What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer progressively getting worse

26 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Good Morning,

You posted the same Combofix log as you did originally.

C:\ComboFix.txt <–Go here, they will be dated, post back with the last one you ran
Post #32
OH NOOO!!!
This is the only thing that opens when I click on ComboFix.txt in C:
I HOPE THIS IS IT!!!:

ComboFix 10-08-03.01 - Owner 08/03/2010 15:03:28.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.249 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\patch.exe
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000013_.tmp.dll
c:\windows\system32\_000019_.tmp.dll
c:\windows\system32\_000020_.tmp.dll
c:\windows\system32\_000021_.tmp.dll
c:\windows\system32\_000038_.tmp.dll
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((( Files Created from 2010-07-03 to 2010-08-03 )))))))))))))))))))))))))))))))
.

2010-07-29 07:21 . 2010-07-29 07:21 ——– d—–w- c:\program files\ESET
2010-07-27 00:35 . 2010-07-12 08:55 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-07-26 05:39 . 2010-07-12 08:55 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-26 05:13 . 2010-07-26 05:13 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Sunbelt Software
2010-07-26 05:07 . 2010-07-26 05:07 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-18 06:13 . 2010-07-18 06:13 ——– d—–w- c:\program files\Trend Micro
2010-07-16 22:10 . 2010-07-16 22:10 141382 —-a-w- c:\windows\hpwins05.dat
2010-07-16 22:10 . 2006-09-07 19:41 3953 ——w- c:\windows\hpwmdl05.dat
2010-07-15 22:26 . 2007-07-05 03:42 1275480 —-a-w- c:\windows\hpzshl01.exe
2010-07-15 22:26 . 2007-07-05 03:42 1132120 —-a-w- c:\windows\hpzmsi01.exe
2010-07-15 22:26 . 2007-09-14 16:12 16059 —-a-w- c:\windows\hpwscr05.dat
2010-07-15 15:21 . 2010-07-15 15:21 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-07-14 06:50 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-26 05:05 . 2008-01-14 19:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-26 05:05 . 2006-05-20 22:20 ——– d—–w- c:\program files\Lavasoft
2010-07-20 20:45 . 2010-07-20 20:45 1615200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-07-20 20:45 . 2010-07-20 20:45 1373536 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
2010-07-20 20:45 . 2010-07-20 20:45 1107296 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-20 20:45 . 2010-07-20 20:45 4368224 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-07-18 06:14 . 2010-07-18 06:14 388096 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-15 15:22 . 2010-07-15 15:22 242896 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-07-15 15:22 . 2010-07-15 15:22 216200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-07-15 15:21 . 2009-09-26 21:53 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 15:20 . 2009-09-26 21:53 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-15 15:02 . 2010-07-15 15:02 813336 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-07-15 15:02 . 2010-07-15 15:02 624920 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-07-15 15:02 . 2010-07-15 15:02 1690464 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-07-15 15:02 . 2010-07-15 15:02 1038688 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-07-12 08:56 . 2010-07-26 05:07 2979280 -c–a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-07-05 16:29 . 2010-06-10 05:37 ——– d—–w- c:\documents and settings\Owner\Application Data\mjusbsp
2010-07-04 00:38 . 2005-11-05 03:59 ——– d—–w- c:\program files\Microsoft.NET
2010-06-30 22:51 . 2010-06-30 22:51 ——– d—–w- c:\documents and settings\LocalService\Application Data\Motive
2010-06-30 18:47 . 2010-06-30 18:48 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-20 00:01 . 2006-03-26 22:43 ——– d—–w- c:\program files\iTunes
2010-06-19 23:59 . 2010-06-19 23:59 ——– d—–w- c:\program files\iPod
2010-06-19 23:59 . 2007-07-01 21:41 ——– d—–w- c:\program files\Common Files\Apple
2010-06-19 23:44 . 2010-06-19 23:44 ——– d—–w- c:\program files\Bonjour
2010-06-19 23:30 . 2010-06-19 23:30 72504 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-06-14 14:31 . 2005-11-01 23:55 744448 —-a-w- c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
2010-06-14 06:13 . 2003-08-23 14:12 60120 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-14 06:12 . 2005-11-19 17:14 ——– d—–w- c:\program files\Pure Networks
2010-06-09 13:29 . 2010-06-09 13:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Verizon Wireless
2010-06-09 13:23 . 2010-06-09 13:23 ——– d—–w- c:\documents and settings\Owner\Application Data\Verizon Wireless
2010-06-09 13:15 . 2010-06-09 13:15 ——– d—–w- c:\documents and settings\All Users\Application Data\WEngineLite
2010-06-09 13:15 . 2010-06-09 13:11 ——– d—–w- c:\program files\Verizon Wireless
2010-06-09 13:11 . 2010-06-09 13:11 25214 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{06FAFD58-1C21-4C90-A2FC-C9DC5A2A9D09}\Start.exe_B50352861C9E40AB92092A8E9DE06306.exe
2010-06-09 13:11 . 2010-06-09 13:11 25214 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{06FAFD58-1C21-4C90-A2FC-C9DC5A2A9D09}\DesktopShortcut_B50352861C9E40AB92092A8E9DE06306.exe
2010-06-09 13:11 . 2010-06-09 13:11 25214 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{06FAFD58-1C21-4C90-A2FC-C9DC5A2A9D09}\ARPPRODUCTICON.exe
2010-06-09 13:07 . 2010-06-09 13:07 ——– d—–w- c:\program files\Novatel Wireless
2010-06-02 16:22 . 2009-09-26 21:53 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-18 23:35 . 2010-05-18 23:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 23:35 . 2010-05-18 23:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-05-11 21:34 . 2010-05-11 21:33 8892928 —-a-w- c:\documents and settings\All Users\Application Data\atscie.msi
2010-05-06 10:41 . 2006-03-04 03:33 916480 —-a-w- c:\windows\system32\wininet.dll
2005-12-10 21:37 . 2005-11-22 04:58 56 –sha-r- c:\windows\system32\71523CDC9C.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-05-11 10:06 . 2007-05-11 10:06 40048 c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe
2008-10-15 08:04 . 2008-10-15 08:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

2005-07-12 05:17 . 2005-07-12 05:17 50776 c:\program files\America Online 9.0a\bak\AOL.EXE

2005-11-28 21:02 . 2005-11-28 21:02 118784 c:\program files\Common Files\Acronis\Schedule2\bak\schedhlp.exe

2006-04-19 09:20 . 2007-09-14 08:51 421888 c:\program files\Grisoft\AVG Free\bak\avgcc.exe

2002-10-07 14:23 . 2002-10-07 14:23 90112 c:\program files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe

2003-08-23 14:01 . 2003-05-23 10:03 49152 c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\bak\hphupd05.exe

2005-02-17 06:11 . 2005-02-17 06:11 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe

2006-02-23 22:45 . 2006-02-23 22:45 278528 c:\program files\iTunes\bak\iTunesHelper.exe
2010-06-15 23:33 . 2010-06-15 23:33 141624 c:\program files\iTunes\iTunesHelper.exe

2007-07-17 20:23 . 2007-07-12 11:00 132496 c:\program files\Java\jre1.6.0_02\bin\bak\jusched.exe

2007-01-19 19:54 . 2007-01-19 19:54 5674352 c:\program files\MSN Messenger\bak\msnmsgr.exe

2003-08-23 14:23 . 2003-02-25 01:51 53248 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\bak\mmtask.exe

2006-05-21 23:33 . 2006-05-21 23:33 282624 c:\program files\QuickTime\bak\qttask.exe
2010-03-18 04:53 . 2010-03-18 04:53 421888 c:\program files\QuickTime\QTTask.exe

2007-10-08 08:03 . 2007-11-09 18:10 182 c:\windows\system\bak\hpsysdrv.DAT
2005-11-02 00:20 . 2007-10-07 21:04 1406 c:\windows\system\hpsysdrv.DAT

2003-08-23 13:27 . 1998-05-07 23:04 52736 c:\windows\system\bak\hpsysdrv.exe

2005-11-01 23:54 . 2004-08-04 07:56 15360 c:\windows\system32\bak\ctfmon.exe
2004-08-04 10:00 . 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe

2003-08-23 13:35 . 2003-04-07 14:07 114688 c:\windows\system32\bak\hkcmd.exe

2003-08-23 14:01 . 2003-05-23 09:55 483328 c:\windows\system32\bak\hphmon05.exe

2003-11-10 23:06 . 2003-11-10 23:06 406016 c:\windows\system32\bak\PSDrvCheck.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ComodoBackup"="c:\program files\Comodo\BackUp\CmdBackUp.exe" [2009-02-24 2856448]
"cdloader"="c:\documents and settings\Owner\Application Data\mjusbsp\cdloader2.exe" [2010-02-26 50520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"HostManager"="c:\program files\Common Files\AOL\1132421260\ee\AOLSoftware.exe" [2006-09-26 50736]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2002-08-29 44032]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-30 149280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-06-18 647216]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-07-09 1366064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

c:\documents and settings\paragon_db_scheduler\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2010-3-14 155648]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-3-3 805392]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 15:21 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 09:42 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^DING!.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\DING!.lnk
backup=c:\windows\pss\DING!.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 08:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-06-15 23:33 141624 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerMenu]
2002-12-20 19:17 57344 —-a-w- c:\program files\PowerMenu\PowerMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 04:53 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 11:25 144784 —-a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqcopy.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Owner\\Application Data\\mjusbsp\\magicJack.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/25/2010 10:39 PM 64288]
R0 VOBID;VOBID;c:\windows\system32\drivers\vobid.sys [8/1/2003 2:47 PM 29239]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/26/2009 2:53 PM 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/26/2009 2:53 PM 243024]
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [7/6/2004 5:06 PM 188416]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 8:21 AM 308136]
R2 ComodoBackupService;ComodoBackupService;c:\program files\Comodo\BackUp\CmdBkSvc.exe [9/12/2008 9:17 AM 1023488]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [7/31/2008 5:56 PM 93320]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [6/1/2004 12:41 PM 64000]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [12/18/2009 12:12 PM 174720]
S2 a2free;a-squared Free Service;"c:\docume~1\Owner\LOCALS~1\Temp\A2FREE\a2service.exe" –> c:\docume~1\Owner\LOCALS~1\Temp\A2FREE\a2service.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 1:55 AM 1352832]
S2 mrtRate;mrtRate; [x]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [12/18/2009 12:13 PM 20480]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [5/25/2009 3:43 PM 32408]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/4/2004 3:00 AM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

— Other Services/Drivers In Memory —

*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WINRM REG_MULTI_SZ WINRM

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-08-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 08:55]

2010-07-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
IE: eBay Search - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
TCP: {E808BCF0-8CDE-494D-9F5D-6BA4E53F8379} = 66.174.92.14 69.78.96.14
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\0rssncbk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p;=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
——- File Associations ——-
.
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-03 15:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(740)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\Softex\OmniPass\opxpgina.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
.
Completion time: 2010-08-03 15:23:03
ComboFix-quarantined-files.txt 2010-08-03 22:22
ComboFix2.txt 2007-11-12 22:51

Pre-Run: 110,557,704,192 bytes free
Post-Run: 110,519,267,328 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /noexecute=optin

- - End Of File - - 7F0313E8170F6169E6FB5B55696DE5FB
Post #34
Nope, thats the original log , don't know what happened to the second one.

Do this, drag Combofix to the trash and download a updated copy and run it , no script, just run it and post the new log


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop
Post #35
Whew – thank you SO MUCH!

So, is it weird that the 2 ComboFix icons (one the cat's head & one old log) that I dragged to the recycle bin IS NOT there, even tho I didn't empty the bin?

Here's your scan – I even dated it so we'll know which one it is:



ComboFix 10-08-05.02 - Owner 08/05/2010 21:25:19.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.132 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2010-07-06 to 2010-08-06 )))))))))))))))))))))))))))))))
.

2010-07-29 07:21 . 2010-07-29 07:21 ——– d—–w- c:\program files\ESET
2010-07-27 00:35 . 2010-07-12 08:55 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-07-26 05:39 . 2010-07-12 08:55 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-26 05:13 . 2010-07-26 05:13 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Sunbelt Software
2010-07-26 05:07 . 2010-07-26 05:07 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-18 06:13 . 2010-07-18 06:13 ——– d—–w- c:\program files\Trend Micro
2010-07-16 22:10 . 2010-07-16 22:10 141382 —-a-w- c:\windows\hpwins05.dat
2010-07-16 22:10 . 2006-09-07 19:41 3953 ——w- c:\windows\hpwmdl05.dat
2010-07-15 22:26 . 2007-07-05 03:42 1275480 —-a-w- c:\windows\hpzshl01.exe
2010-07-15 22:26 . 2007-07-05 03:42 1132120 —-a-w- c:\windows\hpzmsi01.exe
2010-07-15 22:26 . 2007-09-14 16:12 16059 —-a-w- c:\windows\hpwscr05.dat
2010-07-15 15:21 . 2010-07-15 15:21 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-07-14 06:50 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-04 21:33 . 2008-08-01 00:52 ——– d—–w- c:\program files\McAfee
2010-07-26 05:05 . 2008-01-14 19:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-26 05:05 . 2006-05-20 22:20 ——– d—–w- c:\program files\Lavasoft
2010-07-20 20:45 . 2010-07-20 20:45 1615200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll
2010-07-20 20:45 . 2010-07-20 20:45 1373536 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
2010-07-20 20:45 . 2010-07-20 20:45 1107296 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-20 20:45 . 2010-07-20 20:45 4368224 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-07-18 06:14 . 2010-07-18 06:14 388096 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-15 15:22 . 2010-07-15 15:22 242896 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-07-15 15:22 . 2010-07-15 15:22 216200 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys
2010-07-15 15:21 . 2009-09-26 21:53 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 15:20 . 2009-09-26 21:53 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-15 15:02 . 2010-07-15 15:02 813336 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-07-15 15:02 . 2010-07-15 15:02 624920 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-07-15 15:02 . 2010-07-15 15:02 1690464 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-07-15 15:02 . 2010-07-15 15:02 1038688 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-07-12 08:56 . 2010-07-26 05:07 2979280 -c–a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-07-05 16:29 . 2010-06-10 05:37 ——– d—–w- c:\documents and settings\Owner\Application Data\mjusbsp
2010-07-04 00:38 . 2005-11-05 03:59 ——– d—–w- c:\program files\Microsoft.NET
2010-06-30 22:51 . 2010-06-30 22:51 ——– d—–w- c:\documents and settings\LocalService\Application Data\Motive
2010-06-30 18:47 . 2010-06-30 18:48 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-20 00:01 . 2006-03-26 22:43 ——– d—–w- c:\program files\iTunes
2010-06-19 23:59 . 2010-06-19 23:59 ——– d—–w- c:\program files\iPod
2010-06-19 23:59 . 2007-07-01 21:41 ——– d—–w- c:\program files\Common Files\Apple
2010-06-19 23:44 . 2010-06-19 23:44 ——– d—–w- c:\program files\Bonjour
2010-06-19 23:30 . 2010-06-19 23:30 72504 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-06-14 14:31 . 2005-11-01 23:55 744448 —-a-w- c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
2010-06-14 06:13 . 2003-08-23 14:12 60120 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-14 06:12 . 2005-11-19 17:14 ——– d—–w- c:\program files\Pure Networks
2010-06-09 13:29 . 2010-06-09 13:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Verizon Wireless
2010-06-09 13:23 . 2010-06-09 13:23 ——– d—–w- c:\documents and settings\Owner\Application Data\Verizon Wireless
2010-06-09 13:15 . 2010-06-09 13:15 ——– d—–w- c:\documents and settings\All Users\Application Data\WEngineLite
2010-06-09 13:15 . 2010-06-09 13:11 ——– d—–w- c:\program files\Verizon Wireless
2010-06-09 13:11 . 2010-06-09 13:11 25214 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{06FAFD58-1C21-4C90-A2FC-C9DC5A2A9D09}\Start.exe_B50352861C9E40AB92092A8E9DE06306.exe
2010-06-09 13:11 . 2010-06-09 13:11 25214 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{06FAFD58-1C21-4C90-A2FC-C9DC5A2A9D09}\DesktopShortcut_B50352861C9E40AB92092A8E9DE06306.exe
2010-06-09 13:11 . 2010-06-09 13:11 25214 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{06FAFD58-1C21-4C90-A2FC-C9DC5A2A9D09}\ARPPRODUCTICON.exe
2010-06-09 13:07 . 2010-06-09 13:07 ——– d—–w- c:\program files\Novatel Wireless
2010-06-02 16:22 . 2009-09-26 21:53 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-18 23:35 . 2010-05-18 23:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 23:35 . 2010-05-18 23:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-05-11 21:34 . 2010-05-11 21:33 8892928 —-a-w- c:\documents and settings\All Users\Application Data\atscie.msi
2005-12-10 21:37 . 2005-11-22 04:58 56 –sha-r- c:\windows\system32\71523CDC9C.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-05-11 10:06 . 2007-05-11 10:06 40048 c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe
2008-10-15 08:04 . 2008-10-15 08:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

2005-07-12 05:17 . 2005-07-12 05:17 50776 c:\program files\America Online 9.0a\bak\AOL.EXE

2005-11-28 21:02 . 2005-11-28 21:02 118784 c:\program files\Common Files\Acronis\Schedule2\bak\schedhlp.exe

2006-04-19 09:20 . 2007-09-14 08:51 421888 c:\program files\Grisoft\AVG Free\bak\avgcc.exe

2002-10-07 14:23 . 2002-10-07 14:23 90112 c:\program files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe

2003-08-23 14:01 . 2003-05-23 10:03 49152 c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\bak\hphupd05.exe

2005-02-17 06:11 . 2005-02-17 06:11 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe

2006-02-23 22:45 . 2006-02-23 22:45 278528 c:\program files\iTunes\bak\iTunesHelper.exe
2010-06-15 23:33 . 2010-06-15 23:33 141624 c:\program files\iTunes\iTunesHelper.exe

2007-07-17 20:23 . 2007-07-12 11:00 132496 c:\program files\Java\jre1.6.0_02\bin\bak\jusched.exe

2007-01-19 19:54 . 2007-01-19 19:54 5674352 c:\program files\MSN Messenger\bak\msnmsgr.exe

2003-08-23 14:23 . 2003-02-25 01:51 53248 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\bak\mmtask.exe

2006-05-21 23:33 . 2006-05-21 23:33 282624 c:\program files\QuickTime\bak\qttask.exe
2010-03-18 04:53 . 2010-03-18 04:53 421888 c:\program files\QuickTime\QTTask.exe

2007-10-08 08:03 . 2007-11-09 18:10 182 c:\windows\system\bak\hpsysdrv.DAT
2005-11-02 00:20 . 2007-10-07 21:04 1406 c:\windows\system\hpsysdrv.DAT

2003-08-23 13:27 . 1998-05-07 23:04 52736 c:\windows\system\bak\hpsysdrv.exe

2005-11-01 23:54 . 2004-08-04 07:56 15360 c:\windows\system32\bak\ctfmon.exe
2004-08-04 10:00 . 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe

2003-08-23 13:35 . 2003-04-07 14:07 114688 c:\windows\system32\bak\hkcmd.exe

2003-08-23 14:01 . 2003-05-23 09:55 483328 c:\windows\system32\bak\hphmon05.exe

2003-11-10 23:06 . 2003-11-10 23:06 406016 c:\windows\system32\bak\PSDrvCheck.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ComodoBackup"="c:\program files\Comodo\BackUp\CmdBackUp.exe" [2009-02-24 2856448]
"cdloader"="c:\documents and settings\Owner\Application Data\mjusbsp\cdloader2.exe" [2010-02-26 50520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"HostManager"="c:\program files\Common Files\AOL\1132421260\ee\AOLSoftware.exe" [2006-09-26 50736]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2002-08-29 44032]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-30 149280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-06-18 647216]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-07-09 1366064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2010-3-14 155648]

c:\documents and settings\paragon_db_scheduler\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-3-3 805392]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 15:21 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 09:42 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^DING!.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\DING!.lnk
backup=c:\windows\pss\DING!.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 08:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-06-15 23:33 141624 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerMenu]
2002-12-20 19:17 57344 —-a-w- c:\program files\PowerMenu\PowerMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 04:53 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 11:25 144784 —-a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqcopy.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Owner\\Application Data\\mjusbsp\\magicJack.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/25/2010 10:39 PM 64288]
R0 VOBID;VOBID;c:\windows\system32\drivers\vobid.sys [8/1/2003 2:47 PM 29239]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/26/2009 2:53 PM 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/26/2009 2:53 PM 243024]
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [7/6/2004 5:06 PM 188416]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 8:21 AM 308136]
R2 ComodoBackupService;ComodoBackupService;c:\program files\Comodo\BackUp\CmdBkSvc.exe [9/12/2008 9:17 AM 1023488]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [7/31/2008 5:56 PM 88176]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [6/1/2004 12:41 PM 64000]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [12/18/2009 12:12 PM 174720]
S2 a2free;a-squared Free Service;"c:\docume~1\Owner\LOCALS~1\Temp\A2FREE\a2service.exe" –> c:\docume~1\Owner\LOCALS~1\Temp\A2FREE\a2service.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 1:55 AM 1352832]
S2 mrtRate;mrtRate; [x]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [12/18/2009 12:13 PM 20480]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [5/25/2009 3:43 PM 32408]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/4/2004 3:00 AM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

— Other Services/Drivers In Memory —

*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WINRM REG_MULTI_SZ WINRM

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-08-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 08:55]

2010-07-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
IE: eBay Search - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
TCP: {E808BCF0-8CDE-494D-9F5D-6BA4E53F8379} = 66.174.92.14 69.78.96.14
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\0rssncbk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p;=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
——- File Associations ——-
.
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-05 21:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(740)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\Softex\OmniPass\opxpgina.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(1856)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-08-05 21:51:17
ComboFix-quarantined-files.txt 2010-08-06 04:51
ComboFix2.txt 2010-08-03 22:23
ComboFix3.txt 2007-11-12 22:51

Pre-Run: 110,418,042,880 bytes free
Post-Run: 110,457,741,312 bytes free

- - End Of File - - F16216AB5182A73017118C984F24229A

Attachments:

Post #36
First lets update your Java uninstalling previous versions first

Download the latest version Here save it, do not install it yet.

Java SE Runtime Environment (JRE)JRE 6 Update 21 <–The wording is confusing but this is what you need

  • Go to your Add Remove Programs in the Control Panel and uninstall any previous versions of Java
  • Reboot your computer
  • Install the latest version
You can verify the installation Here






Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above AWF::


AWF::
c:\program files\America Online 9.0a\bak\AOL.EXE
c:\program files\Common Files\Acronis\Schedule2\bak\schedhlp.exe
c:\program files\Grisoft\AVG Free\bak\avgcc.exe
c:\program files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe
c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\bak\hphupd05.exe
c:\windows\system32\bak\hkcmd.exe
c:\windows\system32\bak\hphmon05.exe
c:\windows\system32\bak\PSDrvCheck.exe
c:\program files\MSN Messenger\bak\msnmsgr.exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Post #37
Hey Ken – my PC is doing some strange things, and I am unable to execute any of your latest instructions. I am communicating with you via an alternative computer. FIRST: When I turned on my computer today to deal with the Java & latest instructions you provided, I got the following error message (the screen was blue and the text was white): "A problem has been detected and Windows has been shut down to prevent damage to your computer. KERNEL_STACK_INPAGE_ERROR If this is the first time you've seen this stop error screen restart your computer. If this screen appears again, follow these steps: Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need. If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup options, and then select Safe Mode. Technical information: *** Stop: OxOOOOOO77 (OxOOOOOOO1, OxOO1OOOO3, OxOOOOOOOO, OxF14C2C4C) Beginning dump of physical memory PHysical memory dump complete. Contact your system administrator or technical support group for further assistance." THAT WAS THE FIRST THING THAT HAPPENED – THEN I HELD THE CPUS's POWER BUTTON & SHUT IT DOWN – THEN RESTARTED IT. Second: When it started up again, it went to a black screen with white text writing and gave me this message: "Windows could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM. Select 'r' at the first screen to start repair." Then, while attempting to get online with this laptop that I hate to try to use (because it seems to have all plust more of the same problems that the PC seems to have), the screen on the PC went to complete black – nothing flashing – no screen saver – no prompt or mouse movement – nothing – just black – and the light on the CPU power button is still it up (on) so I know it didn't close down – the message just disappeared and it's nothing but a black screen, and that's where I've left it – I'm afraid to shut it down – I'm just plain afraid to touch it – please advise. (what an ongoing, growing nightmare this is.) Thanks.
Post #39
Hey Ken – before I do one more thing, we better deal with this laptop computer – I want to ensure that the same thing doesn't happen to it, and it's in bad shape – has been for years – that's why I never use it. So, the first thing about it is that I cannot get any AV to load on it. I have AdAware, but as you know, I need to manually start it, and then it's not very effective when it's not running because then there's no real time protection. Help please!
Post #40
Good Morning,

What you need to do is to start a new thread for the second computer stating its your second computer , run DDS and post the log. This is the way the forum works, been at this for many years and believe me it can get very confusing working two different computers on the same post. Go ahead and start that new topic, I am home all day today, I will look for it and if no one else has replied I will grab it.


It looks like Paws has replied to your other post in the windows forum, your in good hands with him.
http://forums.whatthetech.com/index.php?sh…=113815&hl=
Post #41
Hey Ken545 – I posted in the other forum regarding my second computer and am waiting for you to respond – I think others are leaving it for you because I wrote that I wanted you to pick it up. I think priority should be to get AV on it – I'll wait for you to respond – THANKS!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI