What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

What's going on?

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi Boggler

Things are looking pretty good but you haven’t told me how your computer is running.

A couple of things to clear up from the last log.

Open ComboFix

Please do the following:
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the codebox below into it:
File::
C:\Users\Kwab\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\49c90790-7272410f

Folder::
c:\users\Kwab\AppData\Roaming\Azureus

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.


Clear all your temporary files

Download ATF Cleaner
• Double-click ATF-Cleaner.exe (on your desktop) to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.
If you use Firefox browser
• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu

Please remember to tell me how your computer is behaving now.

Satchfan
Post #17
Thanks computer seems to be running fine now and the previous issues are no longer appearing. Here's my latest log:



ComboFix 10-09-30.03 - Kwab 01/10/2010 8:13.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.1268 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Kwab\Desktop\cfscript.txt
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\Kwab\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\49c90790-7272410f"
.

((((((((((((((((((((((((( Files Created from 2010-09-01 to 2010-10-01 )))))))))))))))))))))))))))))))
.

2010-10-01 07:22 . 2010-10-01 07:22 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-10-01 07:22 . 2010-10-01 07:22 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-10-01 07:08 . 2010-10-01 07:09 ——– d—–w- C:\32788R22FWJFW
2010-09-29 04:25 . 2010-06-22 13:30 2048 —-a-w- c:\windows\system32\tzres.dll
2010-09-27 21:30 . 2010-09-27 21:30 ——– d—–w- c:\program files\Common Files\Java
2010-09-27 21:29 . 2010-09-27 21:29 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-09-23 17:14 . 2010-09-23 17:14 ——– d—–w- c:\users\Kwab\AppData\Roaming\Malwarebytes
2010-09-23 17:14 . 2010-04-29 14:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-23 17:14 . 2010-09-23 17:14 ——– d—–w- c:\programdata\Malwarebytes
2010-09-23 17:14 . 2010-09-23 20:32 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-23 17:14 . 2010-04-29 14:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-23 09:53 . 2010-09-23 09:53 388096 —-a-r- c:\users\Kwab\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-18 12:23 . 2010-09-20 22:25 ——– d—–w- c:\users\Kwab\AppData\Roaming\AA Pass Your Test
2010-09-15 21:45 . 2010-04-16 16:46 502272 —-a-w- c:\windows\system32\usp10.dll
2010-09-15 21:45 . 2010-08-17 14:11 128000 —-a-w- c:\windows\system32\spoolsv.exe
2010-09-15 21:45 . 2010-04-05 17:02 317952 —-a-w- c:\windows\system32\MP4SDECD.DLL
2010-09-15 21:45 . 2010-05-27 20:08 739328 —-a-w- c:\windows\system32\inetcomm.dll
2010-09-01 16:34 . 2010-09-01 16:34 1361192 —-a-w- c:\windows\system32\ISPPopUpDlg.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-01 07:22 . 2008-02-19 22:02 ——– d—–w- c:\programdata\Kontiki
2010-10-01 06:52 . 2007-12-11 16:48 12 —-a-w- c:\windows\bthservsdp.dat
2010-09-30 19:04 . 2010-03-12 22:33 ——– d—–w- c:\program files\Microsoft Silverlight
2010-09-29 21:28 . 2010-08-10 21:00 ——– d—–w- c:\program files\AA Pass Your Test
2010-09-27 21:21 . 2008-02-26 12:09 ——– d—–w- c:\program files\Java
2010-09-25 21:21 . 2008-08-20 06:30 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2010-09-25 18:58 . 2008-03-15 19:56 ——– d—–w- c:\program files\Azureus
2010-09-25 07:36 . 2009-03-14 12:53 27744 —-a-w- c:\users\Kwab\AppData\Roaming\nvModes.dat
2010-09-23 20:32 . 2008-06-23 03:22 ——– d—–w- c:\users\Kwab\AppData\Roaming\Otduco
2010-09-23 17:31 . 2010-06-05 06:55 ——– d—–w- c:\program files\Autorun Eater
2010-09-23 08:04 . 2008-12-24 05:18 ——– d—–w- c:\users\Kwab\AppData\Roaming\Acbe
2010-09-16 02:10 . 2007-12-11 18:27 ——– d—–w- c:\programdata\Microsoft Help
2010-09-16 02:04 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-08-24 13:57 . 2010-07-25 05:53 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-08-24 13:57 . 2010-07-25 05:53 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 13:57 . 2010-07-25 05:53 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-08-24 13:57 . 2010-07-25 05:53 64304 —-a-w- c:\windows\system32\drivers\mfenlfk.sys
2010-08-24 13:57 . 2010-07-25 05:53 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-08-24 13:57 . 2010-07-25 05:53 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-08-24 13:57 . 2010-07-25 05:53 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-24 13:57 . 2010-07-25 05:53 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-08-24 13:57 . 2010-07-25 05:53 164808 —-a-w- c:\windows\system32\drivers\mfewfpk.sys
2010-08-24 13:57 . 2010-07-25 05:53 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-08-22 22:07 . 2008-02-14 18:06 ——– d—–w- c:\users\Kwab\AppData\Roaming\Skype
2010-08-22 19:40 . 2008-02-14 18:07 ——– d—–w- c:\users\Kwab\AppData\Roaming\skypePM
2010-08-21 20:44 . 2010-08-21 20:44 ——– d—–w- c:\program files\Veoh Networks
2010-08-15 10:05 . 2010-08-15 10:01 ——– d—–w- c:\program files\Trojan Remover
2010-08-15 10:02 . 2010-08-15 10:02 715152 —-a-w- c:\programdata\Simply Super Software\Trojan Remover\Data\trunins.exe
2010-08-15 10:01 . 2010-08-15 10:01 ——– d—–w- c:\users\Kwab\AppData\Roaming\Simply Super Software
2010-08-15 10:01 . 2010-08-15 10:01 ——– d—–w- c:\programdata\Simply Super Software
2010-07-25 05:54 . 2006-11-02 10:25 51200 —-a-w- c:\windows\Inf\infpub.dat
2010-07-25 05:54 . 2006-11-02 10:25 143360 —-a-w- c:\windows\Inf\infstrng.dat
2010-07-25 05:54 . 2006-11-02 10:25 143360 —-a-w- c:\windows\Inf\infstor.dat
2010-07-21 10:07 . 2009-09-20 17:40 38784 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-07-18 451872]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-13 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-23 857648]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-10-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-24 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-24 81920]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-15 122880]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"B2C_AGENT"="c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2010-05-20 317368]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-06-24 1193848]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-11-22 19:15 13672 —-a-w- c:\program files\Citrix\GoToAssist\599\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner]
2010-08-15 10:02 1167808 —-a-w- c:\program files\Trojan Remover\Trjscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]
2010-07-06 14:01 2634048 —-a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R2 0112961285876675mcinstcleanup;McAfee Application Installer Cleanup (0112961285876675);c:\windows\TEMP\011296~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 135664]
R3 ADDMEM;ADDMEM;c:\users\Kwab\AppData\Local\Temp\__Samsung_Update\ADDMEM.SYS [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-08-31 29472]
R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2007-10-25 487424]
R3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2007-10-25 15488]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-08-24 84264]
R3 NETw2v32;Intel® PRO/Wireless 2915ABG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-19 16896]
R4 EPGService;EPGService;c:\progra~1\WinTV\EPG Services\System\EPGService.exe [2006-07-19 435200]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-08-24 64304]
S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-08-24 164808]
S2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\DRIVERS\kmdfmemio.sys [2006-11-14 13312]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-08-24 188136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-08-24 141792]
S2 myAgtSvc;McAfee Total Protection Agent Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [2006-05-04 120392]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-08-24 55840]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-08-24 312904]


— Other Services/Drivers In Memory —

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-07-18 08:53 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-10-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 09:37]

2010-10-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 09:37]

2010-10-01 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-10-27 13:26]

2010-10-01 c:\windows\Tasks\User_Feed_Synchronization-{5C210700-6543-4646-B781-D7D2BE24CDBB}.job
- c:\windows\system32\msfeedssync.exe [2010-08-11 04:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.co.uk/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: flybmi.com\www
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20100805101937
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/63.27/uploader2.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPI.cab
DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles_vista/KVPISPCTLD_VISTA.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-01 08:22
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-10-01 08:24:54
ComboFix-quarantined-files.txt 2010-10-01 07:24
ComboFix2.txt 2010-09-30 23:55
ComboFix3.txt 2010-09-28 22:04
ComboFix4.txt 2010-09-27 21:58

Pre-Run: 20,893,523,968 bytes free
Post-Run: 20,846,092,288 bytes free

- - End Of File - - E49A399C67D88A91261F8F77428464E6
Post #18
Hi boggler.

Your computer appears to be clean. :thumbup:

We need to tidy up a bit by removing the tools that have been used.

Uninstall Combofix

Follow these steps to uninstall Combofix• Click START then RUN
• Now type Combofix /uninstall in the runbox and click OK.
Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)
• Please follow the prompts to uninstall Combofix.
• Once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
===================================================

Uninstall OTL
  • Double-click OTL.exe
  • Click the CleanUp! button.
  • Select Yes when the Begin cleanup Process? prompt appears.
  • If you are prompted to reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.

===================================================

Re-enable DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

===================================================

Update Acrobat Reader

It is advisable to upgrade to version 9.3.4 in order to secure the program from known vulnerabilities. You can either run Reader and select Check for Updates under the Help menu, or visit the link below to download the update manually. If you have issues installing this update, make sure all browsers are closed before starting.

http://www.adobe.com/support/downloads/pro…&product=10

===================================================

Recommended programs
  • Although Spybot Search & Destroy was a good program, it is not robust enough to deal with today’s intruders and infections. I suggest you replace it with the following free program:
    SpywareBlaster. SpywareBlaster blocks over 11,000 bad guys and sites and uses zero resources of your computer.
  • Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.
You can never update too often and your computer will not be protected from new malware if your programs are not up-to-date.

===================================================

I also recommend that you read the following:

"How to prevent malware" by miekiemoes

Safe computing

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI