 000,000,000 | —D | C] – C:\Windows\pss
[2010/05/29 20:16:49 | 000,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2010/05/27 11:09:04 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2010/05/27 11:08:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2010/05/22 11:16:06 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Roaming\Yahoo!
[2010/05/22 11:16:05 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2010/05/22 11:15:53 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/05/22 08:57:42 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Roaming\LimeWire
[2010/05/17 19:42:49 | 000,000,000 | —D | C] – C:\Program Files\ReviverSoft
[2010/05/17 19:42:30 | 000,000,000 | —D | C] – C:\ProgramData\ReviverSoft
[2010/05/15 17:42:38 | 000,000,000 | —D | C] – C:\Program Files\LimeWire

========== Files - Modified Within 30 Days ==========

[2010/06/10 14:16:16 | 002,097,152 | -HS- | M] () – C:\Users\Christopher\ntuser.dat
[2010/06/10 13:51:37 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/06/10 13:51:37 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/06/10 13:46:01 | 000,000,932 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1518083110-2845193643-2763625782-1000UA.job
[2010/06/10 10:37:46 | 000,690,960 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/06/10 10:37:46 | 000,595,684 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/06/10 10:37:46 | 000,101,350 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/06/10 10:35:17 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/06/10 09:51:57 | 000,000,439 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.ics
[2010/06/10 09:51:57 | 000,000,324 | —- | M] () – C:\Windows\tasks\GlaryInitialize.job
[2010/06/10 09:51:44 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/06/10 09:51:25 | 3210,784,768 | -HS- | M] () – C:\hiberfil.sys
[2010/06/10 02:04:23 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/06/10 02:04:17 | 000,524,288 | -HS- | M] () – C:\Users\Christopher\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/06/10 02:04:17 | 000,065,536 | -HS- | M] () – C:\Users\Christopher\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/06/10 02:04:13 | 001,518,752 | -H– | M] () – C:\Users\Christopher\AppData\Local\IconCache.db
[2010/06/10 00:46:00 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1518083110-2845193643-2763625782-1000Core.job
[2010/06/09 23:17:12 | 060,871,309 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/06/04 16:50:29 | 000,255,179 | —- | M] () – C:\Users\Christopher\Desktop\ASM CNN Brochure.pdf
[2010/06/03 22:29:44 | 000,000,162 | -H– | M] () – C:\Users\Christopher\Desktop\~$ofessional references.doc
[2010/05/28 15:03:25 | 000,029,184 | —- | M] () – C:\Users\Christopher\Desktop\Chris Lindemann Resume-1.doc
[2010/05/22 11:12:56 | 000,019,968 | —- | M] () – C:\Users\Christopher\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/22 08:58:26 | 000,001,658 | —- | M] () – C:\Users\Christopher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk

========== Files Created - No Company Name ==========

[2010/06/04 16:50:29 | 000,255,179 | —- | C] () – C:\Users\Christopher\Desktop\ASM CNN Brochure.pdf
[2010/06/03 22:29:44 | 000,000,162 | -H– | C] () – C:\Users\Christopher\Desktop\~$ofessional references.doc
[2010/05/22 08:58:26 | 000,001,658 | —- | C] () – C:\Users\Christopher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010/05/12 18:46:41 | 000,029,184 | —- | C] () – C:\Users\Christopher\Desktop\Chris Lindemann Resume-1.doc
[2010/01/11 13:22:40 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/11/25 04:24:49 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/11/17 22:05:30 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2009/03/02 12:33:32 | 000,067,584 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/03/02 12:33:32 | 000,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2008/02/11 20:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/05/06 20:06:00 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
< End of report >




================================================================================
======================================
Post #28
Hello again lindemannn327,

Looks good, because of the symptoms your machine is experiencing I think we ought to run another tool just to make sure.

Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Post #29
Ok, ran the program, here is the log:




ComboFix 10-06-10.02 - Christopher 06/10/2010 16:21:37.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3061.1667 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-05-10 to 2010-06-10 )))))))))))))))))))))))))))))))
.

2010-06-10 20:25 . 2010-06-10 20:25 ——– d—–w- c:\users\Christopher\AppData\Local\temp
2010-06-10 20:13 . 2010-06-10 20:19 ——– d—–w- C:\32788R22FWJFW
2010-06-10 18:43 . 2010-06-10 18:43 29512 —-a-w- c:\programdata\avg9\update\backup\avgmfx86.sys
2010-06-10 18:43 . 2010-06-10 18:43 242896 —-a-w- c:\programdata\avg9\update\backup\avgtdix.sys
2010-06-09 13:12 . 2010-06-09 13:12 ——– d—–w- c:\program files\Ask.com
2010-06-08 01:11 . 2010-06-08 01:11 ——– d—–w- C:\_OTL
2010-06-07 00:21 . 2010-06-07 00:21 ——– d—–w- c:\programdata\WindowsSearch
2010-05-31 18:20 . 2010-05-31 18:20 ——– d—–w- c:\users\Christopher\AppData\Local\Mozilla
2010-05-31 18:14 . 2010-06-06 21:22 ——– d—–w- c:\program files\XeroBank
2010-05-27 15:09 . 2010-05-27 15:09 ——– d—–w- c:\users\Christopher\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
2010-05-27 15:08 . 2010-05-27 15:08 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-05-22 15:16 . 2010-05-22 15:16 ——– d—–w- c:\users\Christopher\AppData\Roaming\Yahoo!
2010-05-22 15:16 . 2010-05-22 15:16 ——– d—–w- c:\program files\Yahoo!
2010-05-22 15:15 . 2010-06-10 03:07 ——– d—–w- c:\program files\CCleaner
2010-05-17 23:42 . 2010-05-17 23:42 ——– d—–w- c:\program files\ReviverSoft
2010-05-17 23:42 . 2010-05-17 23:42 ——– d—–w- c:\programdata\ReviverSoft
2010-05-15 21:42 . 2010-05-22 12:56 ——– d—–w- c:\program files\LimeWire
2010-05-12 14:15 . 2010-01-29 15:40 738816 —-a-w- c:\windows\system32\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-10 18:48 . 2010-05-22 12:57 ——– d—–w- c:\users\Christopher\AppData\Roaming\LimeWire
2010-06-10 18:44 . 2009-11-18 01:01 12 —-a-w- c:\windows\bthservsdp.dat
2010-06-10 18:42 . 2009-11-19 04:21 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-10 18:42 . 2009-11-19 04:21 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-06-10 03:08 . 2010-01-05 01:35 ——– d—–w- c:\program files\uTorrent
2010-06-10 03:08 . 2009-11-19 03:16 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-10 03:08 . 2010-01-16 06:49 ——– d—–w- c:\program files\Glary Utilities
2010-06-10 03:08 . 2009-11-19 03:18 ——– d—–w- c:\program files\IObit
2010-06-10 03:08 . 2010-04-29 22:57 ——– d—–w- c:\program files\Bonjour
2010-06-07 22:38 . 2009-11-19 03:18 ——– d—–w- c:\users\Christopher\AppData\Roaming\IObit
2010-06-01 23:50 . 2009-11-19 04:21 ——– d—–w- c:\programdata\avg9
2010-05-27 21:11 . 2010-01-05 01:34 ——– d—–w- c:\users\Christopher\AppData\Roaming\uTorrent
2010-05-22 15:38 . 2009-11-19 05:12 ——– d—–w- c:\programdata\Lavasoft
2010-05-22 15:35 . 2010-04-29 22:59 ——– d—–w- c:\program files\QuickTime
2010-05-22 15:29 . 2009-12-22 03:22 ——– d—–w- c:\users\Christopher\AppData\Roaming\Skype
2010-05-16 17:47 . 2009-11-19 03:20 ——– d—–w- c:\program files\AIM
2010-05-13 07:00 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-05-07 16:55 . 2010-05-07 16:55 255472 —-a-w- c:\users\Christopher\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
2010-04-29 23:01 . 2010-03-28 22:21 ——– d—–w- c:\program files\iTunes
2010-04-29 23:00 . 2010-04-29 23:00 ——– d—–w- c:\program files\iPod
2010-04-29 23:00 . 2010-03-28 22:15 ——– d—–w- c:\program files\Common Files\Apple
2010-04-29 22:59 . 2010-03-28 22:18 ——– d—–w- c:\programdata\Apple Computer
2010-04-29 22:59 . 2010-04-29 22:59 ——– d—–w- c:\program files\Apple Software Update
2010-04-29 22:57 . 2010-04-29 22:57 ——– d—–w- c:\programdata\Apple
2010-04-29 19:39 . 2009-11-19 03:16 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2009-11-19 03:16 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-28 19:45 . 2010-04-28 19:45 73000 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe
2010-04-20 03:40 . 2009-11-18 01:00 1356 —-a-w- c:\users\Christopher\AppData\Local\d3d9caps.dat
2010-04-19 08:21 . 2010-04-19 08:21 ——– d—–w- c:\program files\Windows Portable Devices
2010-04-19 08:21 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2010-04-18 07:19 . 2010-04-18 07:06 64 —-a-w- c:\windows\system32\rp_stats.dat
2010-04-18 07:19 . 2010-04-18 07:06 44 —-a-w- c:\windows\system32\rp_rules.dat
2010-04-18 07:15 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Calendar
2010-04-18 07:14 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Sidebar
2010-04-18 07:14 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Journal
2010-04-18 07:14 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Collaboration
2010-04-18 07:14 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Photo Gallery
2010-04-18 07:14 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Defender
2010-04-18 06:37 . 2009-12-22 03:22 ——– d—–w- c:\programdata\Skype
2010-04-18 06:37 . 2009-11-18 01:05 ——– d—–w- c:\program files\Dell
2010-04-18 06:25 . 2010-04-16 20:08 ——– dc-h–w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-04-18 06:00 . 2010-04-18 04:12 ——– d—–w- c:\users\Christopher\AppData\Roaming\GlarySoft
2010-04-18 05:26 . 2009-11-19 05:12 ——– d—–w- c:\program files\Lavasoft
2010-04-16 20:18 . 2009-11-27 01:12 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-04-16 20:18 . 2010-03-28 18:42 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-04-13 16:26 . 2010-04-13 16:26 ——– d—–w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-08 17:20 . 2010-04-08 17:20 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-04-08 17:20 . 2010-04-08 17:20 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-04-01 21:24 . 2010-04-01 21:24 690952 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-03-19 17:22 . 2010-03-30 04:51 23096 —-a-w- c:\windows\system32\drivers\CamdAudio.sys
2010-03-13 16:18 . 2010-03-13 16:18 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-13 16:18 . 2009-11-19 04:21 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"systray"="c:\program files\Dell\Dell Mobile Broadband\systray.exe" [2007-06-23 331851]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-08 3444736]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]

c:\users\Christopher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-3-30 503808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(B):00,df,a3,bd,c7,de,ca,01

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-05-22 1314704]
R3 CamdAudio;CamdAudio;c:\windows\system32\drivers\CamdAudio.sys [2010-03-19 23096]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2010-02-23 25704]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [2010-02-23 25704]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [2010-02-23 25704]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [2010-02-23 25704]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [2010-02-23 25704]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-04 64288]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-03-13 216200]
S1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-06-10 242896]
S2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-03-13 916760]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-03-13 308064]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9C450606-ED24-4958-92BA-B8940C99D441}]
2009-03-04 21:32 8192 —-a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2010-06-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 15:37]

2010-06-10 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-01-16 01:36]

2010-06-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1518083110-2845193643-2763625782-1000Core.job
- c:\users\Christopher\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-19 02:30]

2010-06-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1518083110-2845193643-2763625782-1000UA.job
- c:\users\Christopher\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-19 02:30]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-10 16:25
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-06-10 16:28:05
ComboFix-quarantined-files.txt 2010-06-10 20:28

Pre-Run: 185,078,390,784 bytes free
Post-Run: 185,129,512,960 bytes free

- - End Of File - - D41F4A0CBA619F5035CE1E01C4B92858
Post #30
Hello again lindemannn327,

All looks clean to me.

I don't think your gmail and facebook problems are malware related. I am not the best person to help you with fixing them.

You could try a IE repair to see whether that helps:

Go to support Microsoft for instructions on how to repair/reinstall your Internet Explorer.

Otherwise you might try opening a new topic in the technical area here http://forums.whatthetech.com/Microsoft_Windows_f119.html

Now

We have a couple of last steps to perform and then you're all set.[image unavailable: Posted Image]

Follow these steps to uninstall Combofix and tools used in the removal of malware. This will also clean out and reset your Restore Points.
Step 2
  • Double-click OTL.exe to run it. (Vista users, please right click on OTL.exe and select "Run as an Administrator")
  • Click on the CleanUp! button
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

MBAM can be uninstalled via control panel add/remove but it may be a useful tool to keep.

Next, we need to clean your restore points and set a new one:

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Restart your computer.

3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.
System Restore will now be active again.

——————————————————————————————————————-

A reminder: Remember to turn back on any anti-malware programs you may have turned off during the cleaning process.

——————————————————————————————————————-

Now that your machine is clean here are some things that I think are worth having a look at if you don't already know about them:

———————————————————————————————————————

Regularly check that your Java is up to date. Older versions are vunerable to malicious attack.
  • Download from here Java Runtime Environment (JDK) Update
  • Scroll to where it says "Windows XP/Vista/2000/2003/2008 online" and download and follow the instructions to install.

    Reboot your computer.
    You also need to uininstall older versions of Java.

  • Click Start > Control Panel > Add or Remove Programs
  • Remove all Java updates except the latest one you have just installed.
——————————————————————————————————————–

Be sure and give the Temp folders a cleaning out now and then. This helps with security and your computer will run more efficiently. I clean mine once a week.

For ease of use, you might consider the following free program:
  • TFC.exe
——————————————————————————————————————–

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* Consider using an alternate browser.

Opera may be downloaded from here. It is one of the least targeted of all browers.

Avant may be downloaded from here. Another one that is less well known.

Firefox may be downloaded from Here. I use Firefox because I like it. Used to be one of the safest but now targeted probably as much as IE.

Adblock Plus is a good Add-on for Firefox that helps prevent those annoying pop ups.
———————————————————————————————————————–

Startuplite is a tool to help you stop some programs not needed when you start your computer from loading. They will begin automatically only when needed.

———————————————————————————————————————–

To help protect your computer in the future here are some free programs you can look at:

  • It is recommended that you do set Windows to check, download and install your updates automatically.

    * Click Start > Control Panel > Automatic Updates
    * Set the day and time for the update check. Set this to a time when your computer will normally be on and connected to the internet.
    * Click Apply then OK.

    And to keep your system clean consider choosing from these free for home use malware scanners and updating and running weekly.
  • Malwarebytes
  • SuperAntiSpyWare
Be aware of what emails you open and websites you visit.

Go here for some good advice about how to prevent infection.

Have a safe and happy computing day!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI