What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Am I infected

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I really would appreciate some help here. I have been experiencing a reduced speed in my computer (running Windows Vista). I blamed the blackberry software and deleted it, and improved a lot. But know I see a very, very strange behaviour. For example, it deleted some network printers I had configured, and now I try to configure again it tells me that cannot connect to printers. It is still slow. I cannot use powerpoint (it takes 30 min to show a slide).
Someone had a look at it and told me I was infected by "smartfraud". I don´t know what that is, as I am not a real tech guy. And he did not tell me how to get rid of it. I have run Hauri antivirus daily (and updating daily) and nothing is found. I also ran Spybot S&D and does not find anything, but gives me a list of errors during the analysis (a bunch of files that could not be accessed). I ran hijackthis and got the following (together with an error saying that c:\Windows\System32\drivers\etc\hosts). The error message tells me that I should run the program as administrator (and I am doing that and still getting the error).

Please help us improve HijackThis by reporting this error

Click 'Yes' to submit


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 08:13:51 p.m., on 30/06/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18928)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Hauri\SiteClient\SiteCli.exe
C:\Program Files\Hauri\Common\Base\vrmonnt.exe
C:\Program Files\Hauri\ViRobot Desktop 5.5\PCFirewall\vrfwsock.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Aplicación auxiliar de inicio de sesión de Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SiteClient] C:\Program Files\Hauri\SiteClient\SiteCli.exe
O4 - HKLM\..\Run: [InitClient] C:\Program Files\Hauri\SiteClient\InitCli.exe
O4 - HKLM\..\Run: [HEProtect] C:\Program Files\Hauri\ViRobot Desktop 5.5\AntiSpam\HSockPE.exe
O4 - HKLM\..\Run: [VrSchedule] C:\Program Files\Hauri\ViRobot Desktop 5.5\AntiVirus\hrres.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\Hauri\Common\Base\VRMONNT.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Servicio de red')
O4 - Startup: Psi.lnk = C:\Program Files\Psi\psi.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @appmgmts.dll,-3250 (AppMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\cscsvc.dll,-200 (CscService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe
O23 - Service: @%SystemRoot%\system32\dhcpcsvc.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\emdmgmt.dll,-1000 (EMDMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (Eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\FntCache.dll,-100 (FontCache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ViRobot for WinNT™ Folder Protect (HFACSVC) - hauri - C:\Program Files\Hauri\ViRobot Desktop 5.5\AccessControl\HFACSvc.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: ViRobot Communication Service (hpcsvc) - HAURI - C:\Program Files\Hauri\ViRobot Desktop 5.5\hpcsvc.exe
O23 - Service: Hauri Common Service (hsvcmod) - Hauri, Inc. - C:\Program Files\Hauri\Common\hsvcmod.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-200 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\netman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netprof.dll,-246 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\nlasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\nsisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ipnathlp.dll,-106 (SharedAccess) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: ViRobot ISMS Client Service (SiteClientService) - HAURI - C:\Program Files\Hauri\SiteClient\clisvc.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe
O23 - Service: @%SystemRoot%\system32\SLUINotify.dll,-103 (SLUINotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%SystemRoot%\system32\sstpsvc.dll,-200 (SstpSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tapisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tbssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\termsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\trkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%SystemRoot%\system32\umrdp.dll,-1000 (UmRdpService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: ViRobot Common Scan Service - HAURI Inc. - C:\Program Files\Hauri\Common\Base\vrscan.exe
O23 - Service: Hauri Firewall (vrfwsvc) - Hauri inc. - C:\Program Files\Hauri\ViRobot Desktop 5.5\PCFirewall\vrfwsvc.exe
O23 - Service: ViRobot Desktop Monitoring (vrmonsvc) - Hauri, Inc. - C:\Program Files\Hauri\Common\Base\vrmonsvc.exe
O23 - Service: Hauri Self Protect Service (vrptsvc) - Hauri, Inc - C:\Program Files\Hauri\ViRobot Desktop 5.5\AccessControl\vrptsvc.exe
O23 - Service: ViRobot Repairing Service (vrrepair) - Hauri, Inc. - C:\Program Files\Hauri\Common\Base\vrrepair.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe

–
End of file - 22495 bytes


Thanks.
Post #2
Something else I forgot to say: When running Spybot S&D, I get like 200 or more error messages saying something like this (I have the Spanish version): Error during analysis! Cannot open the file c:\windows\System32\drivers\etc\hosts - Access denied. And when I try to open the hosts file with the notepad I am just told "Access denied" and that is it. I understand this file is sometimes changed by malware to send you to fake homepages, right?
Post #3
Hi

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT




Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #4
Thank you, CatByte, for your reply. Here is the content of dds.txt: DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 15:31:46.43 on 02/07/2010 Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_20 Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.52.3082.18.3032.1651 [GMT -5:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\WLANExt.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Hauri\ViRobot Desktop 5.5\AccessControl\HFACSvc.exe C:\Program Files\Hauri\ViRobot Desktop 5.5\hpcsvc.exe C:\Program Files\Hauri\Common\hsvcmod.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Hauri\SiteClient\clisvc.exe C:\Program Files\Hauri\Common\Base\vrscan.exe C:\Program Files\Hauri\ViRobot Desktop 5.5\PCFirewall\vrfwsvc.exe C:\Program Files\Hauri\Common\Base\vrmonsvc.exe C:\Program Files\Hauri\ViRobot Desktop 5.5\AccessControl\vrptsvc.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Hauri\Common\Base\vrrepair.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Hauri\SiteClient\SiteCli.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Psi\psi.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe C:\Windows\System32\svchost.exe -k swprv C:\Windows\system32\taskeng.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Users\Administrador\Desktop\dds.com C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com.mx/ BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Aplicación auxiliar de inicio de sesión de Windows Live ID: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [SiteClient] c:\program files\hauri\siteclient\SiteCli.exe mRun: [InitClient] c:\program files\hauri\siteclient\InitCli.exe mRun: [HEProtect] c:\program files\hauri\virobot desktop 5.5\antispam\HSockPE.exe mRun: [VrSchedule] c:\program files\hauri\virobot desktop 5.5\antivirus\hrres.exe mRun: [Vrmon] c:\program files\hauri\common\base\VRMONNT.EXE mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript StartupFolder: c:\users\admini~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\psi.lnk - c:\program files\psi\psi.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xportar a Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: igfxcui - igfxdev.dll STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll mASetup: {7070D8E0-650A-46b3-B03C-9497582E6A74} - %SystemRoot%\system32\soundschemes.exe /AddRegistration mASetup: {B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24} - %SystemRoot%\system32\soundschemes2.exe /AddRegistration ================= FIREFOX =================== FF - ProfilePath - c:\users\admini~1\appdata\roaming\mozilla\firefox\profiles\2jl3dovk.default\ FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npsharedview.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R2 hpcsvc;ViRobot Communication Service;c:\program files\hauri\virobot desktop 5.5\hpcsvc.exe [2010-2-11 513616] R2 SiteClientService;ViRobot ISMS Client Service;c:\program files\hauri\siteclient\CliSvc.exe [2010-2-11 1059328] R2 ViRobot Common Scan Service;ViRobot Common Scan Service;c:\program files\hauri\common\base\vrscan.exe [2010-2-11 176128] R2 vrptsvc;Hauri Self Protect Service;c:\program files\hauri\virobot desktop 5.5\accesscontrol\vrptsvc.exe [2010-6-30 247152] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet: NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-1-20 179712] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-30 112128] R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2008-8-7 97536] R3 VRFWNTD6;VRFWNTD6 Hauri Network Driver;c:\windows\system32\drivers\VRFWNTD6.SYS [2010-2-11 30208] R3 vrrepair;ViRobot Repairing Service;c:\program files\hauri\common\base\vrrepair.exe [2010-2-11 502368] R3 VRsecos;VRsecos;c:\windows\system32\drivers\VRsecos.sys [2010-2-11 15644] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-22 136176] S3 FontCache;Servicio de caché de fuentes de Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] S3 mirrorv3;mirrorv3;c:\windows\system32\drivers\rminiv3.sys [2006-11-1 3328] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-3-19 136704] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-3-19 8320] ============== File Associations =============== .scr=AutoCADScriptFile =============== Created Last 30 ================ 2010-07-01 22:40:47 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2010-07-01 22:40:47 49472 —-a-w- c:\windows\system32\netfxperf.dll 2010-07-01 22:40:47 297808 —-a-w- c:\windows\system32\mscoree.dll 2010-07-01 22:40:47 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2010-07-01 22:40:47 1130824 —-a-w- c:\windows\system32\dfshim.dll 2010-07-01 22:39:23 28672 —-a-w- c:\windows\system32\Apphlpdm.dll 2010-07-01 22:39:22 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2010-07-01 20:05:46 0 d—–w- c:\users\admini~1\appdata\roaming\Malwarebytes 2010-07-01 20:05:35 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-01 20:05:34 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-07-01 20:05:34 0 d—–w- c:\programdata\Malwarebytes 2010-07-01 20:05:33 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-07-01 01:05:44 0 d—–w- c:\program files\Trend Micro 2010-06-30 22:44:40 0 d—–w- c:\windows\pss 2010-06-30 14:56:39 0 d—–w- c:\program files\CCleaner 2010-06-30 14:56:06 0 d—–w- c:\windows\Advanced WindowsCare 2010-06-30 14:56:06 0 d—–w- c:\program files\Advanced WindowsCare 2010-06-28 15:40:37 0 d—–w- c:\program files\SDHelper (Spybot - Search & Destroy) 2010-06-28 15:40:36 0 d—–w- c:\program files\TeaTimer (Spybot - Search & Destroy) 2010-06-28 15:40:36 0 d—–w- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2010-06-28 15:40:36 0 d—–w- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2010-06-28 15:33:19 0 d—–w- c:\programdata\Spybot - Search & Destroy 2010-06-28 15:32:20 0 d—–w- c:\program files\Spybot - Search & Destroy 2010-06-25 17:23:55 0 d—–w- c:\program files\Research In Motion 2010-06-22 16:58:06 0 d—–w- c:\programdata\Google 2010-06-18 15:02:05 420352 —-a-w- c:\windows\system32\vbscript.dll 2010-06-18 15:02:01 79360 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2010-06-18 15:02:01 212992 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-06-18 15:02:01 106496 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-06-18 15:01:44 2048 —-a-w- c:\windows\system32\tzres.dll 2010-06-18 14:59:03 738816 —-a-w- c:\windows\system32\inetcomm.dll 2010-06-18 14:57:53 3600776 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-06-18 14:57:53 3548040 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-06-18 14:57:22 904576 —-a-w- c:\windows\system32\drivers\tcpip.sys 2010-06-18 14:57:21 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys 2010-06-18 14:57:21 200704 —-a-w- c:\windows\system32\iphlpsvc.dll 2010-06-18 14:57:02 172032 —-a-w- c:\windows\system32\wintrust.dll 2010-06-18 14:56:48 289792 —-a-w- c:\windows\system32\atmfd.dll 2010-06-18 14:56:47 34304 —-a-w- c:\windows\system32\atmlib.dll 2010-06-18 14:56:35 98304 —-a-w- c:\windows\system32\cabview.dll 2010-06-18 14:56:25 1696256 —-a-w- c:\windows\system32\gameux.dll 2010-06-18 14:56:10 67072 —-a-w- c:\windows\system32\asycfilt.dll 2010-06-18 14:55:55 62464 —-a-w- c:\windows\system32\l3codeca.acm 2010-06-18 14:55:55 220672 —-a-w- c:\windows\system32\l3codecp.acm 2010-06-18 14:45:04 0 d—–w- c:\programdata\Sun 2010-06-18 14:40:53 411368 —-a-w- c:\windows\system32\deployJava1.dll 2010-06-17 00:31:48 24064 —-a-w- c:\windows\system32\nshhttp.dll 2010-06-17 00:31:44 411648 —-a-w- c:\windows\system32\drivers\http.sys 2010-06-17 00:31:43 30720 —-a-w- c:\windows\system32\httpapi.dll 2010-06-17 00:17:51 2037248 —-a-w- c:\windows\system32\win32k.sys ==================== Find3M ==================== 2010-07-02 20:21:07 670508 —-a-w- c:\windows\system32\perfh00A.dat 2010-07-02 20:21:07 130956 —-a-w- c:\windows\system32\perfc00A.dat 2010-06-30 23:07:06 4704 –sha-w- c:\windows\system32\KGyGaAvL.sys 2010-06-28 14:35:54 86016 —-a-w- c:\windows\inf\infstor.dat 2010-06-28 14:35:54 51200 —-a-w- c:\windows\inf\infpub.dat 2010-06-28 14:35:54 143360 —-a-w- c:\windows\inf\infstrng.dat 2010-06-23 15:12:11 117008 —-a-w- c:\windows\system32\drivers\vradfil.sys 2010-05-21 19:14:28 221568 ——w- c:\windows\system32\MpSigStub.exe 2010-05-17 15:00:00 46640 ——w- c:\windows\system32\drivers\vracfil.sys 2010-05-04 05:59:21 916480 —-a-w- c:\windows\system32\wininet.dll 2010-05-04 05:55:42 71680 —-a-w- c:\windows\system32\iesetup.dll 2010-05-04 05:55:42 109056 —-a-w- c:\windows\system32\iesysprep.dll 2010-05-04 04:31:05 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2009-11-22 09:09:35 665600 —-a-w- c:\windows\inf\drvindex.dat 2008-01-21 08:35:22 40258 —-a-w- c:\windows\inf\perflib\0c0a\perfd.dat 2008-01-21 08:35:22 40258 —-a-w- c:\windows\inf\perflib\0c0a\perfc.dat 2008-01-21 08:35:22 336930 —-a-w- c:\windows\inf\perflib\0c0a\perfi.dat 2008-01-21 08:35:22 336930 —-a-w- c:\windows\inf\perflib\0c0a\perfh.dat 2008-01-21 02:41:56 174 –sha-w- c:\program files\desktop.ini 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2010-03-31 03:21:16 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat 2010-03-31 03:21:16 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat 2010-03-31 03:21:16 32768 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat 2009-10-19 20:44:12 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat ============= FINISH: 15:32:32.84 =============== And here is the content of Attach.txt: UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-03-17.01) Microsoft® Windows Vista™ Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 06/06/2009 06:07:59 a.m. System Uptime: 07/02/2010 03:12:45 p.m. (3480 hours ago) Motherboard: LENOVO | | KIWDX Processor: Intel® Pentium® Dual CPU T3200 @ 2.00GHz | U2E1 | 1000/mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 149 GiB total, 80.152 GiB free. D: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: Description: Device ID: HDAUDIO\FUNC_02&VEN_14F1&DEV_5051&SUBSYS_17AA3C2B&REV_1000\4&2DA4A3DD&0&0202 Manufacturer: Name: PNP Device ID: HDAUDIO\FUNC_02&VEN_14F1&DEV_5051&SUBSYS_17AA3C2B&REV_1000\4&2DA4A3DD&0&0202 Service: ==== System Restore Points =================== RP320: 30/06/2010 08:04:29 p.m. - Installed HiJackThis RP321: 01/07/2010 05:39:33 p.m. - Windows Update RP322: 02/07/2010 11:42:08 a.m. - Punto de control programado ==== Installed Programs ====================== Adobe Acrobat 7.0 Professional Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Advanced WindowsCare AT&T Connect Participant AutoCAD 2009 - English Autodesk Design Review 2009 Ayudante para el inicio de sesión de Windows Live ID Canvas X CCleaner (remove only) CorelDRAW Graphics Suite X3 ES Esquemas de sonido de Windows FileMaker Pro 4.0 FontNav Google Earth Google Update Helper Herramienta de carga de Windows Live HiJackThis Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Intel® Graphics Media Accelerator Driver Java Auto Updater Java™ 6 Update 20 JMicron JMB38X Flash Media Controller Lenovo EasyCamera Malwarebytes' Anti-Malware Microsoft .NET Framework 3.5 Language Pack SP1 - esn Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Choice Guard Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access MUI (Spanish) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel 2007 Help Actualización (KB963678) Microsoft Office Excel MUI (Spanish) 2007 Microsoft Office Groove MUI (Spanish) 2007 Microsoft Office InfoPath MUI (Spanish) 2007 Microsoft Office Live Add-in 1.5 Microsoft Office Live Meeting 2007 Microsoft Office OneNote MUI (Spanish) 2007 Microsoft Office Outlook 2007 Help Actualización (KB963677) Microsoft Office Outlook MUI (Spanish) 2007 Microsoft Office Powerpoint 2007 Help Actualización (KB963669) Microsoft Office PowerPoint MUI (Spanish) 2007 Microsoft Office Proof (Basque) 2007 Microsoft Office Proof (Catalan) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Galician) 2007 Microsoft Office Proof (Portuguese (Brazil)) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (Spanish) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (Spanish) 2007 Microsoft Office Shared MUI (Spanish) 2007 Microsoft Office Word 2007 Help Actualización (KB963665) Microsoft Office Word MUI (Spanish) 2007 Microsoft SharedView Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (3.6.6) MSVC80_x86 MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nokia Connectivity Cable Driver Nokia PC Suite Nokia Software Updater Paquete de controladores de Windows - Nokia Modem (06/01/2009 4.1) Paquete de controladores de Windows - Nokia Modem (06/01/2009 7.01.0.3) Paquete de controladores de Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0) Paquete de idioma de Microsoft .NET Framework 3.5 SP1 - esn PC Connectivity Solution Psi (remove only) RISCv404 Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for 2007 Microsoft Office System (KB982312) Security Update for 2007 Microsoft Office System (KB982331) Security Update for CAPICOM (KB931906) Security Update for Microsoft Office Excel 2007 (KB982308) Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office Outlook 2007 (KB972363) Security Update for Microsoft Office PowerPoint 2007 (KB982158) Security Update for Microsoft Office Publisher 2007 (KB982124) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB982135) setup.exe Skype Toolbars Skype™ 4.2 Spybot - Search & Destroy Spybot - Search & Destroy 1.4 Ultimate Extras sounds from Microsoft® Tinker™ Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office OneNote 2007 (KB980729) Update for Outlook 2007 Junk Email Filter (kb983486) Update Manager VBA VBA (2627.01) ViRobot Desktop 5.5 ViRobot ISMS Client 3.5 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Messenger WinZip 14.0 Xvid 1.2.2 final uninstall ==== Event Viewer Messages From Past Week ======== 30/06/2010 08:48:22 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 30/06/2010 07:44:45 p.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 30/06/2010 07:43:26 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 30/06/2010 07:41:43 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 30/06/2010 07:41:43 p.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 30/06/2010 07:39:11 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1084" al intentar iniciar el servicio MSIServer con argumentos "" para ejecutar el servidor: {000C101C-0000-0000-C000-000000000046} 30/06/2010 07:27:04 p.m., Error: Service Control Manager [7026] - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente: spldr Wanarpv6 30/06/2010 07:27:04 p.m., Error: Service Control Manager [7001] - El servicio Examinador de equipos depende del servicio Servidor, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:26:51 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1084" al intentar iniciar el servicio WSearch con argumentos "" para ejecutar el servidor: {9E175B6D-F52A-11D8-B9A5-505054503030} 30/06/2010 07:26:49 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1084" al intentar iniciar el servicio MDM con argumentos "" para ejecutar el servidor: {0C0A3666-30C9-11D0-8F20-00805F2CD064} 30/06/2010 07:26:45 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1068" al intentar iniciar el servicio fdPHost con argumentos "" para ejecutar el servidor: {145B4335-FE2A-4927-A040-7C35AD3180EF} 30/06/2010 07:26:43 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1084" al intentar iniciar el servicio EventSystem con argumentos "" para ejecutar el servidor: {1BE1F766-5536-11D1-B726-00C04FB926AF} 30/06/2010 07:26:36 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1084" al intentar iniciar el servicio ShellHWDetection con argumentos "" para ejecutar el servidor: {DD522ACC-F821-461A-A407-50B198B896DC} 30/06/2010 07:26:33 p.m., Error: Microsoft-Windows-WLAN-AutoConfig [10000] - El módulo de extensibilidad de WLAN no se pudo iniciar. Ruta de acceso del módulo: C:\Windows\System32\bcmihvsrv.dll Código de error: 21 30/06/2010 07:15:19 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:15:19 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:14:46 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:14:46 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:40 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7026] - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente: AFD CSC DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx Wanarpv6 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio SMB MiniRedirector Wrapper and Engine depende del servicio Redirected Buffering Sub Sysytem, el cual no pudo iniciarse debido al siguiente error: Uno de los dispositivos vinculados al sistema no funciona. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio SMB 2.0 MiniRedirector depende del servicio SMB MiniRedirector Wrapper and Engine, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio SMB 1.x MiniRedirector depende del servicio SMB MiniRedirector Wrapper and Engine, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Servicio Interfaz de almacenamiento en red depende del servicio NSI proxy service, el cual no pudo iniciarse debido al siguiente error: Uno de los dispositivos vinculados al sistema no funciona. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Servicio de lista de redes depende del servicio Reconocimiento de ubicación de red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Reconocimiento de ubicación de red depende del servicio Servicio Interfaz de almacenamiento en red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Estación de trabajo depende del servicio Servicio Interfaz de almacenamiento en red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Conexiones de red depende del servicio Servicio Interfaz de almacenamiento en red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Cliente DNS depende del servicio Controlador de soporte TDI heredado NetIO, el cual no pudo iniciarse debido al siguiente error: Uno de los dispositivos vinculados al sistema no funciona. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Cliente DHCP depende del servicio Ancilliary Function Driver for Winsock, el cual no pudo iniciarse debido al siguiente error: Uno de los dispositivos vinculados al sistema no funciona. 30/06/2010 07:13:36 p.m., Error: Service Control Manager [7001] - El servicio Aplicación auxiliar IP depende del servicio Servicio Interfaz de almacenamiento en red, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio o grupo de dependencia. 30/06/2010 07:13:01 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1068" al intentar iniciar el servicio netprofm con argumentos "" para ejecutar el servidor: {A47979D2-C419-11D9-A5B4-001185AD2B89} 30/06/2010 07:13:01 p.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1068" al intentar iniciar el servicio netman con argumentos "" para ejecutar el servidor: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 30/06/2010 05:51:27 p.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 30/06/2010 05:51:05 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 30/06/2010 05:49:21 p.m., Error: Service Control Manager [7024] - El servicio ViRobot Desktop Monitoring se cerró con el error específico de servicio 15 (0xF). 30/06/2010 05:49:21 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 30/06/2010 05:49:21 p.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 30/06/2010 04:40:13 p.m., Error: Service Control Manager [7026] - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente: spldr Wanarpv6 30/06/2010 04:39:16 p.m., Error: Microsoft-Windows-WLAN-AutoConfig [10000] - El módulo de extensibilidad de WLAN no se pudo iniciar. Ruta de acceso del módulo: C:\Windows\System32\bcmihvsrv.dll Código de error: 21 29/06/2010 09:20:21 a.m., Error: Service Control Manager [7000] - El servicio Windows Installer no pudo iniciarse debido al siguiente error: El servicio no respondió a tiempo a la solicitud de inicio o de control. 29/06/2010 09:20:20 a.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1053" al intentar iniciar el servicio MSIServer con argumentos "" para ejecutar el servidor: {000C101C-0000-0000-C000-000000000046} 29/06/2010 09:19:54 a.m., Error: Service Control Manager [7009] - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Windows Installer. 29/06/2010 09:09:05 a.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 29/06/2010 09:08:31 a.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 29/06/2010 09:07:15 a.m., Error: EventLog [6008] - El cierre anterior del sistema a las 09:05:26 a.m. del 29/06/2010 resultó inesperado. 29/06/2010 08:58:36 a.m., Error: Service Control Manager [7009] - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Servicio de uso compartido de red del Reproductor de Windows Media. 29/06/2010 08:58:36 a.m., Error: Service Control Manager [7000] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media no pudo iniciarse debido al siguiente error: El servicio no respondió a tiempo a la solicitud de inicio o de control. 29/06/2010 08:58:35 a.m., Error: Service Control Manager [7011] - Se agotó el tiempo de espera (30000 ms) para la respuesta de transacción del servicio Spooler. 29/06/2010 08:56:20 a.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 29/06/2010 08:55:29 a.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 29/06/2010 04:28:29 p.m., Error: Microsoft-Windows-PrintSpooler [6161] - No se puede imprimir el documento Página de prueba propiedad de Administrador en la impresora Epson EPL-6200. Intente imprimir el documento de nuevo o reinicie el administrador de trabajos de impresión. Tipo de datos: NT EMF 1.008. Tamaño del archivo de cola de impresión en bytes: 101700. Número de bytes impresos: 0. Número de páginas en el documento: 1. Número de páginas impresas: 0. Equipo cliente: \\LAPTOP_QRO. Código de error Win32 devuelto por el procesador de impresión: 2250. No existe esta conexión de red. 28/06/2010 10:57:17 a.m., Error: Service Control Manager [7009] - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Servicio de uso compartido de red del Reproductor de Windows Media. 28/06/2010 10:57:17 a.m., Error: Service Control Manager [7000] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media no pudo iniciarse debido al siguiente error: El servicio no respondió a tiempo a la solicitud de inicio o de control. 28/06/2010 10:55:06 a.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 28/06/2010 10:54:44 a.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 28/06/2010 09:05:09 a.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80004005 28/06/2010 09:05:07 a.m., Error: Service Control Manager [7009] - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Instalador de módulos de Windows. 28/06/2010 09:05:07 a.m., Error: Service Control Manager [7000] - El servicio Instalador de módulos de Windows no pudo iniciarse debido al siguiente error: El servicio no respondió a tiempo a la solicitud de inicio o de control. 28/06/2010 09:05:07 a.m., Error: Microsoft-Windows-DistributedCOM [10005] - Error de DCOM "1053" al intentar iniciar el servicio TrustedInstaller con argumentos "" para ejecutar el servidor: {752073A1-23F2-4396-85F0-8FDB879ED0ED} 28/06/2010 09:02:05 a.m., Error: Service Control Manager [7009] - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Roxio Hard Drive Watcher 9. 28/06/2010 09:02:05 a.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 25/06/2010 12:50:52 p.m., Error: Service Control Manager [7030] - El servicio Roxio Hard Drive Watcher 9 ha sido marcado como servicio interactivo. Sin embargo, el sistema está configurado para no permitir servicios interactivos. Este servicio puede tener un funcionamiento incorrecto. 25/06/2010 12:50:51 p.m., Error: Service Control Manager [7030] - El servicio LiveShare P2P Server 9 ha sido marcado como servicio interactivo. Sin embargo, el sistema está configurado para no permitir servicios interactivos. Este servicio puede tener un funcionamiento incorrecto. 25/06/2010 12:50:50 p.m., Error: Service Control Manager [7030] - El servicio RoxMediaDB9 ha sido marcado como servicio interactivo. Sin embargo, el sistema está configurado para no permitir servicios interactivos. Este servicio puede tener un funcionamiento incorrecto. 25/06/2010 12:50:50 p.m., Error: Service Control Manager [7030] - El servicio Roxio Upnp Server 9 ha sido marcado como servicio interactivo. Sin embargo, el sistema está configurado para no permitir servicios interactivos. Este servicio puede tener un funcionamiento incorrecto. 25/06/2010 12:50:50 p.m., Error: Service Control Manager [7030] - El servicio Roxio UPnP Renderer 9 ha sido marcado como servicio interactivo. Sin embargo, el sistema está configurado para no permitir servicios interactivos. Este servicio puede tener un funcionamiento incorrecto. 02/07/2010 11:03:26 a.m., Error: Service Control Manager [7024] - El servicio ViRobot Desktop Monitoring se cerró con el error específico de servicio 15 (0xF). 02/07/2010 10:23:34 a.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 02/07/2010 10:22:45 a.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 02/07/2010 10:22:20 a.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 02/07/2010 10:22:08 a.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 02/07/2010 03:15:24 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 02/07/2010 03:15:09 p.m., Error: Microsoft-Windows-Dhcp-Client [1002] - El servidor DHCP 10.0.0.138 denegó la concesión de la dirección IP 10.10.4.7 para la tarjeta de red con dirección de red 0021009568D0 (el servidor DHCP envió un mensaje DHCPNACK). 02/07/2010 03:14:46 p.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 02/07/2010 03:13:46 p.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 01/07/2010 09:00:53 p.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 01/07/2010 09:00:23 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 01/07/2010 08:59:04 p.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 01/07/2010 05:16:59 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 01/07/2010 05:15:46 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 01/07/2010 05:15:46 p.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 01/07/2010 05:15:17 p.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 01/07/2010 03:52:58 a.m., Error: PlugPlayManager [12] - El dispositivo 'JMB38X SD/MMC Host Controller' (PCI\VEN_197B&DEV_2382&SUBSYS_3D9B17AA&REV_00\4&33590ca8&0&00E0) desapareció del sistema sin ser primero preparado para la supresión. 01/07/2010 03:52:58 a.m., Error: PlugPlayManager [12] - El dispositivo 'JMB38X SD Host Controller' (PCI\VEN_197B&DEV_2381&SUBSYS_3D9A17AA&REV_00\4&33590ca8&0&02E0) desapareció del sistema sin ser primero preparado para la supresión. 01/07/2010 03:52:58 a.m., Error: PlugPlayManager [12] - El dispositivo 'JMB38X MS Host Controller' (PCI\VEN_197B&DEV_2383&SUBSYS_3D9C17AA&REV_00\4&33590ca8&0&03E0) desapareció del sistema sin ser primero preparado para la supresión. 01/07/2010 02:37:41 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 01/07/2010 02:36:22 p.m., Error: Microsoft-Windows-LanguagePackSetup [1001] - Error al inicializar la aplicación. Error más reciente: 0x80070032 01/07/2010 02:35:58 p.m., Error: Service Control Manager [7001] - El servicio Servicio de uso compartido de red del Reproductor de Windows Media depende del servicio Dispositivo host de UPnP, el cual no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. 01/07/2010 02:35:58 p.m., Error: Service Control Manager [7000] - El servicio Parallel port driver no pudo iniciarse debido al siguiente error: No se puede iniciar el servicio, porque está deshabilitado o porque no tiene dispositivos habilitados asociados a él. ==== End Of File =========================== I will post the other report in a separate reply. I really appreciate this help!
Post #5
And… attached is the report from the GMER. Please let me know if you think I need to get other reports with different software or conditions. Thanks you!

Attachments:

Post #6
Hi

Please do the following;

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #7
Here is the report from C:\Combofix.txt

ComboFix 10-07-01.02 - Administrador 02/07/2010 16:54:56.1.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.52.3082.18.3032.1461 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system\BisonC07.dll

.
((((((((((((((((((((((((( Files Created from 2010-06-02 to 2010-07-02 )))))))))))))))))))))))))))))))
.

2010-07-02 22:06 . 2010-07-02 22:07 ——– d—–w- c:\users\Administrador\AppData\Local\temp
2010-07-02 22:06 . 2010-07-02 22:06 ——– d—–w- c:\users\Invitado\AppData\Local\temp
2010-07-02 22:06 . 2010-07-02 22:06 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-07-02 22:06 . 2010-07-02 22:06 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2010-07-01 22:40 . 2009-11-08 15:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-07-01 22:40 . 2009-11-08 15:55 49472 —-a-w- c:\windows\system32\netfxperf.dll
2010-07-01 22:40 . 2009-11-08 15:55 297808 —-a-w- c:\windows\system32\mscoree.dll
2010-07-01 22:40 . 2009-11-08 15:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-07-01 22:40 . 2009-11-08 15:55 1130824 —-a-w- c:\windows\system32\dfshim.dll
2010-07-01 22:39 . 2010-04-16 16:43 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-07-01 22:39 . 2010-04-16 14:39 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-07-01 20:05 . 2010-07-01 20:05 ——– d—–w- c:\users\Administrador\AppData\Roaming\Malwarebytes
2010-07-01 20:05 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-01 20:05 . 2010-07-01 20:05 ——– d—–w- c:\programdata\Malwarebytes
2010-07-01 20:05 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-01 20:05 . 2010-07-01 20:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-01 19:31 . 2010-07-01 19:31 680 —-a-w- c:\users\Administrator\AppData\Local\d3d9caps.dat
2010-07-01 02:02 . 2010-07-01 02:02 ——– d—–w- c:\users\Administrator\AppData\Roaming\AdobeUM
2010-07-01 01:05 . 2010-07-01 01:05 388096 —-a-r- c:\users\Administrador\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-01 01:05 . 2010-07-01 01:05 ——– d—–w- c:\program files\Trend Micro
2010-06-30 23:35 . 2010-06-30 23:35 0 —-a-w- c:\windows\nsreg.dat
2010-06-30 23:35 . 2010-06-30 23:35 ——– d—–w- c:\users\Administrator\AppData\Local\Mozilla
2010-06-30 14:56 . 2010-06-30 14:56 ——– d—–w- c:\program files\CCleaner
2010-06-30 14:56 . 2010-06-30 14:56 ——– d—–w- c:\program files\Advanced WindowsCare
2010-06-30 14:56 . 2010-06-30 14:56 ——– d—–w- c:\windows\Advanced WindowsCare
2010-06-28 15:40 . 2010-06-28 15:40 ——– d—–w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-06-28 15:40 . 2010-06-28 15:40 ——– d—–w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-06-28 15:40 . 2010-06-28 15:40 ——– d—–w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-06-28 15:40 . 2010-06-28 15:40 ——– d—–w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-06-28 15:33 . 2010-06-30 22:06 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2010-06-28 15:32 . 2010-06-30 22:10 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-06-25 17:23 . 2010-06-28 14:35 ——– d—–w- c:\program files\Research In Motion
2010-06-23 21:35 . 2006-11-02 09:46 33792 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\EP0LPP00.DLL
2010-06-18 15:36 . 2009-07-31 19:58 192512 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll
2010-06-18 15:02 . 2010-03-05 14:01 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-06-18 15:02 . 2010-02-23 11:10 212992 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-06-18 15:02 . 2010-02-23 11:10 79360 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-06-18 15:02 . 2010-02-23 11:10 106496 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-06-18 15:01 . 2010-04-23 14:13 2048 —-a-w- c:\windows\system32\tzres.dll
2010-06-18 14:59 . 2010-01-29 15:40 738816 —-a-w- c:\windows\system32\inetcomm.dll
2010-06-18 14:57 . 2010-02-18 14:07 3600776 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-18 14:57 . 2010-02-18 14:07 3548040 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-06-18 14:57 . 2010-02-18 14:07 904576 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-18 14:57 . 2010-02-18 13:30 200704 —-a-w- c:\windows\system32\iphlpsvc.dll
2010-06-18 14:57 . 2010-02-18 11:28 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys
2010-06-18 14:57 . 2009-12-23 11:33 172032 —-a-w- c:\windows\system32\wintrust.dll
2010-06-18 14:56 . 2010-05-26 14:47 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-06-18 14:56 . 2010-05-26 17:06 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-06-18 14:56 . 2010-01-13 17:34 98304 —-a-w- c:\windows\system32\cabview.dll
2010-06-18 14:56 . 2010-01-06 15:39 1696256 —-a-w- c:\windows\system32\gameux.dll
2010-06-18 14:56 . 2010-04-05 17:01 67072 —-a-w- c:\windows\system32\asycfilt.dll
2010-06-18 14:45 . 2010-06-18 14:45 ——– d—–w- c:\program files\Common Files\Java
2010-06-18 14:40 . 2010-04-12 22:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-06-17 00:31 . 2010-02-20 23:06 24064 —-a-w- c:\windows\system32\nshhttp.dll
2010-06-17 00:31 . 2010-02-20 20:53 411648 —-a-w- c:\windows\system32\drivers\http.sys
2010-06-17 00:31 . 2010-02-20 23:05 30720 —-a-w- c:\windows\system32\httpapi.dll
2010-06-17 00:17 . 2010-05-01 14:13 2037248 —-a-w- c:\windows\system32\win32k.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-02 21:21 . 2009-06-12 19:12 ——– d—–w- c:\users\Administrador\AppData\Roaming\Skype
2010-07-02 21:07 . 2009-06-12 21:03 ——– d—–w- c:\users\Administrador\AppData\Roaming\skypePM
2010-07-02 20:21 . 2008-01-21 08:38 670508 —-a-w- c:\windows\system32\perfh00A.dat
2010-07-02 20:21 . 2008-01-21 08:38 130956 —-a-w- c:\windows\system32\perfc00A.dat
2010-06-30 23:07 . 2009-06-05 11:49 4704 –sha-w- c:\windows\system32\KGyGaAvL.sys
2010-06-30 23:06 . 2009-06-05 11:49 104 –sh–r- c:\windows\system32\4B2F0CD753.sys
2010-06-30 23:06 . 2010-01-27 16:34 135976 —-a-w- c:\users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2010-06-30 22:33 . 2010-02-11 23:04 ——– d—–w- c:\users\Administrador\AppData\Roaming\HAURI
2010-06-30 21:40 . 2009-06-30 15:13 ——– d—–w- c:\users\Administrador\AppData\Roaming\TeamViewer
2010-06-28 15:53 . 2009-06-05 10:11 135976 —-a-w- c:\users\Administrador\AppData\Local\GDIPFONTCACHEV1.DAT
2010-06-28 15:10 . 2009-12-03 17:14 ——– d—–w- c:\programdata\Roxio
2010-06-23 15:12 . 2010-02-11 22:56 117008 —-a-w- c:\windows\system32\drivers\vradfil.sys
2010-06-23 14:23 . 2009-06-25 23:04 ——– d—–w- c:\program files\Google
2010-06-18 15:57 . 2009-07-20 15:24 ——– d—–w- c:\program files\Microsoft Silverlight
2010-06-18 15:55 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-06-18 15:42 . 2009-06-05 10:24 ——– d—–w- c:\programdata\Microsoft Help
2010-06-18 15:16 . 2009-06-19 16:55 ——– d—–w- c:\program files\Microsoft
2010-06-18 14:40 . 2009-06-09 04:42 ——– d—–w- c:\program files\Java
2010-06-14 14:00 . 2009-06-05 10:11 1356 —-a-w- c:\users\Administrador\AppData\Local\d3d9caps.dat
2010-05-21 19:14 . 2009-10-03 16:34 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-20 18:20 . 2010-05-20 18:19 ——– d—–w- c:\program files\Archie 1.0
2010-05-20 18:18 . 2009-12-08 17:35 ——– d—–w- c:\programdata\WinZip
2010-05-17 15:00 . 2010-02-11 22:56 46640 ——w- c:\windows\system32\drivers\vracfil.sys
2010-05-04 05:59 . 2010-06-18 14:58 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-18 14:58 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-05-04 05:55 . 2010-06-18 14:58 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-05-04 04:31 . 2010-06-18 14:58 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2010-04-16 16:43 . 2010-07-01 22:39 173056 —-a-w- c:\windows\AppPatch\AcXtrnal.dll
2010-04-16 16:43 . 2010-07-01 22:39 458752 —-a-w- c:\windows\AppPatch\AcSpecfc.dll
2010-04-16 16:43 . 2010-07-01 22:39 542720 —-a-w- c:\windows\AppPatch\AcLayers.dll
2010-04-16 16:43 . 2010-07-01 22:39 2159616 —-a-w- c:\windows\AppPatch\AcGenral.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-02-22 26101032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SiteClient"="c:\program files\Hauri\SiteClient\SiteCli.exe" [2010-04-30 616448]
"InitClient"="c:\program files\Hauri\SiteClient\InitCli.exe" [2009-06-30 621568]
"HEProtect"="c:\program files\Hauri\ViRobot Desktop 5.5\AntiSpam\HSockPE.exe" [2008-10-29 385112]
"VrSchedule"="c:\program files\Hauri\ViRobot Desktop 5.5\AntiVirus\hrres.exe" [2010-02-23 382384]
"Vrmon"="c:\program files\Hauri\Common\Base\VRMONNT.EXE" [2009-12-16 314080]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Psi.lnk - c:\program files\Psi\psi.exe [2008-7-26 9128960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2004-12-14 07:12 483328 —-a-w- c:\program files\Adobe\Acrobat 7.0\Distillr\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:23 125952 —-a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EKIJ5000StatusMonitor]
2009-07-31 20:00 1626112 —-a-w- c:\windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-07-11 18:27 170520 —-a-w- c:\windows\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-07-11 18:27 150040 —-a-w- c:\windows\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2008-10-24 15:14 206112 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2008-10-24 15:14 206112 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2008-10-24 15:14 79136 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 22:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-07-11 18:27 145944 —-a-w- c:\windows\System32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 —-a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 21:07 2260480 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 16:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:21 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:23 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(B):cc,4d,81,a7,8d,6a,ca,01

— Other Services/Drivers In Memory —

*NewlyCreated* - UXROYPOW
*Deregistered* - uxroypow

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 22:23 38400 —-a-w- c:\windows\System32\SoundSchemes.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 15:50 30720 —-a-w- c:\windows\System32\soundschemes2.exe
.
Contents of the 'Scheduled Tasks' folder

2010-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 22:40]

2010-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 22:40]

2010-07-02 c:\windows\Tasks\User_Feed_Synchronization-{5A7A37E0-5EC3-498E-A11B-D061615D81B1}.job
- c:\windows\system32\msfeedssync.exe [2010-06-18 04:30]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.mx/
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xportar; a Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\users\Administrador\AppData\Roaming\Mozilla\Firefox\Profiles\2jl3dovk.default\
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npsharedview.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
——- File Associations ——-
.
.scr=AutoCADScriptFile
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-02 17:07
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-07-02 17:12:53
ComboFix-quarantined-files.txt 2010-07-02 22:12

Pre-Run: 85,834,047,488 bytes libres
Post-Run: 85,794,623,488 bytes libres

- - End Of File - - B7FA124CFE37B342D3E17CBA269E6FCB
Post #8
  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.




NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply



Also, please advise how your computer is behaving and if there are any outstanding issues.
Post #9
Thanks again, Catbyte. This is the report from Malwarebytes. Sorry I installed it in Spanish. Please let me know if you need translation of anything: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Versión de la Base de Datos: 4269 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18928 02/07/2010 05:46:38 p.m. mbam-log-2010-07-02 (17-46-38).txt Tipos de Análisis: Análisis Rápido Objetos examinados: 158126 Tiempo transcurrido: 12 minuto(s), 51 segundo(s) Procesos en Memoria Infectados: 0 Módulos de Memoria Infectados: 0 Claves del Registro Infectadas: 0 Valores del Registro Infectados: 0 Elementos de Datos del Registro Infectados: 0 Carpetas Infectadas: 0 Archivos Infectados: 0 Procesos en Memoria Infectados: (No se han detectado elementos maliciosos) Módulos de Memoria Infectados: (No se han detectado elementos maliciosos) Claves del Registro Infectadas: (No se han detectado elementos maliciosos) Valores del Registro Infectados: (No se han detectado elementos maliciosos) Elementos de Datos del Registro Infectados: (No se han detectado elementos maliciosos) Carpetas Infectadas: (No se han detectado elementos maliciosos) Archivos Infectados: (No se han detectado elementos maliciosos)
Post #10
And, this is the report from kaspersky (which took more than 4 hours to complete). Thanks again!! ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, July 3, 2010 Operating system: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 2 (build 6002) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, July 02, 2010 15:19:16 Records in database: 4259887 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 129147 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 04:13:13 No threats found. Scanned area is clean. Selected area has been scanned.
Post #11
Regarding your question on how the computer is behaving, I must say it is doing much better now. I am using a different network (working from home due to a storm happening, the erratic behaviour was more on the office network. Also, something I forgot to say: Prior to getting your first reply and counsel I ran Malwarebytes (as I had read in another forum that the use of such tool is recommended for this cases). Here is the report (I did not download previously as I did not know how to get reports). Please let me know I you think this was the cause of everything, or if there is something else I should run in my computer. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Versión de la Base de Datos: 4265 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18928 01/07/2010 05:09:45 p.m. mbam-log-2010-07-01 (17-09-45).txt Tipos de Análisis: Análisis Completo (C:\|D:\|) Objetos examinados: 270921 Tiempo transcurrido: 1 hora(s), 52 minuto(s), 8 segundo(s) Procesos en Memoria Infectados: 0 Módulos de Memoria Infectados: 0 Claves del Registro Infectadas: 0 Valores del Registro Infectados: 0 Elementos de Datos del Registro Infectados: 0 Carpetas Infectadas: 0 Archivos Infectados: 3 Procesos en Memoria Infectados: (No se han detectado elementos maliciosos) Módulos de Memoria Infectados: (No se han detectado elementos maliciosos) Claves del Registro Infectadas: (No se han detectado elementos maliciosos) Valores del Registro Infectados: (No se han detectado elementos maliciosos) Elementos de Datos del Registro Infectados: (No se han detectado elementos maliciosos) Carpetas Infectadas: (No se han detectado elementos maliciosos) Archivos Infectados: C:\Program Files\ACD Systems\Canvas X\Canvas Tools\QTObject.CVT (Trojan.Spambot) -> Quarantined and deleted successfully. C:\Program Files\Hauri\Common\Base\VrEncDec.dll (Trojan.Clicker) -> Delete on reboot. C:\Program Files\Hauri\ViRobot Desktop 5.5\VrEncDec.dll (Trojan.Clicker) -> Delete on reboot.
Post #12
Hi

It looks like you are clean, so we just have some housekeeping to do now.

Please do the following:

You can delete the DDS and GMER folders from your desktop.


NEXT

Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]



If there are any logs/tools remaining > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    It's normal after running TFC cleaner that the PC will be slower to boot the first time.

  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #13
Hi Catbyte! You won´t believe it but I just began with the same problems again. That is a slow computer, powerpoint taking 30 min to show a slide and printers not being detected. Is there any test I should do prior to begin blaming the OS or something else as the problem?
Post #14
Hi

Try running these programs:



Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under the Custom Scan box paste this in


    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs


  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.


NEXT

Download Bootkit remover to your desktop
This is a rar file if you do not have a program to open it then download and install Peazip
  • Extract Remover.exe to your desktop
  • Right click Remover.exe and select Run as Administrator
  • It will show a Black screen with some data on it
  • Right click on the screen and select > Select All
  • Press Control+C
  • Now open a notepad and press Control+V
  • Post the resultant log here please

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI