What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

progroup.prorat?

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi winona,


Back up your registry with ERUNT
  • Download ERUNT from Here and save it to your desktop.
  • Double click erunt-setup.exe to install the program
  • Follow the prompts, and then uncheck Create NTREGOPT desktop icon at the Additional Tasks screen.
  • Click No when you are prompted about creating an ERUNT entry in the startup folder.
  • At the next screen, uncheck Show documentation and check Launch ERUNT
  • If ERUNT doesn't start by itself, launch it from the desktop shortcut.
  • At the configuration screen, make sure all 3 checkboxes are checked
  • Click Ok to run the backup process

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00

:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
Please post the OTL fix log.

How's the computer?

Thanks
Post #17
hey, here is the otl log: All processes killed ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\\"BootExecute"|hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00 /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 607521 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 3342651 bytes User: Administrator2 ->Temporary Internet Files folder emptied: 204550 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes ->Java cache emptied: 199611 bytes ->FireFox cache emptied: 14716844 bytes ->Flash cache emptied: 755 bytes User: limited ->Temporary Internet Files folder emptied: 32768 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: peta ->Temp folder emptied: 5761024 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 49564932 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 74595 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 1160192 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 180482 bytes Total Files Cleaned = 73.00 mb OTL by OldTimer - Version 3.2.17.3 log created on 12112010_034732 Files\Folders moved on Reboot… Registry entries deleted on Reboot… Computer is about the same…I am still unable to enable system restore. Any advice, please? PS: I think it's awesome that you give your time and skill to help people for free. Dead impressed. winona
Post #18
Hello,

PS: I think it's awesome that you give your time and skill to help people for free. Dead impressed.

Thank you and not to mention the teachers here are awesome too ;)

It's time for us to pull out a bigger weapon.

Download Combofix from any of the links below but rename it to ConspireCF before saving it to your desktop.

Link 1
Link 2


==================================

Double click on the renamed ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

===================================================

On your next reply please post :
Combofix log

Good Day!
Post #19
Combofix log:

ComboFix 10-12-09.08 - peta 12/11/2010 18:06:53.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.265 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ConspireCF.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\logs
c:\windows\system32\logs\peta(0)_N-0741399D962E4_rundll32_20100716-0353(3108).log

.
((((((((((((((((((((((((( Files Created from 2010-11-11 to 2010-12-11 )))))))))))))))))))))))))))))))
.

2010-12-10 19:47 . 2010-12-10 19:47 ——– dc—-w- C:\_OTL
2010-12-10 19:45 . 2010-12-10 19:46 ——– d—–w- c:\program files\ERUNT
2010-12-08 14:10 . 2010-12-08 14:10 ——– dc—-w- C:\RkUnhooker
2010-12-07 10:34 . 2010-12-07 10:34 ——– d—–w- c:\windows\system32\XPSViewer
2010-12-07 10:34 . 2010-12-07 10:34 ——– d—–w- c:\program files\MSBuild
2010-12-07 10:34 . 2010-12-07 10:34 ——– d—–w- c:\program files\Reference Assemblies
2010-12-07 10:34 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-12-07 10:34 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-12-07 10:34 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-12-07 10:34 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-12-07 10:34 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-12-07 10:34 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-12-07 10:33 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-12-07 10:33 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-12-07 10:33 . 2010-12-07 10:34 ——– dc—-w- C:\8827119d00aeaa12ea
2010-12-04 01:00 . 2010-12-04 01:00 388096 —-a-r- c:\documents and settings\peta\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-04 01:00 . 2010-12-04 01:00 ——– d—–w- c:\program files\Trend Micro
2010-12-02 16:47 . 2010-12-05 12:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-12-02 16:47 . 2010-12-02 16:47 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-11-24 22:11 . 2010-11-24 22:11 167 -c–a-w- C:\__mfdel.bat
2010-11-23 08:29 . 2010-11-23 08:29 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Help
2010-11-23 08:16 . 2010-11-23 08:16 ——– d—–w- c:\documents and settings\peta\Local Settings\Application Data\Identities
2010-11-23 05:36 . 2003-08-18 14:32 174592 —-a-w- c:\windows\system32\LEXPPS.EXE
2010-11-23 05:36 . 2003-08-18 17:47 201216 —-a-w- c:\windows\system32\LEXP2P32.DLL
2010-11-23 05:36 . 2003-08-18 17:48 196096 —-a-w- c:\windows\system32\LEX2KUSB.DLL
2010-11-23 05:36 . 2003-08-18 14:37 303104 —-a-w- c:\windows\system32\LEXBCES.EXE
2010-11-23 05:36 . 2003-08-18 14:34 147456 —-a-w- c:\windows\system32\LEXBCE.DLL
2010-11-23 05:36 . 2003-08-18 17:48 192512 —-a-w- c:\windows\system32\LEXLMPM.DLL
2010-11-23 05:36 . 2008-04-13 18:45 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2010-11-23 05:36 . 2008-04-13 18:45 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2010-11-23 05:36 . 2001-08-17 14:36 87040 -c–a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-11-23 05:36 . 2001-08-17 14:36 87040 —-a-w- c:\windows\system32\wiafbdrv.dll
2010-11-23 05:35 . 2008-04-13 18:47 25856 -c–a-w- c:\windows\system32\dllcache\usbprint.sys
2010-11-23 05:35 . 2008-04-13 18:47 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2010-11-23 05:31 . 1997-04-08 12:08 299520 —-a-w- c:\windows\uninst.exe
2010-11-23 05:31 . 2010-11-23 05:31 ——– d—–w- c:\documents and settings\peta\WINDOWS
2010-11-23 04:51 . 2010-11-28 07:18 ——– d—–w- c:\documents and settings\peta\Local Settings\Application Data\ApplicationHistory
2010-11-22 14:06 . 2010-11-22 14:06 ——– d—–w- c:\program files\Windows Media Connect 2
2010-11-22 14:02 . 2010-11-22 14:04 ——– d—–w- c:\windows\system32\drivers\UMDF
2010-11-22 14:02 . 2010-11-22 14:02 ——– d—–w- c:\windows\system32\LogFiles
2010-11-21 13:29 . 2010-11-21 13:30 ——– d—–w- c:\windows\.jagex_cache_32

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-23 02:19 . 2007-04-05 04:16 626688 —-a-w- c:\windows\system32\msvcr80.dll
2010-11-08 10:50 . 2010-11-06 21:55 16968 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-09-18 06:53 . 2010-07-02 22:51 974848 —-a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2010-07-02 22:51 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2010-07-02 22:51 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-09-18 04:23 . 2010-07-02 22:51 974848 —-a-w- c:\windows\system32\mfc42u.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2010-04-19 6678008]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2010-04-19 925688]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SoundMAX Agent Service (default)"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirSchedulerService"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Analog Devices\\SoundMAX\\SMax4Wiz.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:UDP"= 80:UDP:vs http

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [9/5/2010 11:52 PM 28552]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [7/20/2010 9:22 AM 228216]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [7/20/2010 9:22 AM 24440]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [7/20/2010 9:22 AM 29560]
R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [7/20/2010 9:22 AM 1284600]
R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [7/20/2010 9:22 AM 3364856]
R2 VmbService;Vodafone Mobile Broadband Service;c:\program files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [6/25/2010 12:57 PM 9216]
R3 vodafone_K3805-z_dc_enum;vodafone_K3805-z_dc_enum;c:\windows\system32\drivers\vodafone_K3805-z_dc_enum.sys [3/1/2010 6:35 PM 80000]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\drivers\zteusbvoice.sys [11/8/2010 7:15 PM 105856]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/18/2010 2:25 AM 12872]
S3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [11/10/2010 2:08 PM 9216]
S3 rkhdrv40;Rootkit Unhooker Driver; [x]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [11/8/2010 7:16 PM 114688]
S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/3/2010 1:12 PM 135336]
.
Contents of the 'Scheduled Tasks' folder

2010-09-27 c:\windows\Tasks\User_Feed_Synchronization-{95482345-E0E2-4080-9C10-F009A0C0B058}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 20:31]
.
.
——- Supplementary Scan ——-
.
Trusted Zone: eset.com.au\www
Trusted Zone: live.com\explore
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\go
Trusted Zone: microsoft.com\update
Trusted Zone: mozilla.com
Trusted Zone: windowsupdate.com\download
FF - ProfilePath - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.kongregate.com/games/caesary/caesary
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Extension: Greasefire: [removed] - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
FF - Extension: Gnome Classic: {1ebc69c0-92ff-11dc-8314-0800200c9a66} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{1ebc69c0-92ff-11dc-8314-0800200c9a66}
FF - Extension: LittleFox: {29852C08-1E91-4889-A6BF-C77F91D6A8F3} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{29852C08-1E91-4889-A6BF-C77F91D6A8F3}
FF - Extension: Quick Translator: {5C655500-E712-41e7-9349-CE462F844B19} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{5C655500-E712-41e7-9349-CE462F844B19}
FF - Extension: CacheViewer: {71328583-3CA7-4809-B4BA-570A85818FBB} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{71328583-3CA7-4809-B4BA-570A85818FBB}
FF - Extension: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Extension: MR Tech Toolkit: {9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}
FF - Extension: BlockSite: {dd3d7613-0246-469d-bc65-2a3cc1668adc} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
FF - Extension: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Extension: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Extension: CookieCuller: {99B98C2C-7274-45a3-A640-D9DF1A1C8460} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}
FF - Extension: CsFire: [removed] - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
FF - Extension: HackBar: {F5DDF39C-9293-4d5e-9AA8-E04E6DD5E9B4} - c:\documents and settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{F5DDF39C-9293-4d5e-9AA8-E04E6DD5E9B4}
FF - Extension: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-11 18:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1957994488-413027322-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2188)
c:\windows\system32\WININET.dll
c:\program files\Tall Emu\Online Armor\OAwatch.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\wscntfy.exe
c:\program files\Tall Emu\Online Armor\OAhlp.exe
.
**************************************************************************
.
Completion time: 2010-12-11 18:28:46 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-11 10:28

Pre-Run: 188,132,155,392 bytes free
Post-Run: 188,027,789,312 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - C9B8B62BDB996441CFA8BD291D101D8F


:) winona
Post #20
Hi winona,

Conspire is again experiencing internet problems.

  • Right-click the My Computer icon on the Windows desktop or in the Start menu.
  • Select Manage. The Computer Management window will open.
  • In the left pane, double-click on Services and Applications.
  • Select Services and a list of services should appear.
  • In the right pane, locate the Remote Procedure Call (RPC) service, it should have a Status of "Started" and a Startup Type of "Automatic"
What do you see?


===================================================

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield
  • Do not copy the word CODE , please note the script starts with the :
    :file
C:\__mfdel.bat
:contents
C:\__mfdel.bat
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

===================================================

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You must use Internet Explorer for this scan.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.
Please post back with the ESET log.

Please post back with
  • status for Remote Call Procedure
  • SystemLook log
  • ESET report
Please discribe any symptoms you are experiencing.

Thanks
Post #21
Once again, your continued attention is very much appreciated. I checked and, Remote Procedure Call was already set to automatic and started. When I try to start System Restore, I still get the error message that the system couldn't find the file specified. I ran the ESET Scan and, for some reason it didn't save a log but, I did see the summary at the end of the scan and it was all clear. It didn't find any infected files. Here is the System Look log: SystemLook 04.09.10 by jpshortstuff Log created at 00:46 on 15/12/2010 by peta Administrator - Elevation successful ========== file ========== C:\__mfdel.bat - File found and opened. MD5: CF163C1E9E7D64ACB3F5514D6557C5FD Created at 22:11 on 24/11/2010 Modified at 22:11 on 24/11/2010 Size: 167 bytes Attributes: –a–c- No version information available. ========== contents ========== C:\__mfdel.bat - Opened succesfully. @echo off cd \ cd "C:\Program Files\Miraplacid Form Lite\" if not (%OS%) == (Windows_NT) set NULL=nul :Repeat del "setup.exe" if exist "setup.exe" goto Repeat -= EOF =- You asked me to describe the symptoms I've been experiencing… I spend a lot of time playing browser games at a particular website community where my lack of experience can sometimes be an issue. I worry about keyloggers. Regularly, while playing games, I have sudden onsets of drastic lag and, most of those times, when I ask other users if they are noticing anything, they say they aren't so, it's just me. Over a period of months there have been a lot of little things…like sudden periods of really high cpu usage, once or twice there was suddenly way too many instances of svhost listed in process explorer but, I don't know enough to be able to identify what the hell was happening… now and then, out of the blue while performing tasks that I regularly do, I get an error message saying that I don't have the required permission. More recently, while online, my computer will simply lock up, from time to time - everything freezes and I can't even make task manager open so, I have to reboot without closing everything, first. I use Online Armor free firewall but I'm kind of a noob and I know how to block programs from running or connecting to the net but there is a lot I don't really know - like how to close all the ports I don't need to be using. I apologize if I'm not being as concise as you would like and I'm grateful for your patience. winona
Post #22
Hi,

I'm sorry for the delayed response earlier on.

SFC – System File Checker Workaround

Please try this workaround (you will need your Windows® XP SP2 CD).

(In the event that you do not have a Windows® XP CD with SP2, you will need to 'borrow' one from a friend or colleague, as the manufacturer's "Recovery Discs" will not work in this instance.)

Insert the Windows® XP CD in your drive. (Hold down the Shift Key to prevent it from starting.)

Go Start > Run …in the box type in sfc /scannow …please take note of the space between the sfc and the /.

This is the System File Checker…it will scan all the Windows® core system files to ensure that they are in their respective correct places, and if not replace them from the CD.

During the scan you may be asked to Insert the CD, if this happens just go retry and let it do its thing.

One important point: While sfc is running, it is not advisable to do any other work, or have any browsers/programs running on the computer, until the scan is complete. (This process will generally take around 45-65 minutes to complete).

How is it now?
Post #26
Hi,

We need to first try and remove Online Armour firewall to see if its causing conflicts. It may have blocked some ports unintentionally.

Please go to start - all programs -online armor -uninstall. Reboot.

Then go Start - Control Panel - Double click Windows Firewall - Turn it on and select OK.

Check if System Restore can be enabled.

===================================================

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [9/5/2010 11:52 PM 28552]

:Commands
[emptyflash]
[emptytemp]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
===================================================

On your next reply please post :
Feedback on System Restore
OTL fix log
Fresh OTL log


Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI