What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google Redirect, Bluescreens, possible infection

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, My computer has been creating problems for me. Every time I do a search in google, when I click on the link and it redirects me to another site. It gets annoying. 2.) My computer keeps giving the bluescreen even when I am not doing anything. Sometimes it will go to bluescreen after I log in. 3.) I was looking for my cookies, and in the search I found a folder titled: PCF-VLC. Is that bad? In the next post I will post the HijackThis log.
Post #2
Hi,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds file to run the tool.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop. Post them back to your topic.
Post #3
Hi,

Before we continue I must say a couple of things:
1) My computer has not been able to install the Vista SP2, which is now expired according to the microsoft website.
2) My computer has not been able to create a restore points. So most of the software I have, the drivers, all came factory installed. I know that programs such as itunes, skype, and such i can get again.

I say this because I have no way of re-installing certain programs.

Thanks for your help. :)

Here are the logs:

—-DDS Log—–

DDS (Ver_10-12-12.01) - NTFSx86
Run by [removed] at 13:27:33.25 on Wed 01/26/2011
Internet Explorer: 8.0.6001.18999 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.125 [GMT -6:00]

AV: Symantec AntiVirus *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
AV: Antivirus *Enabled/Outdated* {28e00e3b-806e-4533-925c-f4c3d79514b9}
SP: Symantec AntiVirus *Disabled/Updated* {6C85A515-B91D-4D2B-AF18-40984A4A8493}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *Enabled/Updated* {222A897C-5018-402e-943F-7E7AC8560DA7}
AV: Panda Antivirus Pro 2010 *Enabled/Updated* {86971480-9989-6750-B122-681A86518D59}
SP: Panda Antivirus Pro 2010 *Enabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Panda Personal Firewall 2010 *Enabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PskSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2010\WebProxy.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\ASTSRV.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost -k Panda
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\AVENGINE.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\Firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\ApVxdWin.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint\Apoint.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint\Apvfb.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\msfeedssync.exe
C:\Users\Jorge Alejandro\Desktop\dds.pif

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.com/ig?hl=en
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.sony.com/vaiopeople
mDefault_Page_URL = hxxp://www.sony.com/vaiopeople
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [AdobeBridge]
mRun: [APVXDWIN] "c:\program files\panda security\panda antivirus pro 2010\APVXDWIN.EXE" /s
mRun: [SCANINICIO] "c:\program files\panda security\panda antivirus pro 2010\Inicio.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} - hxxp://esupport.sony.com/VaioInfo.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} - hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-us.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll
mASetup: Nitro PDF Professional - cscript //B "c:\program files\nitro pdf\professional\RemoveOldAddins.vbs"

================= FIREFOX ===================

FF - ProfilePath - c:\users\jorgea~1\appdata\roaming\mozilla\firefox\profiles\49ypuvj5.default\
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Extension: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - c:\users\jorgea~1\appdata\roaming\mozilla\firefox\profiles\49ypuvj5.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Extension: Diccionario español Venezuela: [removed] - c:\users\jorgea~1\appdata\roaming\mozilla\firefox\profiles\49ypuvj5.default\extensions\[removed]

============= SERVICES / DRIVERS ===============

R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys [2010-6-28 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2010-6-28 73728]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2010-6-28 52992]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2010-6-28 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2010-6-28 193792]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2010-6-28 158848]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2010-6-28 41144]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2010-6-28 46720]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-6-12 21504]
R2 AmFSM;AmFSM;c:\windows\system32\drivers\amm8660.sys [2010-6-28 49208]
R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k panda –> c:\windows\system32\svchost -k Panda [?]
R2 Panda Software Controller;Panda Software Controller;c:\program files\panda security\panda antivirus pro 2010\PsCtrlS.exe [2010-6-28 173312]
R2 PAVFNSVR;Panda Function Service;c:\program files\panda security\panda antivirus pro 2010\PavFnSvr.exe [2010-6-28 169216]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2010-6-28 177416]
R2 PavPrSrv;Panda Process Protection Service;c:\program files\common files\panda security\pavshld\PavPrSrv.exe [2010-6-28 62768]
R2 PAVSRV;Panda On-Access Anti-Malware Service;c:\program files\panda security\panda antivirus pro 2010\pavsrvx86.exe [2010-6-28 291584]
R2 PskSvcRetail;Panda PSK service;c:\program files\panda security\panda antivirus pro 2010\psksvc.exe [2010-6-28 28928]
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\drivers\neti1634.sys [2010-6-28 197888]
R3 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2010-3-10 247320]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-8-26 812544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1c9a59268b15470;Google Update Service (gupdate1c9a59268b15470);c:\program files\google\update\GoogleUpdate.exe [2009-3-15 133104]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S3 McComponentHostService;McAfee Security Scan Component Host Service;"c:\program files\mcafee security scan\2.0.181\mcchsvc.exe" –> c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\belkin\belkin usb print and storage center\BkBackupScheduler.exe [2010-9-19 152064]
S4 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\belkin\belkin usb print and storage center\Bkapcs.exe [2010-9-19 49152]
S4 NSUService;NSUService;c:\program files\sony\network utility\NSUService.exe [2007-8-27 200704]
S4 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2007-8-27 745472]
S4 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\sony\vaio media integrated server\platform\SV_Httpd.exe [2007-8-27 397312]
S4 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2007-8-27 1089536]
S4 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\sony\vcm intelligent analyzing manager\VcmIAlzMgr.exe [2007-8-26 292152]
S4 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\common files\sony shared\vcmxml\VcmXmlIfHelper.exe [2007-8-26 79736]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" –> c:\program files\viewpoint\common\ViewpointService.exe [?]

=============== Created Last 30 ================

2011-01-26 06:56:22 388096 —-a-r- c:\users\jorgea~1\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-01-26 01:43:08 5890896 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{74e5ac80-2dd7-4563-a567-c2311844ef02}\mpengine.dll
2011-01-12 05:39:26 708608 —-a-w- c:\program files\common files\system\ado\msado15.dll
2011-01-12 05:39:26 409600 —-a-w- c:\windows\system32\odbc32.dll
2011-01-12 05:39:26 253952 —-a-w- c:\program files\common files\system\ado\msadox.dll
2011-01-12 05:39:25 57344 —-a-w- c:\program files\common files\system\msadc\msadcs.dll
2011-01-12 05:39:25 241664 —-a-w- c:\program files\common files\system\ado\msadomd.dll
2011-01-12 05:39:25 180224 —-a-w- c:\program files\common files\system\msadc\msadco.dll
2011-01-12 05:39:22 1169408 —-a-w- c:\windows\system32\sdclt.exe
2011-01-08 05:46:35 ——– d—–r- c:\program files\Skype
2011-01-04 02:40:33 ——– d—–w- c:\users\jorgea~1\appdata\roaming\Flickr
2011-01-04 02:40:33 ——– d—–w- c:\users\jorgea~1\appdata\local\Flickr
2011-01-04 00:30:30 ——– d—–w- c:\program files\Flickr Uploadr

==================== Find3M ====================

2011-01-26 05:11:50 1063724848 —-a-w- c:\windows\DUMP494e.tmp
2011-01-23 00:20:57 1063721248 —-a-w- c:\windows\DUMP3b89.tmp
2011-01-07 02:31:56 1063721248 —-a-w- c:\windows\DUMP52b1.tmp
2010-12-19 00:49:44 1063724848 —-a-w- c:\windows\DUMP3d7c.tmp
2010-12-18 05:07:42 1063721248 —-a-w- c:\windows\DUMP3b3b.tmp
2010-12-16 16:58:47 1063721248 —-a-w- c:\windows\DUMP338d.tmp
2010-12-11 18:15:28 1061636384 —-a-w- c:\windows\DUMP37f0.tmp
2010-12-11 17:54:48 1063721248 —-a-w- c:\windows\DUMP3523.tmp
2010-11-29 18:22:00 1063721248 —-a-w- c:\windows\DUMP4864.tmp
2010-11-29 18:06:46 1063721248 —-a-w- c:\windows\DUMP3938.tmp
2010-11-13 06:12:24 1063724848 —-a-w- c:\windows\DUMP4884.tmp
2010-11-10 18:28:37 1063721248 —-a-w- c:\windows\DUMP3a12.tmp
2010-11-06 11:10:29 345088 —-a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-06 11:10:13 357376 —-a-w- c:\windows\system32\taskschd.dll
2010-11-06 11:10:13 270336 —-a-w- c:\windows\system32\taskcomp.dll
2010-11-06 11:09:57 603648 —-a-w- c:\windows\system32\schedsvc.dll
2010-11-05 00:53:47 171520 —-a-w- c:\windows\system32\taskeng.exe
2010-11-04 21:55:01 1061663040 —-a-w- c:\windows\DUMP4c5a.tmp
2010-11-02 06:01:54 916480 —-a-w- c:\windows\system32\wininet.dll
2010-11-02 05:57:41 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-11-02 05:57:27 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2010-11-02 05:57:11 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-11-02 05:57:11 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-11-02 05:01:31 385024 —-a-w- c:\windows\system32\html.iec
2010-11-02 04:26:10 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2010-11-02 04:24:44 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2010-10-30 16:57:03 1063724848 —-a-w- c:\windows\DUMP3b6a.tmp
2010-10-29 15:29:02 1063724848 —-a-w- c:\windows\DUMP450a.tmp
2010-10-29 02:26:22 1063721248 —-a-w- c:\windows\DUMP473c.tmp

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6001

CreateFile("\\.\PHYSICALDRIVE0"): The maximum number of secrets that may be stored in a single system has been exceeded.
device: opened successfully
user: error reading MBR

Disk trace:
called modules: ntkrnlpa.exe >>UNKNOWN [0x866EB6D2]<< >>UNKNOWN [0x8CB64D70]<<
_asm { JMP 0x647969e; }
1 ntkrnlpa!IofCallDriver[0x828FF05F] -> \Device\Harddisk0\DR0[0x857344C0]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
user != kernel MBR !!!

============= FINISH: 13:31:23.19 ===============


—-Attach log —–


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 12/25/2007 2:07:10 PM
System Uptime: 1/26/2011 12:49:20 PM (1 hours ago)

Motherboard: Sony Corporation | | VAIO
Processor: Intel® Pentium® Dual CPU T2310 @ 1.46GHz | N/A | 800/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 104 GiB total, 24.519 GiB free.
D: is Removable
E: is Removable
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0017
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter #8
PNP Device ID: ROOT\*ISATAP\0017
Service: tunnel

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================


µTorrent
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.0
Adobe Shockwave Player 11.5
Akamai NetSession Interface
Alps Pointing-device for VAIO
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft TotalMedia Backup
AutoUpdate
Belkin Daily DJ
Belkin Music Labeler
Belkin Setup and Router Monitor
Belkin USB Print and Storage Center
Bibbia italiana
Bonjour
CCleaner
Click to DVD 2.0.05 Menu Data
Click to DVD 2.6.00
Compatibility Pack for the 2007 Office system
Debugging Tools for Windows (x86)
DivX Codec
DivX Player
DivX Plus Web Player
DivX Version Checker
Flickr Uploadr 3.2.1
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
Google Talk (remove only)
Google Update Helper
HDAUDIO SoftV92 Data Fax Modem with SmartCP
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel® Graphics Media Accelerator Driver
iTunes
Java™ 6 Update 17
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Java™ SE Runtime Environment 6
Junk Mail filter update
LocationFree Player
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft .NET Framework 4 Multi-Targeting Pack
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Help Viewer 1.0
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.4
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server 2008 R2 Management Objects
Microsoft SQL Server Compact 3.5 SP2 ENU
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server System CLR Types
Microsoft SQL Server VSS Writer
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Mozilla Firefox (3.6.11)
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Napster Burn Engine
Nitro PDF Professional
OGA Notifier 2.0.0048.0
OpenMG Limited Patch 4.7-07-15-19-01
OpenMG Secure Module 4.7.00
Panda Antivirus Pro 2010
QuickBooks Product Listing Service
QuickTime
Realtek High Definition Audio Driver
Roxio Easy Media Creator Home
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Setting Utility Series
Skype™ 5.1
SonicStage Mastering Studio
SonicStage Mastering Studio Audio Filter
SonicStage Mastering Studio Audio Filter Custom Preset
SonicStage Mastering Studio Plugins
Sony Video Shared Library
SupportSoft Assisted Service
System Requirements Lab for Intel
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2412171)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2483110)
VAIO Azure Float Wallpaper
VAIO Center Access Bar
VAIO Content Folder Setting
VAIO Content Importer VAIO Content Exporter
VAIO Content Importer / VAIO Content Exporter
VAIO Content Metadata Intelligent Analyzing Manager
VAIO Content Metadata Manager Setting
VAIO Content Metadata XML Interface Library
VAIO Control Center
VAIO Entertainment Center
VAIO Entertainment Platform
VAIO Event Service
VAIO Floral Dusk Wallpaper
VAIO Help And Support
VAIO Launcher
VAIO Media
VAIO Media 6.0
VAIO Media AC3 Decoder 1.0
VAIO Media Content Collection 6.0
VAIO Media Integrated Server 6.1
VAIO Media Redistribution 6.0
VAIO Media Registration Tool
VAIO Media Registration Tool 6.0
VAIO Movie Story
VAIO Movie Story Template Data
VAIO MusicBox
VAIO MusicBox Sample Music
VAIO OOBE and Welcome Center
VAIO Original Function Setting
VAIO PC Wireless LAN Wizard
VAIO Power Management
VAIO Productivity Center
VAIO Security Center
VAIO Service Utility
VAIO Smart Network
VAIO Survey
VAIO Teal Whisper Wallpaper
VAIO Update 3
VC80CRTRedist - 8.0.50727.4053
Viewpoint Media Player
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Player Firefox Plugin
WinDVD for VAIO

==== End Of File ===========================
Post #4
Just to let you know: My current Antivirus is Panda AntiVirus Pro. I noticed Symantic showed up in the log. Can we get rid of that one and the others?
Post #5
Hi,

Before we continue I must say a couple of things:
1) My computer has not been able to install the Vista SP2, which is now expired according to the microsoft website.
2) My computer has not been able to create a restore points. So most of the software I have, the drivers, all came factory installed. I know that programs such as itunes, skype, and such i can get again.

I say this because I have no way of re-installing certain programs.

They didn't provide recovery disks, did they?


utorrent

Above listed ones are P2P file sharing programs. P2P downloads are nowadays one of those things that most likely bring infection into the system. My recommendation is to uninstall these (and other if present) P2P file sharing programs.


Please download MBRCheck to your desktop.

1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log in your reply.
Post #6
No they did have include recovery disks. The recovery tools are on the hard drive. As soon as I saw uTorrent I deleted it before you telling me ;) Here is the MBR Check log: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows Vista Home Premium Edition Windows Information: Service Pack 1 (build 6001), 32-bit Base Board Manufacturer: Sony Corporation BIOS Manufacturer: Phoenix Technologies LTD System Manufacturer: Sony Corporation System Product Name: VGN-NR110E Logical Drives Mask: 0x0000003c Kernel Drivers (total 160): 0x82810000 \SystemRoot\system32\ntkrnlpa.exe 0x82BC9000 \SystemRoot\system32\hal.dll 0x8060D000 \SystemRoot\system32\kdcom.dll 0x80615000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x80675000 \SystemRoot\system32\PSHED.dll 0x80686000 \SystemRoot\system32\BOOTVID.dll 0x8068E000 \SystemRoot\system32\CLFS.SYS 0x806CF000 \SystemRoot\system32\CI.dll 0x82E02000 \SystemRoot\system32\drivers\Wdf01000.sys 0x82E7E000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x82E8B000 \SystemRoot\system32\drivers\acpi.sys 0x82ED1000 \SystemRoot\system32\drivers\WMILIB.SYS 0x82EDA000 \SystemRoot\system32\drivers\msisadrv.sys 0x82EE2000 \SystemRoot\system32\drivers\pci.sys 0x82F09000 \SystemRoot\System32\drivers\partmgr.sys 0x82F18000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x82F1B000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x82F25000 \SystemRoot\system32\drivers\volmgr.sys 0x82F34000 \SystemRoot\System32\drivers\volmgrx.sys 0x82F7E000 \SystemRoot\system32\drivers\intelide.sys 0x82F85000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x82F93000 \SystemRoot\system32\DRIVERS\pcmcia.sys 0x82FC0000 \SystemRoot\System32\drivers\mountmgr.sys 0x82FD0000 \SystemRoot\system32\Drivers\pavboot.sys 0x82FD6000 \SystemRoot\system32\drivers\atapi.sys 0x82FDE000 \SystemRoot\system32\drivers\ataport.SYS 0x807AF000 \SystemRoot\system32\drivers\msahci.sys 0x807B9000 \SystemRoot\system32\drivers\fltmgr.sys 0x807EB000 \SystemRoot\system32\drivers\fileinfo.sys 0x80600000 \SystemRoot\System32\Drivers\PxHelp20.sys 0x86A09000 \SystemRoot\System32\Drivers\ksecdd.sys 0x86A7A000 \SystemRoot\system32\drivers\ndis.sys 0x86B85000 \SystemRoot\system32\drivers\msrpc.sys 0x86BB0000 \SystemRoot\system32\drivers\NETIO.SYS 0x86C01000 \SystemRoot\System32\drivers\tcpip.sys 0x86CEA000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x86E04000 \SystemRoot\System32\Drivers\Ntfs.sys 0x86F13000 \SystemRoot\system32\drivers\volsnap.sys 0x86F4C000 \SystemRoot\System32\Drivers\spldr.sys 0x86F54000 \SystemRoot\System32\Drivers\mup.sys 0x86F63000 \SystemRoot\System32\drivers\ecache.sys 0x86F8A000 \SystemRoot\system32\drivers\disk.sys 0x86F9B000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x86FBC000 \SystemRoot\system32\drivers\crcdisk.sys 0x86FE7000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x86FF2000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x86D05000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x86FFB000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x8BC03000 \SystemRoot\system32\DRIVERS\igdkmd32.sys 0x86D14000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x8C1E9000 \SystemRoot\System32\drivers\watchdog.sys 0x86DB3000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x86DBE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x86BEA000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x8C20B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8C21D000 \SystemRoot\system32\DRIVERS\yk60x86.sys 0x8C25C000 \SystemRoot\system32\DRIVERS\athr.sys 0x8C343000 \SystemRoot\system32\DRIVERS\ohci1394.sys 0x8C353000 \SystemRoot\system32\DRIVERS\1394BUS.SYS 0x8C40A000 \SystemRoot\system32\drivers\ti21sony.sys 0x8C4D6000 \SystemRoot\System32\Drivers\SonyNC.sys 0x8C4DD000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x8C4F0000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x8C4FB000 \SystemRoot\system32\DRIVERS\Apfiltr.sys 0x8C524000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x8C530000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x8C549000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys 0x8C54F000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x8C57D000 \SystemRoot\system32\DRIVERS\storport.sys 0x8C5BE000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8C5C9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x8C5E0000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8C361000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8C5EB000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8C384000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8C398000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x8C3AD000 \SystemRoot\system32\DRIVERS\neti1634.sys 0x8C3DC000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8C5FA000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8CA07000 \SystemRoot\system32\DRIVERS\ks.sys 0x8CA31000 \SystemRoot\system32\DRIVERS\sxuptp.sys 0x8CA70000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8CA7A000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8CA87000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x8CABB000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x8CC0E000 \SystemRoot\system32\drivers\RTKVHDA.sys 0x8CDC1000 \SystemRoot\system32\drivers\portcls.sys 0x8CACC000 \SystemRoot\system32\drivers\drmk.sys 0x8CAF1000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys 0x8CE07000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys 0x8CF0A000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys 0x8CFBE000 \SystemRoot\system32\drivers\modem.sys 0x8CFCB000 \SystemRoot\System32\Drivers\Cdr4_xp.SYS 0x8CFCC000 \SystemRoot\System32\Drivers\Cdralw2k.SYS 0x8CFCD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x8CFD6000 \SystemRoot\System32\Drivers\Null.SYS 0x8CFDD000 \SystemRoot\System32\Drivers\Beep.SYS 0x8CFED000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x8CFF4000 \SystemRoot\System32\drivers\vga.sys 0x8CB2E000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8CFE4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x8CDEE000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8CC00000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8CB7A000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8CDF6000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x8CB88000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8CB9E000 \SystemRoot\system32\DRIVERS\smb.sys 0x8CBB2000 \??\C:\Windows\system32\Drivers\NETFLTDI.SYS 0x8D20F000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8D241000 \SystemRoot\system32\drivers\afd.sys 0x8D289000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8D29F000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8D2AD000 \??\C:\Windows\system32\Drivers\WNMFLT.SYS 0x8D2B7000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x8D2CA000 \SystemRoot\System32\DRIVERS\ShlDrv51.sys 0x8D2D3000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8D30F000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8D319000 \??\C:\Windows\system32\Drivers\IDSFLT.SYS 0x8D347000 \??\C:\Windows\system32\Drivers\fnetmon.SYS 0x8D34B000 \??\C:\Windows\system32\Drivers\DSAFLT.SYS 0x8D357000 \SystemRoot\system32\DRIVERS\DMICall.sys 0x8D358000 \SystemRoot\System32\Drivers\dfsc.sys 0x8D36F000 \??\C:\Windows\system32\Drivers\APPFLT.SYS 0x8D380000 \SystemRoot\System32\Drivers\crashdmp.sys 0x8D38D000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x8D398000 \SystemRoot\System32\Drivers\dump_msahci.sys 0x95E00000 \SystemRoot\System32\win32k.sys 0x8D3A2000 \SystemRoot\System32\drivers\Dxapi.sys 0x8D3AC000 \SystemRoot\system32\DRIVERS\monitor.sys 0x96020000 \SystemRoot\System32\TSDDD.dll 0x96040000 \SystemRoot\System32\cdd.dll 0x96050000 \SystemRoot\System32\ATMFD.DLL 0x8D3BB000 \SystemRoot\system32\drivers\luafv.sys 0x8D3D6000 \SystemRoot\system32\DRIVERS\amm8660.sys 0x8D3E6000 \??\C:\Windows\system32\PavTPK.sys 0x8CBD8000 \SystemRoot\system32\DRIVERS\lltdio.sys 0xABA0D000 \SystemRoot\system32\DRIVERS\nwifi.sys 0xABA37000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xABA41000 \SystemRoot\system32\DRIVERS\rspndr.sys 0xABA54000 \SystemRoot\system32\drivers\HTTP.sys 0xABAC1000 \SystemRoot\system32\drivers\spsys.sys 0xABB70000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xABB8D000 \SystemRoot\system32\DRIVERS\bowser.sys 0xABBA6000 \SystemRoot\System32\drivers\mpsdrv.sys 0xABBBB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xABC0D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xABC46000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0xABC5E000 \SystemRoot\System32\DRIVERS\srv2.sys 0xABC86000 \SystemRoot\System32\DRIVERS\srv.sys 0xABCEC000 \??\C:\Windows\system32\PavSRK.sys 0xABCEF000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys 0xABD01000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xABD05000 \??\C:\Windows\system32\DRIVERS\PavProc.sys 0xAEA02000 \SystemRoot\system32\drivers\peauth.sys 0xAEAE0000 \SystemRoot\System32\Drivers\secdrv.SYS 0xAEAEA000 \SystemRoot\System32\drivers\tcpipreg.sys 0xAEAF6000 \SystemRoot\system32\DRIVERS\xaudio.sys 0xAEAFE000 \SystemRoot\system32\drivers\av5flt.sys 0xAEB17000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x77500000 \Windows\System32\ntdll.dll Processes (total 71): 0 System Idle Process 4 System 524 C:\Windows\System32\smss.exe 600 csrss.exe 644 C:\Windows\System32\wininit.exe 656 csrss.exe 688 C:\Windows\System32\services.exe 700 C:\Windows\System32\lsass.exe 708 C:\Windows\System32\lsm.exe 792 C:\Windows\System32\winlogon.exe 900 C:\Windows\System32\svchost.exe 968 C:\Windows\System32\svchost.exe 1008 C:\Windows\System32\svchost.exe 1064 C:\Windows\System32\svchost.exe 1120 C:\Windows\System32\svchost.exe 1192 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\psksvc.exe 1244 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe 1272 C:\Windows\System32\svchost.exe 1464 C:\Windows\System32\svchost.exe 272 C:\Windows\System32\svchost.exe 1560 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\WebProxy.exe 1816 C:\Windows\System32\audiodg.exe 292 C:\Windows\System32\svchost.exe 1492 C:\Windows\System32\SLsvc.exe 1332 C:\Windows\System32\spoolsv.exe 544 C:\Windows\System32\svchost.exe 308 C:\Windows\System32\svchost.exe 1708 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 1920 C:\Windows\System32\ASTSRV.EXE 460 C:\Program Files\Bonjour\mDNSResponder.exe 1564 C:\Windows\System32\svchost.exe 1596 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe 704 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsCtrlS.exe 836 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe 2668 C:\Program Files\Common Files\Panda Security\PavShld\PavPrSrv.exe 2976 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe 3776 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\AVENGINE.EXE 2832 C:\Windows\System32\svchost.exe 3224 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\FIREWALL\PSHost.exe 2472 C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe 2968 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe 3160 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 3524 C:\Windows\System32\svchost.exe 2744 C:\Windows\System32\svchost.exe 1372 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE 2020 C:\Windows\System32\SearchIndexer.exe 3144 C:\Windows\System32\drivers\XAudio.exe 604 C:\Windows\System32\taskeng.exe 2548 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE 3848 C:\Program Files\Windows Media Player\wmpnetwk.exe 2368 C:\Windows\System32\dwm.exe 2352 C:\Windows\System32\taskeng.exe 3728 C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe 2768 C:\Windows\System32\wuauclt.exe 2808 C:\Program Files\Windows Media Player\wmpnscfg.exe 260 C:\Windows\RtHDVCpl.exe 1184 C:\Windows\System32\hkcmd.exe 1476 C:\Program Files\Apoint\Apoint.exe 2732 C:\Windows\ehome\ehtray.exe 4932 C:\Windows\ehome\ehmsas.exe 4540 C:\Program Files\Apoint\ApMsgFwd.exe 5100 C:\Program Files\Apoint\ApntEx.exe 3972 C:\Program Files\Apoint\Apvfb.exe 5420 C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 1036 C:\Program Files\Mozilla Firefox\firefox.exe 2952 C:\Program Files\Mozilla Firefox\plugin-container.exe 3168 C:\Windows\System32\SearchProtocolHost.exe 4596 C:\Windows\System32\igfxsrvc.exe 4108 C:\Windows\explorer.exe 5988 C:\Windows\System32\SearchFilterHost.exe 3996 C:\Users\Jorge Alejandro\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000001`d7b00000 (NTFS) PhysicalDrive0 Model Number: Size Device Name MBR Status ——————————————– ERROR Opening: \\.\PhysicalDrive0 (1381) Done!
Post #7
Hi


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.

Please continue as follows:

  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  • Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
Post #8
I am unable to run ComboFix. I keep getting an APPCRASH error. I've tried downloading it and saving it to the desktop many times. The program starts if it says ComboFix(2) - this happened when i downloaded the file again without being aware of the other file already present - but then it says that this file cannot be renamed. I've tried shutting down and restarting the computer and still get the APPCRASH error. Is there something that could be causing this?
Post #10
Hi,

I tried it in safe mode. The application would not start. Even trying to run it as admin. it would not run.

Here are the details of the error:

Problem signature:
Problem Event Name: APPCRASH
Application Name: ComboFix.exe
Application Version: 0.0.0.0
Application Timestamp: 4a87e7ff
Fault Module Name: ComboFix.exe
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 4a87e7ff
Exception Code: 80000003
Exception Offset: 00025a90
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional Information 1: 6981
Additional Information 2: 784e16db964f68bfccfd77b7769e3430
Additional Information 3: b10a
Additional Information 4: 2cf46eaff7cce1ebb4f9056eb5fae11b

Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=501…mp;clcid=0x0409
Post #12
It worked!

Here is the log file for combofix:

ComboFix 11-01-28.03 - Jorge Alejandro 01/30/2011 12:50:17.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.537 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\koshe.exe
AV: Panda Antivirus Pro 2010 *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}
FW: Panda Personal Firewall 2010 *Disabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}
SP: Panda Antivirus Pro 2010 *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
ADS - Windows: deleted 0 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Securityessentials2010
c:\programdata\pswi_preloaded.exe
C:\restore
c:\users\Jorge Alejandro\AppData\Roaming\screensaver_Beach.scr
c:\windows\system32\drivers\etc\lmhosts

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MSIVXserv.sys
——-\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-30 )))))))))))))))))))))))))))))))
.

2011-01-30 18:45 . 2011-01-30 18:46 ——– dc—-w- C:\32788R22FWJFW
2011-01-26 06:56 . 2011-01-26 06:56 388096 —-a-r- c:\users\Jorge Alejandro\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-26 01:43 . 2011-01-13 09:41 5890896 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{74E5AC80-2DD7-4563-A567-C2311844EF02}\mpengine.dll
2011-01-12 05:39 . 2010-12-28 14:57 409600 —-a-w- c:\windows\system32\odbc32.dll
2011-01-12 05:39 . 2010-12-28 14:56 708608 —-a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 05:39 . 2010-12-28 14:56 253952 —-a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 05:39 . 2010-12-28 14:56 57344 —-a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2011-01-12 05:39 . 2010-12-28 14:56 241664 —-a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 05:39 . 2010-12-28 14:56 180224 —-a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 05:39 . 2010-12-14 15:49 1169408 —-a-w- c:\windows\system32\sdclt.exe
2011-01-08 05:55 . 2011-01-10 22:01 ——– d—–w- c:\users\Jorge Alejandro\AppData\Roaming\skypePM
2011-01-08 05:46 . 2011-01-08 05:46 ——– d—–w- c:\program files\Common Files\Skype
2011-01-08 05:46 . 2011-01-08 05:46 ——– d—–r- c:\program files\Skype
2011-01-08 05:46 . 2011-01-26 05:58 ——– d—–w- c:\users\Jorge Alejandro\AppData\Roaming\Skype
2011-01-08 05:34 . 2011-01-08 05:46 ——– d—–w- c:\programdata\Skype
2011-01-04 02:40 . 2011-01-04 02:40 ——– d—–w- c:\users\Jorge Alejandro\AppData\Roaming\Flickr
2011-01-04 02:40 . 2011-01-04 02:40 ——– d—–w- c:\users\Jorge Alejandro\AppData\Local\Flickr
2011-01-04 00:30 . 2011-01-23 06:05 ——– d—–w- c:\program files\Flickr Uploadr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-26 05:11 . 2007-12-25 20:00 1063724848 —-a-w- c:\windows\DUMP494e.tmp
2011-01-23 00:20 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP3b89.tmp
2011-01-07 02:31 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP52b1.tmp
2010-12-19 00:49 . 2007-12-25 20:00 1063724848 —-a-w- c:\windows\DUMP3d7c.tmp
2010-12-18 05:07 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP3b3b.tmp
2010-12-16 16:58 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP338d.tmp
2010-12-11 18:15 . 2007-12-25 20:00 1061636384 —-a-w- c:\windows\DUMP37f0.tmp
2010-12-11 17:54 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP3523.tmp
2010-11-29 18:22 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP4864.tmp
2010-11-29 18:06 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP3938.tmp
2010-11-25 06:57 . 2009-03-30 22:30 564632 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2010-11-25 06:57 . 2009-03-30 22:20 17816 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2010-11-13 06:12 . 2007-12-25 20:00 1063724848 —-a-w- c:\windows\DUMP4884.tmp
2010-11-10 18:28 . 2007-12-25 20:00 1063721248 —-a-w- c:\windows\DUMP3a12.tmp
2010-11-06 11:10 . 2010-12-16 04:49 345088 —-a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-06 11:10 . 2010-12-16 04:49 357376 —-a-w- c:\windows\system32\taskschd.dll
2010-11-06 11:10 . 2010-12-16 04:49 270336 —-a-w- c:\windows\system32\taskcomp.dll
2010-11-06 11:09 . 2010-12-16 04:49 603648 —-a-w- c:\windows\system32\schedsvc.dll
2010-11-05 00:53 . 2010-12-16 04:49 171520 —-a-w- c:\windows\system32\taskeng.exe
2010-11-04 21:55 . 2007-12-25 20:00 1061663040 —-a-w- c:\windows\DUMP4c5a.tmp
2010-11-02 06:01 . 2010-12-16 04:49 916480 —-a-w- c:\windows\system32\wininet.dll
2010-11-02 05:57 . 2010-12-16 04:49 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-11-02 05:57 . 2010-12-16 04:49 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2010-11-02 05:57 . 2010-12-16 04:49 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-11-02 05:57 . 2010-12-16 04:49 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-11-02 05:01 . 2010-12-16 04:49 385024 —-a-w- c:\windows\system32\html.iec
2010-11-02 04:26 . 2010-12-16 04:49 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2010-11-02 04:24 . 2010-12-16 04:49 1638912 —-a-w- c:\windows\system32\mshtml.tlb
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"APVXDWIN"="c:\program files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE" [2009-06-05 574720]
"SCANINICIO"="c:\program files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe" [2009-04-21 56064]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-25 4489216]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-29 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-29 154136]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-08 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-07-25 02:26 98304 ——w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Calendar Sync.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Calendar Sync.lnk
backup=c:\windows\pss\Google Calendar Sync.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TotalMedia Backup Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TotalMedia Backup Monitor.lnk
backup=c:\windows\pss\TotalMedia Backup Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Jorge Alejandro^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\users\Jorge Alejandro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Jorge Alejandro^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
path=c:\users\Jorge Alejandro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
backup=c:\windows\pss\Logitech . Product Registration.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 05:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 10:47 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 08:44 500208 ——w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-03-18 16:19 207360 —-a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ——w- c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaLAN]
2010-03-02 21:15 1134488 —-a-w- c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe]
2007-06-12 01:27 317560 ——w- c:\program files\Sony\ISB Utility\ISBMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 07:10 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nitro PDF Printer Monitor]
2009-05-27 17:56 209216 —-a-w- c:\program files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSUFloatingUI]
2007-06-29 20:38 258048 ——w- c:\program files\Sony\Network Utility\LANUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-06-29 13:45 133656 ——w- c:\windows\System32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 16:17 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-01-03 21:44 15028104 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-06-25 21:41 1826816 —-a-w- c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-11-14 07:02 149280 ——w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VWLASU]
2007-07-12 18:31 45056 ——w- c:\program files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3147054866-92175380-2420560267-1002]
"EnableNotificationsRef"=dword:00000001

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9a59268b15470;Google Update Service (gupdate1c9a59268b15470);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 133104]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [x]
R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [2009-12-18 11336]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 PavSRK.sys;PavSRK.sys;c:\windows\system32\PavSRK.sys [x]
R3 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [2010-03-10 152064]
R4 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [2010-03-10 49152]
R4 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [2007-06-29 200704]
R4 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]
R4 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
R4 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
R4 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-07-13 292152]
R4 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2007-07-06 79736]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [x]
S0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [2008-06-19 28544]
S1 APPFLT;App Filter Plugin;c:\windows\system32\Drivers\APPFLT.SYS [2008-06-25 73728]
S1 DSAFLT;DSA Filter Plugin;c:\windows\system32\Drivers\DSAFLT.SYS [2008-06-18 52992]
S1 FNETMON;NetMon Filter Plugin;c:\windows\system32\Drivers\fnetmon.SYS [2008-03-28 22072]
S1 IDSFLT;Ids Filter Plugin;c:\windows\system32\Drivers\IDSFLT.SYS [2008-06-18 193792]
S1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\Drivers\NETFLTDI.SYS [2008-07-11 19:58 158848]
S1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [2008-03-04 41144]
S1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\Drivers\WNMFLT.SYS [2008-06-18 46720]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [2008-02-14 49208]
S2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost [x]
S2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [2009-06-02 177416]
S2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Antivirus Pro 2010\PskSvc.exe [2008-06-25 28928]
S3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\DRIVERS\neti1634.sys [2008-06-26 197888]
S3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [x]
S3 sxuptp;SXUPTP Driver;c:\windows\system32\DRIVERS\sxuptp.sys [2010-03-10 247320]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-06-05 812544]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2011-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 17:20]

2011-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 17:20]

2010-08-20 c:\windows\Tasks\RCHubTask 0 0 {2E6E3A14-F6F5-404E-AC33-87F20083074D} 0~0.job
- c:\program files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe [2006-12-27 09:43]

2011-01-30 c:\windows\Tasks\User_Feed_Synchronization-{73E1DD56-116B-47F5-8A29-793974F5EF7F}.job
- c:\windows\system32\msfeedssync.exe [2010-12-16 04:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/ig?hl=en
mStart Page = hxxp://www.sony.com/vaiopeople
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
FF - ProfilePath - c:\users\Jorge Alejandro\AppData\Roaming\Mozilla\Firefox\Profiles\49ypuvj5.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Diccionario español Venezuela: [removed] - %profile%\extensions\[removed]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
ShellIconOverlayIdentifiers-{AB0C8BE3-041C-47d6-8195-E089D32B38DD} - (no file)
HKCU-Run-AdobeBridge - (no file)
SafeBoot-ccEvtMgr
SafeBoot-ccSetMgr
SafeBoot-Symantec Antivirus
MSConfigStartUp-AdobeCS5ServiceManager - c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
MSConfigStartUp-Google Update - c:\users\Jorge Alejandro\AppData\Local\Google\Update\GoogleUpdate.exe
MSConfigStartUp-SwitchBoard - c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
MSConfigStartUp-wmsdk64_32 - c:\users\JORGEA~1\AppData\Local\Temp\wmsdk64_32.exe
HKLM_ActiveSetup-Nitro PDF Professional - (no file)
AddRemove-{FD9E03B5-AEEA-4D59-B512-6CE4AA0281D4} - c:\users\Jorge Alejandro\AppData\Local\{7D4B3D1D-104E-4507-9123-568BC721B7E2}\BYKI4Installer.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-30 13:15
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet114\Services\MSIVXserv.sys]
"imagepath"="\systemroot\system32\drivers\MSIVXtwuibktxwryryrqcmivxcfohbpinelht.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet114\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet114\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet114\Services\MSIVXserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\MSIVXtwuibktxwryryrqcmivxcfohbpinelht.sys"
.
———————— Other Running Processes ————————
.
c:\program files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe
c:\program files\PANDA SECURITY\PANDA ANTIVIRUS PRO 2010\WebProxy.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\ASTSRV.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Panda Security\Panda Antivirus Pro 2010\PsCtrls.exe
c:\program files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe
c:\program files\Common Files\Panda Security\PavShld\pavprsrv.exe
c:\program files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe
c:\program files\Panda Security\Panda Antivirus Pro 2010\AVENGINE.EXE
c:\program files\Panda Security\Panda Antivirus Pro 2010\Firewall\PSHOST.EXE
c:\program files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Sony\VAIO Update 3\VAIOUpdt.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\RtHDVCpl.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\program files\Apoint\ApMsgFwd.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Apoint\Apvfb.exe
c:\program files\Apoint\Apntex.exe
.
**************************************************************************
.
Completion time: 2011-01-30 13:27:49 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-30 19:27

Pre-Run: 25,091,391,488 bytes free
Post-Run: 24,802,877,440 bytes free

- - End Of File - - 9FD0E00678488329E66297AC2539A88A




————————————————————————————————————————————————————————–

Here's the log file for DDS:



DDS (Ver_10-12-12.01) - NTFSx86
Run by [removed] at 13:43:31.05 on Sun 01/30/2011
Internet Explorer: 8.0.6001.18999 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.278 [GMT -6:00]

AV: Symantec AntiVirus *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
AV: Antivirus *Enabled/Outdated* {28e00e3b-806e-4533-925c-f4c3d79514b9}
SP: Symantec AntiVirus *Disabled/Updated* {6C85A515-B91D-4D2B-AF18-40984A4A8493}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *Enabled/Updated* {222A897C-5018-402e-943F-7E7AC8560DA7}
AV: Panda Antivirus Pro 2010 *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}
SP: Panda Antivirus Pro 2010 *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Panda Personal Firewall 2010 *Disabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PskSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\TPSrv.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2010\WebProxy.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\ASTSRV.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost -k Panda
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\pavsrvx86.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\AVENGINE.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\Firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\PsImSvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\ApVxdWin.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint\Apoint.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint\Apvfb.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Jorge Alejandro\Desktop\dds.pif
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig?hl=en
mStart Page = hxxp://www.sony.com/vaiopeople
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [APVXDWIN] "c:\program files\panda security\panda antivirus pro 2010\APVXDWIN.EXE" /s
mRun: [SCANINICIO] "c:\program files\panda security\panda antivirus pro 2010\Inicio.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} - hxxp://esupport.sony.com/VaioInfo.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} - hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-us.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\jorgea~1\appdata\roaming\mozilla\firefox\profiles\49ypuvj5.default\
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Extension: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - c:\users\jorgea~1\appdata\roaming\mozilla\firefox\profiles\49ypuvj5.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Extension: Diccionario español Venezuela: [removed] - c:\users\jorgea~1\appdata\roaming\mozilla\firefox\profiles\49ypuvj5.default\extensions\[removed]

============= SERVICES / DRIVERS ===============

R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys [2010-6-28 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2010-6-28 73728]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2010-6-28 52992]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2010-6-28 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2010-6-28 193792]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2010-6-28 158848]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2010-6-28 41144]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2010-6-28 46720]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-6-12 21504]
R2 AmFSM;AmFSM;c:\windows\system32\drivers\amm8660.sys [2010-6-28 49208]
R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k panda –> c:\windows\system32\svchost -k Panda [?]
R2 Panda Software Controller;Panda Software Controller;c:\program files\panda security\panda antivirus pro 2010\PsCtrlS.exe [2010-6-28 173312]
R2 PAVFNSVR;Panda Function Service;c:\program files\panda security\panda antivirus pro 2010\PavFnSvr.exe [2010-6-28 169216]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2010-6-28 177416]
R2 PavPrSrv;Panda Process Protection Service;c:\program files\common files\panda security\pavshld\PavPrSrv.exe [2010-6-28 62768]
R2 PAVSRV;Panda On-Access Anti-Malware Service;c:\program files\panda security\panda antivirus pro 2010\pavsrvx86.exe [2010-6-28 291584]
R2 PskSvcRetail;Panda PSK service;c:\program files\panda security\panda antivirus pro 2010\psksvc.exe [2010-6-28 28928]
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\drivers\neti1634.sys [2010-6-28 197888]
R3 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2010-3-10 247320]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-8-26 812544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1c9a59268b15470;Google Update Service (gupdate1c9a59268b15470);c:\program files\google\update\GoogleUpdate.exe [2009-3-15 133104]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S3 McComponentHostService;McAfee Security Scan Component Host Service;"c:\program files\mcafee security scan\2.0.181\mcchsvc.exe" –> c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\belkin\belkin usb print and storage center\BkBackupScheduler.exe [2010-9-19 152064]
S4 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\belkin\belkin usb print and storage center\Bkapcs.exe [2010-9-19 49152]
S4 NSUService;NSUService;c:\program files\sony\network utility\NSUService.exe [2007-8-27 200704]
S4 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2007-8-27 745472]
S4 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\sony\vaio media integrated server\platform\SV_Httpd.exe [2007-8-27 397312]
S4 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2007-8-27 1089536]
S4 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\sony\vcm intelligent analyzing manager\VcmIAlzMgr.exe [2007-8-26 292152]
S4 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\common files\sony shared\vcmxml\VcmXmlIfHelper.exe [2007-8-26 79736]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" –> c:\program files\viewpoint\common\ViewpointService.exe [?]

=============== Created Last 30 ================

2011-01-30 19:14:28 ——– dcsh–w- C:\$RECYCLE.BIN
2011-01-30 18:59:15 ——– d—–w- c:\users\jorgea~1\appdata\local\temp
2011-01-30 18:46:22 98816 —-a-w- c:\windows\sed.exe
2011-01-30 18:46:22 89088 —-a-w- c:\windows\MBR.exe
2011-01-30 18:46:22 256512 —-a-w- c:\windows\PEV.exe
2011-01-30 18:46:22 161792 —-a-w- c:\windows\SWREG.exe
2011-01-26 06:56:22 388096 —-a-r- c:\users\jorgea~1\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-01-26 01:43:08 5890896 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{74e5ac80-2dd7-4563-a567-c2311844ef02}\mpengine.dll
2011-01-12 05:39:26 708608 —-a-w- c:\program files\common files\system\ado\msado15.dll
2011-01-12 05:39:26 409600 —-a-w- c:\windows\system32\odbc32.dll
2011-01-12 05:39:26 253952 —-a-w- c:\program files\common files\system\ado\msadox.dll
2011-01-12 05:39:25 57344 —-a-w- c:\program files\common files\system\msadc\msadcs.dll
2011-01-12 05:39:25 241664 —-a-w- c:\program files\common files\system\ado\msadomd.dll
2011-01-12 05:39:25 180224 —-a-w- c:\program files\common files\system\msadc\msadco.dll
2011-01-12 05:39:22 1169408 —-a-w- c:\windows\system32\sdclt.exe
2011-01-08 05:46:35 ——– d—–r- c:\program files\Skype
2011-01-04 02:40:33 ——– d—–w- c:\users\jorgea~1\appdata\roaming\Flickr
2011-01-04 02:40:33 ——– d—–w- c:\users\jorgea~1\appdata\local\Flickr
2011-01-04 00:30:30 ——– d—–w- c:\program files\Flickr Uploadr

==================== Find3M ====================

2011-01-26 05:11:50 1063724848 —-a-w- c:\windows\DUMP494e.tmp
2011-01-23 00:20:57 1063721248 —-a-w- c:\windows\DUMP3b89.tmp
2011-01-07 02:31:56 1063721248 —-a-w- c:\windows\DUMP52b1.tmp
2010-12-19 00:49:44 1063724848 —-a-w- c:\windows\DUMP3d7c.tmp
2010-12-18 05:07:42 1063721248 —-a-w- c:\windows\DUMP3b3b.tmp
2010-12-16 16:58:47 1063721248 —-a-w- c:\windows\DUMP338d.tmp
2010-12-11 18:15:28 1061636384 —-a-w- c:\windows\DUMP37f0.tmp
2010-12-11 17:54:48 1063721248 —-a-w- c:\windows\DUMP3523.tmp
2010-11-29 18:22:00 1063721248 —-a-w- c:\windows\DUMP4864.tmp
2010-11-29 18:06:46 1063721248 —-a-w- c:\windows\DUMP3938.tmp
2010-11-13 06:12:24 1063724848 —-a-w- c:\windows\DUMP4884.tmp
2010-11-10 18:28:37 1063721248 —-a-w- c:\windows\DUMP3a12.tmp
2010-11-06 11:10:29 345088 —-a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-06 11:10:13 357376 —-a-w- c:\windows\system32\taskschd.dll
2010-11-06 11:10:13 270336 —-a-w- c:\windows\system32\taskcomp.dll
2010-11-06 11:09:57 603648 —-a-w- c:\windows\system32\schedsvc.dll
2010-11-05 00:53:47 171520 —-a-w- c:\windows\system32\taskeng.exe
2010-11-04 21:55:01 1061663040 —-a-w- c:\windows\DUMP4c5a.tmp
2010-11-02 06:01:54 916480 —-a-w- c:\windows\system32\wininet.dll
2010-11-02 05:57:41 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-11-02 05:57:27 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2010-11-02 05:57:11 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-11-02 05:57:11 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-11-02 05:01:31 385024 —-a-w- c:\windows\system32\html.iec
2010-11-02 04:26:10 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2010-11-02 04:24:44 1638912 —-a-w- c:\windows\system32\mshtml.tlb

============= FINISH: 13:48:17.39 ===============



UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 12/25/2007 2:07:10 PM
System Uptime: 1/30/2011 1:36:18 PM (0 hours ago)

Motherboard: Sony Corporation | | VAIO
Processor: Intel® Pentium® Dual CPU T2310 @ 1.46GHz | N/A | 800/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 104 GiB total, 23.124 GiB free.
D: is Removable
E: is Removable
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0017
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter #8
PNP Device ID: ROOT\*ISATAP\0017
Service: tunnel

Class GUID:
Description:
Device ID: ROOT\LEGACY_BEEP\XX_MSIVXSERV.SYS_XX
Manufacturer:
Name:
PNP Device ID: ROOT\LEGACY_BEEP\XX_MSIVXSERV.SYS_XX
Service: MSIVXserv.sys

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================


Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.0
Adobe Shockwave Player 11.5
Akamai NetSession Interface
Alps Pointing-device for VAIO
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft TotalMedia Backup
AutoUpdate
Belkin Daily DJ
Belkin Music Labeler
Belkin Setup and Router Monitor
Belkin USB Print and Storage Center
Bibbia italiana
Bonjour
CCleaner
Click to DVD 2.0.05 Menu Data
Click to DVD 2.6.00
Compatibility Pack for the 2007 Office system
Debugging Tools for Windows (x86)
DivX Codec
DivX Player
DivX Plus Web Player
DivX Version Checker
Flickr Uploadr 3.2.1
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
Google Talk (remove only)
Google Update Helper
HDAUDIO SoftV92 Data Fax Modem with SmartCP
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel® Graphics Media Accelerator Driver
iTunes
Java™ 6 Update 17
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Java™ SE Runtime Environment 6
Junk Mail filter update
LocationFree Player
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft .NET Framework 4 Multi-Targeting Pack
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Help Viewer 1.0
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.4
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server 2008 R2 Management Objects
Microsoft SQL Server Compact 3.5 SP2 ENU
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server System CLR Types
Microsoft SQL Server VSS Writer
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Mozilla Firefox (3.6.11)
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Napster Burn Engine
Nitro PDF Professional
OGA Notifier 2.0.0048.0
OpenMG Limited Patch 4.7-07-15-19-01
OpenMG Secure Module 4.7.00
Panda Antivirus Pro 2010
QuickBooks Product Listing Service
QuickTime
Realtek High Definition Audio Driver
Roxio Easy Media Creator Home
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Setting Utility Series
Skype™ 5.1
SonicStage Mastering Studio
SonicStage Mastering Studio Audio Filter
SonicStage Mastering Studio Audio Filter Custom Preset
SonicStage Mastering Studio Plugins
Sony Video Shared Library
SupportSoft Assisted Service
System Requirements Lab for Intel
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2412171)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2483110)
VAIO Azure Float Wallpaper
VAIO Center Access Bar
VAIO Content Folder Setting
VAIO Content Importer VAIO Content Exporter
VAIO Content Importer / VAIO Content Exporter
VAIO Content Metadata Intelligent Analyzing Manager
VAIO Content Metadata Manager Setting
VAIO Content Metadata XML Interface Library
VAIO Control Center
VAIO Entertainment Center
VAIO Entertainment Platform
VAIO Event Service
VAIO Floral Dusk Wallpaper
VAIO Help And Support
VAIO Launcher
VAIO Media
VAIO Media 6.0
VAIO Media AC3 Decoder 1.0
VAIO Media Content Collection 6.0
VAIO Media Integrated Server 6.1
VAIO Media Redistribution 6.0
VAIO Media Registration Tool
VAIO Media Registration Tool 6.0
VAIO Movie Story
VAIO Movie Story Template Data
VAIO MusicBox
VAIO MusicBox Sample Music
VAIO OOBE and Welcome Center
VAIO Original Function Setting
VAIO PC Wireless LAN Wizard
VAIO Power Management
VAIO Productivity Center
VAIO Security Center
VAIO Service Utility
VAIO Smart Network
VAIO Survey
VAIO Teal Whisper Wallpaper
VAIO Update 3
VC80CRTRedist - 8.0.50727.4053
Viewpoint Media Player
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Player Firefox Plugin
WinDVD for VAIO

==== End Of File ===========================
Post #13
Hi again,

Do you use Panda or Symantec as your main protection there?

Please do the following steps in normal mode.

Open notepad and copy/paste the text in the quotebox below into it:

DDS::
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
Trusted Zone: se-2011-download.com
Trusted Zone: se-2011-payment.com
Reglockdel::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet114\Services\MSIVXserv.sys]
SecCenter::
{28e00e3b-806e-4533-925c-f4c3d79514b9}


Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

[external image: Posted Image]

Close all browser windows, disable protection and refering to the picture above, drag CFScript into koshe.exe
Then post the resultant log.


Get update 9.4.1 for Adobe Reader here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.



Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version…

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 23.
  • Click the
    Download
    button to the right.
  • Select Windows on platform combobox and check the box that says:
    Accept License Agreement. Click continue.
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u23-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.

* Go here to run an online scanner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is not checked.
  • Click Scan
  • Wait for the scan to finish.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI