What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help Removing TR/crypt.xdr.gen2 & 3 with Possible Rootkit

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Well, the good news is they were all done away with in one fell swoop, by erasing the C:\C\Application Data folder, and everything was at least 10 months old if not much older. The C:\C\ directory is the all-inclusive dump for everything I transferred from my old machine, so none of that was actually being used for anything anymore. I am still having the problem with the PSC, however. I get the 'Safely Remove Hardware' icon in the tray asking me to remove the 'Epson storage USB device' also marked as 'E:\' which of course neither exist. The Epson Event Manager icon is also in the tray, and I do seem to have printing ability regularly again. I also just want to take this opportunity to say a VERY BIG THANK YOU to you and everyone who runs and is an expert on this board!!!! Here's the DDS log: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 1:08:07.81 on Mon 07/26/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2405 [GMT -8:00] AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\EPSON\EpsonPrinterStudy4\EPCP.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\runservice.exe C:\Program Files\Avira\AntiVir Desktop\avshadow.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wscntfy.exe c:\program files\avira\antivir desktop\avcenter.exe C:\Program Files\Avira\AntiVir Desktop\avscan.exe C:\WINDOWS\System32\vssvc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Mozilla Thunderbird\thunderbird.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Documents and Settings\Christine\Desktop\dds.scr ============== Pseudo HJT Report =============== BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [RTHDCPL] RTHDCPL.EXE mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [LTCM Client] c:\program files\ltcm client\ltcmClient.exe /startup mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [SpybotSnD] "c:\program files\spybot - search & destroy\SpybotSD.exe" /autocheck /autofix /autoclose StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab TCP: {1F1A66CB-94A3-4054-A560-CAD829C373C3} = 216.163.120.19 216.163.120.21 Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\christ~1\applic~1\mozilla\firefox\profiles\t2cpv24e.default\ FF - prefs.js: browser.startup.homepage - hxxp://forecast.weather.gov/MapClick.php?site=otx&smap=1&textField1=48.86389&textField2=-117.37139 FF - component: c:\documents and settings\christine\application data\mozilla\firefox\profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll FF - plugin: c:\program files\tabletplugins\npwacom.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.homepage.dontask, truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-10-17 11608] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-17 135336] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-10-17 267432] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-10-17 60936] R2 EpsonPrinterStudy4;EpsonPrinterStudy4;c:\program files\epson\epsonprinterstudy4\EPCP.exe [2009-7-30 96144] R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2009-10-9 2560] R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2009-10-23 4463400] R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2009-9-20 89600] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2009-10-23 16168] S2 gupdate;Google Update Service (gupdate);"c:\program files\google\update\googleupdate.exe" /svc –> c:\program files\google\update\GoogleUpdate.exe [?] S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?] =============== Created Last 30 ================ 2010-07-25 15:45 411,368 a——- c:\windows\system32\deployJava1.dll 2010-07-25 13:04 a-dshr– C:\cmdcons 2010-07-24 17:35 256,512 a——- c:\windows\PEV.exe 2010-07-24 17:35 161,792 a——- c:\windows\SWREG.exe 2010-07-24 17:35 98,816 a——- c:\windows\sed.exe 2010-07-24 17:35 77,312 a——- c:\windows\MBR.exe 2010-07-24 01:16 664 a——- c:\windows\system32\d3d9caps.dat 2010-07-23 09:45 4,194,374 a——- c:\windows\pfirewall.log.old 2010-07-22 16:01 –d—– C:\_OTM 2010-07-21 12:02 –d—– c:\program files\InCode Solutions 2010-07-21 00:45 –d—– c:\docume~1\christ~1\applic~1\Malwarebytes 2010-07-21 00:45 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-21 00:45 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-07-21 00:45 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-07-21 00:45 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-07-20 21:54 460 a——- c:\windows\wininit.ini 2010-07-20 15:52 744,448 -c—— c:\windows\system32\dllcache\helpsvc.exe 2010-07-03 01:25 743,424 -c—— c:\windows\system32\dllcache\iedvtool.dll 2010-07-02 22:26 65,536 -c—— c:\windows\system32\dllcache\asycfilt.dll 2010-07-02 21:32 285,696 -c—— c:\windows\system32\dllcache\atmfd.dll 2010-07-02 20:45 177,664 -c—— c:\windows\system32\dllcache\wintrust.dll 2010-07-02 19:50 100,864 -c—— c:\windows\system32\dllcache\6to4svc.dll 2010-07-02 19:20 86,016 -c—— c:\windows\system32\dllcache\cabview.dll 2010-07-02 18:36 3,558,912 -c—— c:\windows\system32\dllcache\moviemk.exe 2010-07-02 18:15 343,040 -c—— c:\windows\system32\dllcache\mspaint.exe 2010-07-02 18:03 48,128 -c—— c:\windows\system32\dllcache\iyuv_32.dll 2010-07-02 18:03 11,264 -c—— c:\windows\system32\dllcache\msrle32.dll 2010-07-02 18:03 8,704 -c—— c:\windows\system32\dllcache\tsbyuv.dll 2010-07-02 17:57 17,920 -c—— c:\windows\system32\dllcache\msyuv.dll 2010-07-02 17:40 33,280 -c—— c:\windows\system32\dllcache\csrsrv.dll ==================== Find3M ==================== 2010-07-23 07:53 1,655 a——- c:\windows\system32\Wacom_Tablet.dat 2010-07-21 03:27 195,668 a——- c:\windows\pchealth\helpctr\config\cache\Professional_32_1033.dat 2010-06-14 06:31 744,448 a——- c:\windows\pchealth\helpctr\binaries\helpsvc.exe 2010-05-06 02:41 916,480 a——- c:\windows\system32\wininet.dll 2010-05-01 21:22 1,851,264 a——- c:\windows\system32\win32k.sys 2009-11-19 15:48 4 —shr– c:\docume~1\alluse~1\applic~1\sysqcl1129139270.dat 2009-10-26 18:50 8,801,704 a——- c:\program files\FLV PlayerATBSetup.exe ============= FINISH: 1:08:29.29 ===============
Post #17
DOH!!! I was so tired this morning that I made a mistake and didn't erase BOTH folders that needed erasing! Now I have, and here's the revised DDS log: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 9:09:57.37 on Mon 07/26/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2650 [GMT -8:00] AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\EPSON\EpsonPrinterStudy4\EPCP.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\runservice.exe C:\Program Files\Avira\AntiVir Desktop\avshadow.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\Wacom_Tablet.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Christine\Desktop\dds.scr ============== Pseudo HJT Report =============== uInternet Settings,ProxyServer = http=127.0.0.1:5643 uInternet Settings,ProxyOverride = BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [RTHDCPL] RTHDCPL.EXE mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [LTCM Client] c:\program files\ltcm client\ltcmClient.exe /startup mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [SpybotSnD] "c:\program files\spybot - search & destroy\SpybotSD.exe" /autocheck /autofix /autoclose StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\christ~1\applic~1\mozilla\firefox\profiles\t2cpv24e.default\ FF - prefs.js: browser.startup.homepage - hxxp://forecast.weather.gov/MapClick.php?site=otx&smap=1&textField1=48.86389&textField2=-117.37139 FF - component: c:\documents and settings\christine\application data\mozilla\firefox\profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll FF - plugin: c:\program files\tabletplugins\npwacom.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.homepage.dontask, truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-10-17 11608] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-17 135336] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-10-17 267432] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-10-17 60936] R2 EpsonPrinterStudy4;EpsonPrinterStudy4;c:\program files\epson\epsonprinterstudy4\EPCP.exe [2009-7-30 96144] R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2009-10-9 2560] R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2009-10-23 4463400] R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2009-9-20 89600] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2009-10-23 16168] S2 gupdate;Google Update Service (gupdate);"c:\program files\google\update\googleupdate.exe" /svc –> c:\program files\google\update\GoogleUpdate.exe [?] S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?] =============== Created Last 30 ================ 2010-07-25 15:45 411,368 a——- c:\windows\system32\deployJava1.dll 2010-07-25 13:04 a-dshr– C:\cmdcons 2010-07-24 17:35 256,512 a——- c:\windows\PEV.exe 2010-07-24 17:35 161,792 a——- c:\windows\SWREG.exe 2010-07-24 17:35 98,816 a——- c:\windows\sed.exe 2010-07-24 17:35 77,312 a——- c:\windows\MBR.exe 2010-07-24 01:16 664 a——- c:\windows\system32\d3d9caps.dat 2010-07-23 09:45 4,194,374 a——- c:\windows\pfirewall.log.old 2010-07-22 16:01 –d—– C:\_OTM 2010-07-21 12:02 –d—– c:\program files\InCode Solutions 2010-07-21 00:45 –d—– c:\docume~1\christ~1\applic~1\Malwarebytes 2010-07-21 00:45 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-21 00:45 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-07-21 00:45 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-07-21 00:45 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-07-20 21:54 460 a——- c:\windows\wininit.ini 2010-07-20 15:52 744,448 -c—— c:\windows\system32\dllcache\helpsvc.exe 2010-07-03 01:25 743,424 -c—— c:\windows\system32\dllcache\iedvtool.dll 2010-07-02 22:26 65,536 -c—— c:\windows\system32\dllcache\asycfilt.dll 2010-07-02 21:32 285,696 -c—— c:\windows\system32\dllcache\atmfd.dll 2010-07-02 20:45 177,664 -c—— c:\windows\system32\dllcache\wintrust.dll 2010-07-02 19:50 100,864 -c—— c:\windows\system32\dllcache\6to4svc.dll 2010-07-02 19:20 86,016 -c—— c:\windows\system32\dllcache\cabview.dll 2010-07-02 18:36 3,558,912 -c—— c:\windows\system32\dllcache\moviemk.exe 2010-07-02 18:15 343,040 -c—— c:\windows\system32\dllcache\mspaint.exe 2010-07-02 18:03 48,128 -c—— c:\windows\system32\dllcache\iyuv_32.dll 2010-07-02 18:03 11,264 -c—— c:\windows\system32\dllcache\msrle32.dll 2010-07-02 18:03 8,704 -c—— c:\windows\system32\dllcache\tsbyuv.dll 2010-07-02 17:57 17,920 -c—— c:\windows\system32\dllcache\msyuv.dll 2010-07-02 17:40 33,280 -c—— c:\windows\system32\dllcache\csrsrv.dll ==================== Find3M ==================== 2010-07-23 07:53 1,655 a——- c:\windows\system32\Wacom_Tablet.dat 2010-07-21 03:27 195,668 a——- c:\windows\pchealth\helpctr\config\cache\Professional_32_1033.dat 2010-06-14 06:31 744,448 a——- c:\windows\pchealth\helpctr\binaries\helpsvc.exe 2010-05-06 02:41 916,480 a——- c:\windows\system32\wininet.dll 2010-05-01 21:22 1,851,264 a——- c:\windows\system32\win32k.sys 2009-11-19 15:48 4 —shr– c:\docume~1\alluse~1\applic~1\sysqcl1129139270.dat 2009-10-26 18:50 8,801,704 a——- c:\program files\FLV PlayerATBSetup.exe ============= FINISH: 9:10:27.10 ===============
Post #18
Hello Zhora

I was so tired this morning that I made a mistake and didn't erase BOTH folders that needed erasing!

No problem :)

Is this a networked machine? Please let me know.

You seem to have picked up a bad proxy between DDS scans…..


  • Please disable Spybot Teatimer


    • Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
    • On the left hand side, click "Tools", then click on the "Resident" icon in the list.
    • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active" box.
    • Click the "System Startup" icon in the List.
    • Uncheck the "TeaTimer" box and "OK" any prompts.
    • If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
    • Exit Spybot S&D when done.

  • Please work through the following steps


    • Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
    • NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
    • Copy and Paste the text in the quotebox below into the open Notepad window:

      DDS::
      uInternet Settings,ProxyServer = http=127.0.0.1:5643
      uInternet Settings,ProxyOverride =
      DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    • Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
    • Close any open browsers.
    • Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Refering to the picture below, drag CFScript.txt into ComboFix.exe

      [external image: Posted Image]
    • When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
    • Once the log is produced, re-engage your resident anti virus.

    Please post the ComboFix log in your next reply along with another DDS scan.
Post #19
It was originally set up as a network computer by the friend who put it together because I wanted to network it with my old machine, and because he used it to setup the software. However it has never been networked with my old machine due to hardware incompatibilities. I ended up removing the hard drives from the old one and temporarily installing them in my current one so I could copy files. The drives were removed after transfer, and one died immediately, tho I'd intended to leave one in as my scratch drive. Neither are in the machine currently. I do not know how to disable the networking capabilities without also reformatting, and I DO want to disable it. On the ComboFix run…this time it didn't go well. ComboFix first wanted to update itself, then restarted, then it claimed that I didn't have Microsoft Recovery Console installed - which it has also asked for and installed every other time I've run it over the last few days. After that was downloaded and installed AGAIN, it was about halfway through and there was an Exception Prossessing message that I didn't get all written down before it disappeared, and it wanted a disc to read off of. Anyway, here's the log from that run even tho I assume it will have to be done again: ComboFix 10-07-24.06 - Christine 07/26/2010 15:01:00.3.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2845 [GMT -8:00] Running from: c:\documents and settings\[removed]\Desktop\zhora.exe Command switches used :: c:\documents and settings\Christine\Desktop\CFScript.txt AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . ((((((((((((((((((((((((( Files Created from 2010-06-26 to 2010-07-26 ))))))))))))))))))))))))))))))) . 2010-07-26 00:07 . 2010-07-26 00:07 503808 —-a-w- c:\documents and settings\Christine\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-35d70d0f-n\msvcp71.dll 2010-07-26 00:07 . 2010-07-26 00:07 499712 —-a-w- c:\documents and settings\Christine\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-35d70d0f-n\jmc.dll 2010-07-26 00:07 . 2010-07-26 00:07 348160 —-a-w- c:\documents and settings\Christine\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-35d70d0f-n\msvcr71.dll 2010-07-25 23:49 . 2010-07-25 23:49 ——– d—–w- c:\program files\Common Files\Java 2010-07-25 23:46 . 2010-07-25 23:46 61440 —-a-w- c:\documents and settings\Christine\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2d6a602b-n\decora-sse.dll 2010-07-25 23:46 . 2010-07-25 23:46 12800 —-a-w- c:\documents and settings\Christine\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2d6a602b-n\decora-d3d.dll 2010-07-25 23:45 . 2010-04-13 01:29 411368 —-a-w- c:\windows\system32\deployJava1.dll 2010-07-24 09:16 . 2010-07-24 09:16 664 —-a-w- c:\windows\system32\d3d9caps.dat 2010-07-23 00:01 . 2010-07-23 00:01 ——– d—–w- C:\_OTM 2010-07-21 22:50 . 2010-07-21 22:53 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-07-21 21:03 . 2010-07-21 21:03 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Thunderbird 2010-07-21 21:03 . 2010-07-21 21:03 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Thunderbird 2010-07-21 20:02 . 2010-07-21 20:02 ——– d—–w- c:\program files\InCode Solutions 2010-07-21 08:45 . 2010-07-21 08:45 ——– d—–w- c:\documents and settings\Christine\Application Data\Malwarebytes 2010-07-21 08:45 . 2010-04-29 23:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-21 08:45 . 2010-07-21 09:02 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-07-21 08:45 . 2010-07-21 08:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-07-21 08:45 . 2010-04-29 23:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-07-20 23:52 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe 2010-07-03 09:25 . 2010-05-06 10:41 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll 2010-07-03 06:26 . 2010-03-05 14:37 65536 -c—-w- c:\windows\system32\dllcache\asycfilt.dll 2010-07-03 05:32 . 2010-04-20 05:30 285696 -c—-w- c:\windows\system32\dllcache\atmfd.dll 2010-07-03 04:45 . 2009-12-24 06:59 177664 -c—-w- c:\windows\system32\dllcache\wintrust.dll 2010-07-03 03:50 . 2010-02-12 04:33 100864 -c—-w- c:\windows\system32\dllcache\6to4svc.dll 2010-07-03 03:20 . 2010-01-13 14:01 86016 -c—-w- c:\windows\system32\dllcache\cabview.dll 2010-07-03 02:36 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe 2010-07-03 02:15 . 2009-12-16 18:43 343040 -c—-w- c:\windows\system32\dllcache\mspaint.exe 2010-07-03 02:03 . 2009-11-27 16:07 8704 -c—-w- c:\windows\system32\dllcache\tsbyuv.dll 2010-07-03 02:03 . 2009-11-27 16:07 48128 -c—-w- c:\windows\system32\dllcache\iyuv_32.dll 2010-07-03 02:03 . 2009-11-27 16:07 11264 -c—-w- c:\windows\system32\dllcache\msrle32.dll 2010-07-03 01:57 . 2009-11-27 17:11 17920 -c—-w- c:\windows\system32\dllcache\msyuv.dll 2010-07-03 01:40 . 2009-12-14 07:08 33280 -c—-w- c:\windows\system32\dllcache\csrsrv.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-07-26 17:08 . 2009-10-24 04:17 ——– d—–w- c:\documents and settings\Christine\Application Data\WTablet 2010-07-26 17:08 . 2009-10-09 16:52 561 –sha-w- c:\windows\system32\mmf.sys 2010-07-25 23:45 . 2010-03-16 02:50 ——– d—–w- c:\program files\Java 2010-07-25 08:29 . 2009-10-09 16:59 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-07-24 05:10 . 2009-10-09 07:23 ——– d—–w- c:\program files\Mozilla Thunderbird 2010-07-24 05:10 . 2009-10-09 07:23 ——– d—–w- c:\documents and settings\Christine\Application Data\Thunderbird 2010-07-23 15:53 . 2009-10-15 09:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-07-23 15:53 . 2009-11-09 22:48 1655 —-a-w- c:\windows\system32\Wacom_Tablet.dat 2010-07-21 22:41 . 2009-10-24 04:17 ——– d—–w- c:\program files\TabletPlugins 2010-07-21 22:40 . 2009-10-27 02:51 ——– d—–w- c:\program files\Ask & Record Toolbar 2010-07-21 22:29 . 2009-12-31 03:15 ——– d—–w- c:\program files\Google 2010-07-21 11:27 . 2010-07-21 22:50 195668 —-a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat 2010-07-21 11:14 . 2009-11-28 01:30 ——– d—–w- c:\program files\CCleaner 2010-06-14 14:31 . 2009-09-20 08:08 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe 2010-06-07 17:18 . 2010-03-10 22:35 ——– d—–w- c:\documents and settings\Christine\Application Data\EPSON 2010-05-24 01:50 . 2010-06-05 19:23 73216 —-a-w- c:\documents and settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll 2010-05-06 10:41 . 2007-01-16 20:07 916480 —-a-w- c:\windows\system32\wininet.dll 2010-05-02 05:22 . 2007-01-16 20:07 1851264 —-a-w- c:\windows\system32\win32k.sys 2009-10-27 02:50 . 2009-10-27 02:00 8801704 —-a-w- c:\program files\FLV PlayerATBSetup.exe . ((((((((((((((((((((((((((((( SnapShot@2010-07-25_01.55.25 ))))))))))))))))))))))))))))))))))))))))) . + 2010-07-26 17:08 . 2010-07-26 17:08 16384 c:\windows\Temp\Perflib_Perfdata_7d4.dat + 2010-07-25 23:45 . 2010-04-13 01:29 153376 c:\windows\system32\javaws.exe + 2010-07-25 23:45 . 2010-04-13 01:29 145184 c:\windows\system32\javaw.exe - 2010-03-16 16:55 . 2009-10-11 12:17 145184 c:\windows\system32\javaw.exe + 2010-07-25 23:45 . 2010-04-13 01:29 145184 c:\windows\system32\java.exe - 2010-03-16 16:55 . 2009-10-11 12:17 145184 c:\windows\system32\java.exe + 2010-07-25 23:49 . 2010-07-25 23:49 180224 c:\windows\Installer\8bfefb.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440] "RTHDCPL"="RTHDCPL.EXE" [2008-07-03 16876032] "AGRSMMSG"="AGRSMMSG.exe" [2007-09-27 90112] "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2007-09-27 188416] "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-07 673616] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360] "LTCM Client"="c:\program files\LTCM Client\ltcmClient.exe" [2009-03-02 1583808] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-23 110592] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-09-05 06:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix /autoclose "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" /min [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"= R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/17/2009 4:00 AM 135336] R2 EpsonPrinterStudy4;EpsonPrinterStudy4;c:\program files\epson\EpsonPrinterStudy4\EPCP.exe [7/30/2009 6:15 PM 96144] R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [10/23/2009 8:16 PM 4463400] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [10/23/2009 8:16 PM 16168] S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc –> c:\program files\Google\Update\GoogleUpdate.exe [?] S2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [10/9/2009 8:52 AM 2560] S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?] . . ——- Supplementary Scan ——- . TCP: {1F1A66CB-94A3-4054-A560-CAD829C373C3} = 216.163.120.19 216.163.120.21 FF - ProfilePath - c:\documents and settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\ FF - prefs.js: browser.startup.homepage - hxxp://forecast.weather.gov/MapClick.php?site=otx&smap=1&textField1=48.86389&textField2=-117.37139 FF - component: c:\documents and settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll FF - plugin: c:\program files\TabletPlugins\npwacom.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.homepage.dontask, truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \DA9879757777DAE8] "1"=hex:ed,4b,4a,ed,15,23,49,74,5a,62,6c,ea,06,f6,a6,df "2"=hex:a9,40,80,f3,45,2c,d5,a1,17,53,11,d7,21,de,a4,9e,70,5f,a0,52,5b,27,ae, 65,1c,9d,59,02,eb,37,2c,7a,87,23,4c,1a,3f,83,53,96 "3"=hex:ed,4b,4a,ed,15,23,49,74,b0,26,52,ff,a0,7d,07,31,e6,5f,d4,da,fb,3f,90, 71,75,14,ea,42,77,9a,7a,ec,d4,b7,cc,3b,f4,0a,33,5b,a4,1e,da,46,25,2d,2a,72,\ [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387] "1"=hex:1a,dd,98,10,b1,7c,5d,e1 "2"=hex:b5,36,60,c0,75,1d,69,ea "3"=hex:81,20,8f,ab,28,6a,52,9c "4"=hex:2f,ad,a2,e7,8a,bf,05,5e "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\ "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4, 51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20 "7"=hex:ed,4b,4a,ed,15,23,49,74,5a,02,d0,c7,f9,dd,f2,e5,3e,e0,99,3d,a8,68,9c, 4f,1f,71,fc,13,23,3b,2c,6b,94,db,ee,08,97,0d,d7,27,bf,b9,1b,eb,26,77,8c,fe,\ "8"=hex:5d,56,03,e5,33,b3,79,9e,4c,e0,61,6e,a5,60,95,f1,1d,da,60,89,a3,a0,95, f9 "9"=hex:81,20,8f,ab,28,6a,52,9c "18"=hex:b6,dd,00,4d,9d,38,11,d1 "10"=hex:81,20,8f,ab,28,6a,52,9c "11"=hex:81,20,8f,ab,28,6a,52,9c "12"=hex:81,20,8f,ab,28,6a,52,9c "13"=hex:81,20,8f,ab,28,6a,52,9c "14"=hex:81,20,8f,ab,28,6a,52,9c "24"=hex:81,20,8f,ab,28,6a,52,9c "26"=hex:81,20,8f,ab,28,6a,52,9c "19"=hex:81,20,8f,ab,28,6a,52,9c "22"=hex:81,20,8f,ab,28,6a,52,9c . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'winlogon.exe'(724) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3556) c:\windows\system32\WININET.dll c:\program files\Windows Media Player\wmpband.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll . Completion time: 2010-07-26 15:03:54 ComboFix-quarantined-files.txt 2010-07-26 23:03 ComboFix2.txt 2010-07-25 21:09 ComboFix3.txt 2010-07-25 01:57 Pre-Run: 440,506,134,528 bytes free Post-Run: 440,494,862,336 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer - - End Of File - - 0B562DC7B35DF8421DE4A0FB6238D8E0
Post #20
Hello Zhora

Thank you for the log

here's the log from that run even tho I assume it will have to be done again:

ComboFix ran just fine :thumbup:

The log appears to be clean.

Normally I would not ask for another Onilne scan, but I see that it only took 1.5 hours (the longest I have had so far was 31 hours).

Please run Kaspersky again and post the log along with a new DDS scan.

If everything is okay with them I will hand you over to our Tech Team to sort out your hardware and networking issues (not my area of expertise).
Post #21
The download is what takes so slagging long for me with the Kapersky scan. Took at least 5 and a half hours today. Then I ended up doing the scan twice because I discovered that I'd inadvertently reactivated TeaTimer instead of deactivating it before the first scan. Thank you SO MUCH AGAIN!!!! Here's the Kapersky: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, July 27, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Tuesday, July 27, 2010 07:05:37 Records in database: 4196059 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Objects scanned: 92997 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 00:46:56 No threats found. Scanned area is clean. Selected area has been scanned. ————————— And the DDS: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 20:52:35.93 on Tue 07/27/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2664 [GMT -8:00] AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\EPSON\EpsonPrinterStudy4\EPCP.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\runservice.exe C:\Program Files\Avira\AntiVir Desktop\avshadow.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\Wacom_Tablet.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\AIM\aim.exe C:\Documents and Settings\Christine\Desktop\dds.scr ============== Pseudo HJT Report =============== BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [RTHDCPL] RTHDCPL.EXE mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [LTCM Client] c:\program files\ltcm client\ltcmClient.exe /startup mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab TCP: {1F1A66CB-94A3-4054-A560-CAD829C373C3} = 216.163.120.19 216.163.120.21 Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\christ~1\applic~1\mozilla\firefox\profiles\t2cpv24e.default\ FF - prefs.js: browser.startup.homepage - hxxp://forecast.weather.gov/MapClick.php?site=otx&smap=1&textField1=48.86389&textField2=-117.37139 FF - component: c:\documents and settings\christine\application data\mozilla\firefox\profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll FF - plugin: c:\program files\tabletplugins\npwacom.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.homepage.dontask, truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-10-17 11608] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-17 135336] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-10-17 267432] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-10-17 60936] R2 EpsonPrinterStudy4;EpsonPrinterStudy4;c:\program files\epson\epsonprinterstudy4\EPCP.exe [2009-7-30 96144] R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2009-10-9 2560] R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2009-10-23 4463400] R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2009-9-20 89600] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2009-10-23 16168] S2 gupdate;Google Update Service (gupdate);"c:\program files\google\update\googleupdate.exe" /svc –> c:\program files\google\update\GoogleUpdate.exe [?] S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?] =============== Created Last 30 ================ 2010-07-26 14:59 a-dshr– C:\cmdcons 2010-07-26 14:43 –d—– C:\zhora 2010-07-25 15:45 411,368 a——- c:\windows\system32\deployJava1.dll 2010-07-24 17:35 256,512 a——- c:\windows\PEV.exe 2010-07-24 17:35 161,792 a——- c:\windows\SWREG.exe 2010-07-24 17:35 98,816 a——- c:\windows\sed.exe 2010-07-24 17:35 77,312 a——- c:\windows\MBR.exe 2010-07-24 01:16 664 a——- c:\windows\system32\d3d9caps.dat 2010-07-23 09:45 4,194,374 a——- c:\windows\pfirewall.log.old 2010-07-22 16:01 –d—– C:\_OTM 2010-07-21 12:02 –d—– c:\program files\InCode Solutions 2010-07-21 00:45 –d—– c:\docume~1\christ~1\applic~1\Malwarebytes 2010-07-21 00:45 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-21 00:45 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-07-21 00:45 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-07-21 00:45 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-07-20 21:54 460 a——- c:\windows\wininit.ini 2010-07-20 15:52 744,448 -c—— c:\windows\system32\dllcache\helpsvc.exe 2010-07-03 01:25 743,424 -c—— c:\windows\system32\dllcache\iedvtool.dll 2010-07-02 22:26 65,536 -c—— c:\windows\system32\dllcache\asycfilt.dll 2010-07-02 21:32 285,696 -c—— c:\windows\system32\dllcache\atmfd.dll 2010-07-02 20:45 177,664 -c—— c:\windows\system32\dllcache\wintrust.dll 2010-07-02 19:50 100,864 -c—— c:\windows\system32\dllcache\6to4svc.dll 2010-07-02 19:20 86,016 -c—— c:\windows\system32\dllcache\cabview.dll 2010-07-02 18:36 3,558,912 -c—— c:\windows\system32\dllcache\moviemk.exe 2010-07-02 18:15 343,040 -c—— c:\windows\system32\dllcache\mspaint.exe 2010-07-02 18:03 48,128 -c—— c:\windows\system32\dllcache\iyuv_32.dll 2010-07-02 18:03 11,264 -c—— c:\windows\system32\dllcache\msrle32.dll 2010-07-02 18:03 8,704 -c—— c:\windows\system32\dllcache\tsbyuv.dll 2010-07-02 17:57 17,920 -c—— c:\windows\system32\dllcache\msyuv.dll 2010-07-02 17:40 33,280 -c—— c:\windows\system32\dllcache\csrsrv.dll ==================== Find3M ==================== 2010-07-23 07:53 1,655 a——- c:\windows\system32\Wacom_Tablet.dat 2010-07-21 03:27 195,668 a——- c:\windows\pchealth\helpctr\config\cache\Professional_32_1033.dat 2010-06-14 06:31 744,448 a——- c:\windows\pchealth\helpctr\binaries\helpsvc.exe 2010-05-06 02:41 916,480 a——- c:\windows\system32\wininet.dll 2010-05-01 21:22 1,851,264 a——- c:\windows\system32\win32k.sys 2009-11-19 15:48 4 —shr– c:\docume~1\alluse~1\applic~1\sysqcl1129139270.dat 2009-10-26 18:50 8,801,704 a——- c:\program files\FLV PlayerATBSetup.exe ============= FINISH: 20:52:53.32 ===============
Post #22
Hello Zhora

Your logs appear to be clean! Great job :thumbup:

For your hardware issues I suggest that you create a thread in our General Hardware Forum: http://forums.whatthetech.com/index.php?showforum=126

Please include a link to this topic (so they know that your system has been cleaned) and try to provide as much information as you can about your problem (Make of machine, Operating system, printer model, network connection etc. Tech Team guidelines for posting can be found here: http://forums.whatthetech.com/index.php?act=SR&f=126). Our Tech Team will be able to give you some excellent advice.


We only have a few clean up steps left to take care of:


  • Please Uninstall Combofix


    • Click on "Start" and then on "Run".
    • Now type combofix /uninstall in the run box and click "OK". Please note the space between the "x" and the "/Uninstall", it needs to be there.

  • Removal of Tools


    You no longer need DDS], GMER, SystemLook or The Avenger. Please delete them from your system.

  • Please re-enable Spybot Teatimer


    • Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
    • On the left hand side, click "Tools", then click on the "Resident" icon in the list.
    • Check the "Resident "TeaTimer" (Protection of overall system settings) active" box.
    • Click the "System Startup" icon in the List.
    • Check the "TeaTimer" box and "OK" any prompts.
    • If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
    • Exit Spybot S&D when done.


    Once you have completed the above steps you should be good to go! If you have any further questions, please feel free to ask.

  • Finally, please take the time to read through the information provided below:

    Enhance your System Security

    • For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.

    • IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
    • Once complete, remember to re-engage your resident security before going online.

    Web Browsers and Browser Security

    Firefox
    • Firefox is generally considered to have greater browsing security in comparison to other popular programs. You can download Firefox 3.0 from here.

    No-Script
    • If you use Firefox as your default browser, No-Script can provide additional security by preventing malicious scripts from being executed on your system.
    • You can download No-Script by clicking here.

    Internet Explorer
    • The newest version of Internet Explorer is available from here.

    SpywareBlaster
    • If you use Internet Explorer as your default browser, SpywareBlaster would be a valuable addition to your online security.
    • SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.
    • You can download SpywareBlaster by clicking here.

    Web of Trust
    • When using search engines, Web of Trust provides you with an easy way of telling the good sites from the bad and is compatible with both Firefox and Internet Explorer.
    • Coloured symbols are displayed next to search results, giving you more confidence in the links you choose to click on: Green (To go), Yellow (Caution) and Red (Stop).
    • You can download Web of Trust by clicking here.

    Keep your Software Updated
    • Outdated software can sometimes have vulnerabilities that are exploitable by malware.
    • Check if there are available updates for your installed software with Secunia's Online Software Inspector by clicking here.

    Passwords
    • Learn how to create strong passwords by clicking here and test the strength of the passwords you already use by clicking here.

    General Reading

    Learn How To Combat Malware
    • Would you like to learn how to fight back against malware and help others? Enroll at the What The Tech (Formerly Tom Coyotes) Malware Classroom by clicking here.
Post #23
Thank you so much again! :woot: I've been spending the last couple of days just making sure everything's running and adjusting NoScript. That, and it was a pretty stressful week so I REALLY NEEDED to take a break, get some sleep! The printer problem is still persisting, so I will make a thread in the tech area soon - like I said, I really needed a break! :pullhair: Thank you again! –Zhora
Post #25
Since this problem appears to be resolved this topic is now closed. Glad we could help :) If you are the topic starter and need this topic reopened, please PM a staff member (include the address of this thread in your request). Everyone else please start a new topic. Best wishes JonTom

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI