What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

browser hijacking and trojan virus

47 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello JonTom

Here are the results.



_______
c:\program files\Common Files\OnlineFilesManager.dll


http://www.virustotal.com/file-scan/report…6461-1296920918
_________


Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8



``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
McAfee SecurityCenter
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Java™ 6 Update 23
Java™ SE Runtime Environment 6 Update 1
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Out of date Java installed!
Adobe Flash Player
Adobe Reader 7.0
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VIRUSS~1 mcshield.exe
McAfee VIRUSS~1 mcsysmon.exe
``````````End of Log````````````
_______

ComboFix 11-01-31.02 - HP_Administrator 02/05/2011 10:17:59.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3006.2426 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt
AV: McAfee VirusScan *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
* Created a new restore point
* Resident AV is active


FILE ::
"c:\windows\SEFC0C0D5.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\15331662541.dll
c:\windows\SEFC0C0D5.tmp . . . . Failed to delete

.
((((((((((((((((((((((((( Files Created from 2011-01-05 to 2011-02-05 )))))))))))))))))))))))))))))))
.

2011-02-05 16:26 . 2011-02-05 16:26 0 —-a-w- c:\windows\SEFC0C0D5.tmp
2011-02-03 02:05 . 2011-02-03 02:05 ——– d—–w- C:\_OTL
2011-02-01 15:50 . 2011-02-01 17:56 ——– d—–w- C:\otl scanner antivirus
2011-02-01 00:02 . 2011-02-03 14:45 ——– d—–w- C:\Combofix newest and documents and err message pics
2011-01-31 16:00 . 2011-01-31 16:01 ——– d—–w- C:\DDS newest
2011-01-31 15:59 . 2011-01-31 16:11 ——– d—–w- C:\gmer new
2011-01-31 02:06 . 2011-01-31 23:32 ——– d—–w- C:\Anti-virus Hijackthis log analized pic
2011-01-30 22:33 . 2011-01-30 22:33 ——– d—–w- C:\HiJackThis newest
2011-01-30 04:23 . 2010-12-21 00:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-30 04:23 . 2011-01-30 04:23 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-01-30 04:23 . 2010-12-21 00:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-01-27 21:13 . 2011-01-27 21:14 ——– d—–w- C:\K-lite codec pack 6.6.2
2011-01-27 21:07 . 2011-02-05 16:22 ——– d—–w- c:\program files\Common Files\Data
2011-01-27 21:01 . 2011-01-27 21:01 197632 —-a-w- c:\program files\Common Files\OnlineFilesManager.dll
2011-01-26 20:06 . 2011-01-26 20:06 ——– d—–w- C:\RAW Workflow from Capture to Archives A Complete Digital Photographer's Guide to Raw Imaging extracted
2011-01-25 20:05 . 2011-01-25 20:07 ——– d—–w- C:\7 zip software
2011-01-25 19:37 . 2011-01-25 19:37 ——– d—–w- C:\Rar archive
2011-01-22 04:19 . 2011-01-22 04:19 ——– d—–w- c:\windows\system32\XPSViewer
2011-01-22 04:19 . 2011-01-22 04:19 ——– d—–w- c:\program files\MSBuild
2011-01-22 04:19 . 2011-01-22 04:19 ——– d—–w- c:\program files\Reference Assemblies
2011-01-22 04:18 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-01-22 04:18 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-01-22 04:18 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-01-22 04:18 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-01-22 04:18 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-01-22 04:18 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2011-01-22 04:18 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2011-01-22 04:18 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-01-22 04:18 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-01-22 03:55 . 2011-01-22 03:55 ——– d—–w- c:\windows\ie8updates
2011-01-22 03:29 . 2010-09-18 06:53 974848 ——w- c:\windows\system32\dllcache\mfc42.dll
2011-01-22 03:29 . 2010-09-18 06:53 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll
2011-01-22 03:26 . 2010-08-27 08:02 119808 ——w- c:\windows\system32\dllcache\t2embed.dll
2011-01-22 03:26 . 2009-10-15 16:28 81920 ——w- c:\windows\system32\dllcache\fontsub.dll
2011-01-22 03:24 . 2010-08-23 16:12 617472 ——w- c:\windows\system32\dllcache\comctl32.dll
2011-01-22 03:24 . 2010-11-02 15:17 40960 ——w- c:\windows\system32\dllcache\ndproxy.sys
2011-01-22 03:23 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2011-01-22 03:23 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2011-01-22 03:23 . 2010-11-06 00:26 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2011-01-22 03:23 . 2010-11-06 00:26 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll
2011-01-22 03:23 . 2010-11-06 00:26 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2011-01-22 03:20 . 2009-06-21 21:44 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2011-01-22 03:16 . 2010-06-18 13:36 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe
2011-01-22 03:10 . 2010-10-11 14:59 45568 ——w- c:\windows\system32\dllcache\wab.exe
2011-01-22 03:10 . 2010-08-16 08:45 590848 ——w- c:\windows\system32\dllcache\rpcrt4.dll
2011-01-20 21:03 . 2011-01-20 21:05 ——– d—–w- C:\ASPI Programs dvdfab out of date
2011-01-19 20:06 . 2011-01-24 18:16 ——– d—–w- C:\Temp
2011-01-19 20:02 . 2010-03-24 14:53 266240 —-a-w- c:\windows\system32\VideoEdit.ocx
2011-01-19 20:02 . 2009-10-09 21:33 335872 —-a-w- c:\windows\system32\dvdauthor.ocx
2011-01-19 20:02 . 2008-07-30 12:23 2078952 —-a-w- c:\windows\system32\starburnx.dll
2011-01-19 20:02 . 2008-04-17 16:14 233472 —-a-w- c:\windows\system32\viscomdvdimg.dll
2011-01-19 20:02 . 2011-01-19 20:21 ——– d—–w- c:\program files\Cheetah Burner
2011-01-19 16:32 . 2011-01-30 20:58 ——– d—–w- C:\Pic Camera 9
2011-01-19 00:21 . 2011-01-19 00:21 ——– d—–w- c:\windows\system32\wbem\Repository
2011-01-18 20:43 . 2011-01-18 20:43 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Nero
2011-01-18 20:23 . 2011-01-19 00:20 ——– d—–w- c:\program files\Nero
2011-01-18 20:22 . 2011-01-19 00:20 ——– d—–w- c:\documents and settings\All Users\Application Data\Nero
2011-01-18 20:22 . 2011-01-19 00:20 ——– d—–w- c:\program files\Ask.com
2011-01-16 06:32 . 2011-01-19 00:46 ——– d—–w- c:\program files\DVDFab 5
2011-01-16 01:44 . 2011-01-16 01:44 ——– d—–w- c:\program files\Elaborate Bytes
2011-01-14 04:47 . 2011-01-14 05:08 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\1Click DVD Copy
2011-01-14 04:39 . 2011-01-16 00:01 ——– d—–w- c:\documents and settings\All Users\Application Data\1click dvd copy
2011-01-14 04:38 . 2011-01-14 04:38 ——– d—–w- c:\program files\LG Software Innovations
2011-01-14 02:59 . 2011-01-24 20:00 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Vso
2011-01-14 02:59 . 2011-01-14 02:59 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2011-01-14 02:59 . 2011-01-14 02:59 47360 —-a-w- c:\documents and settings\HP_Administrator\Application Data\pcouffin.sys
2011-01-14 02:59 . 2007-03-19 02:37 65602 —-a-w- c:\windows\system32\cook3260.dll
2011-01-14 02:59 . 2006-09-29 18:26 176165 —-a-w- c:\windows\system32\drv23260.dll
2011-01-14 02:59 . 2006-09-29 18:25 208935 —-a-w- c:\windows\system32\drv33260.dll
2011-01-14 02:59 . 2006-09-29 18:24 217127 —-a-w- c:\windows\system32\drv43260.dll
2011-01-14 02:59 . 2006-05-20 22:16 1184984 —-a-w- c:\windows\system32\wvc1dmod.dll
2011-01-14 02:59 . 2006-05-12 01:21 626688 —-a-w- c:\windows\system32\vp7vfw.dll
2011-01-14 02:59 . 2004-05-04 17:53 1645320 —-a-w- c:\windows\gdiplus.dll
2011-01-14 02:59 . 2011-01-14 02:59 ——– d—–w- c:\program files\VSO
2011-01-14 02:55 . 2011-01-14 02:56 ——– d—–w- C:\Convert x to DVD 3.0
2011-01-13 17:21 . 2011-01-16 02:03 ——– d—–w- c:\documents and settings\HP_Administrator\.dvdcss
2011-01-13 04:46 . 2011-01-20 17:32 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\dvdcss
2011-01-13 01:47 . 2011-01-13 01:47 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AnvSoft
2011-01-13 01:47 . 2011-01-13 01:47 ——– d—–w- c:\program files\AnvSoft
2011-01-12 15:23 . 2011-01-12 20:36 ——– d—–w- C:\Adobe Lightroom 3 book

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2004-08-09 21:00 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-13 00:53 . 2010-09-22 15:32 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-11-12 22:34 . 2007-05-02 02:44 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-11-09 14:52 . 2004-08-09 21:00 249856 —-a-w- c:\windows\system32\odbc32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Online Files]
@="{B82655E9-B81D-4A97-8154-0D84A4C048E4}"
[HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}]
2011-01-27 21:01 197632 —-a-w- c:\program files\Common Files\OnlineFilesManager.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-04 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"P17Helper"="P17.dll" [2005-05-03 64512]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-19 68592]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-02-22 180269]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-8-9 113664]
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-8-9 113664]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-2-22 27136]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NaturalColorLoad.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NaturalColorLoad.lnk
backup=c:\windows\pss\NaturalColorLoad.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=c:\windows\pss\SBC Self Support Tool.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^Nikon Monitor.lnk]
path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\Nikon Monitor.lnk
backup=c:\windows\pss\Nikon Monitor.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^SpywareGuard.lnk]
path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\SpywareGuard.lnk
backup=c:\windows\pss\SpywareGuard.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
1 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
2005-08-03 00:19 77312 —-a-w- c:\windows\arpwrmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2002-09-11 02:26 368706 —-a-w- c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
2004-12-02 23:23 102400 ——w- c:\program files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
2005-02-15 21:10 57344 ——w- c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
2005-11-11 21:11 1064960 —-a-w- c:\program files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
2005-11-11 21:10 61440 —-a-w- c:\program files\DISC\DISCUpdateMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
2005-11-01 10:01 90112 —-a-w- c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 21:56 64512 —-a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer4_in_1]
2004-01-22 15:59 151552 —-a-w- c:\program files\Lexmark 4200 Series\Fax\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 07:12 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
2005-11-09 17:29 249856 —-a-w- c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 23:35 49152 —-a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-28 00:50 221184 —-a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 4200 Series]
2004-01-16 10:04 57344 —-a-w- c:\program files\Lexmark 4200 Series\lxbmbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxMenuMgr]
2008-10-28 22:42 181544 —-a-w- c:\program files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
2003-12-10 09:52 380928 —-a-w- c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 15:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 09:25 144784 —-a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-02-18 22:40 2012912 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-12-04 02:10 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 06:00 90112 ——w- c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
2003-12-09 19:02 57344 —-a-w- c:\progra~1\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Ati HotKey Poller"=2 (0x2)
"LightScribeService"=2 (0x2)
"FreeAgentGoNext Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 10:15 AM 66632]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [5/18/2009 9:47 PM 93320]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 10:42 AM 135664]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 10:15 AM 12872]
S4 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [10/28/2008 4:42 PM 156968]
.
Contents of the 'Scheduled Tasks' folder

2011-02-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:42]

2011-02-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 16:42]

2011-01-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-19 17:22]

2009-05-19 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-19 17:22]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.tvguide.com/listings/
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-05 10:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(696)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3360)
c:\windows\system32\WININET.dll
c:\program files\Common Files\OnlineFilesManager.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\arservice.exe
c:\windows\system32\CTsvcCDA.EXE
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MPFSrv.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Rundll32.exe
.
**************************************************************************
.
Completion time: 2011-02-05 10:32:40 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-05 16:32
ComboFix2.txt 2011-02-03 17:28
ComboFix3.txt 2011-02-02 18:31
ComboFix4.txt 2007-11-17 03:28

Pre-Run: 164,987,334,656 bytes free
Post-Run: 165,030,088,704 bytes free

- - End Of File - - 6246B03EDD1A9833C5D7F9BAAB312E43




________

Could not flush DNS Resolver cache: Fuction failed during execution


Some web pages are still poping up at ramdom.


When I signed in to my internet account it told me to download and install New Google toolbar with better security. I thought this a little strange - since I already did this process the day before. I can't acess my E-mail or bookmarks if I don't do this - other wise I would not do it.



Boffo
Post #17
Hello boffo123

Lets remove your outdated Java and then run a check on your Master Boot Record:

  • Please un-install your old Java


    • Click on "Start" then on "Control Panel" and then on "Add or remove programs".
    • Click on "remove a program". A list of currently installed programs will be displayed.
    • Find the following Java installations, click on them once and then click on the "uninstall" button:


    J2SE Runtime Environment 5.0 Update 5
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    Java™ SE Runtime Environment 6 Update 1
    Java™ 6 Update 2
    Java™ 6 Update 3
    Java™ 6 Update 5


    • If you are prompted to re-boot your computer to complete the uninstall please do so.

  • Please Clear Your Sun Java Cache


    • Click on "Start", then on "Control Panel" and then on the Java icon (looks like a coffee cup). If you do not see the icon, look to your left and click "Switch to Classic View".
    • On the "General" tab, under "Temporary Internet Files", click the "Settings" button.
    • Next, click on the "Delete Files" button.
    • There are two options in the window to clear the cache - ("Applications and Applets" and "Trace and Log Files").
    • Leave BOTH Checked
    • Click "OK" on Delete Temporary Files Window.
    • Note: This deletes all of the Downloaded Applications and Applets from the Cache.
    • Click "OK" to leave the Temporary Files Window.
    • Click "OK" to leave the Java Control Panel.

  • MBRCheck


    • Please download MBRCheck by clicking here and save it to your desktop.
    • Be sure to disable your security programs.
    • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt).
    • A window will open on your desktop.
    • If an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
    • If nothing unusual is found just press Enter.
    • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
    • Please post the contents of that file in your next reply.

    Please post the MBRCheck log in your next reply.
Post #18 last edited
Hello JonTom Here is the log. MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x00000fbc Kernel Drivers (total 150): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806E4000 \WINDOWS\system32\hal.dll 0xBA5A8000 \WINDOWS\system32\KDCOM.DLL 0xBA4B8000 \WINDOWS\system32\BOOTVID.dll 0xB9F79000 ACPI.sys 0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xB9F68000 pci.sys 0xBA0A8000 isapnp.sys 0xBA0B8000 ohci1394.sys 0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xBA670000 pciide.sys 0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xBA5AC000 viaide.sys 0xBA5AE000 intelide.sys 0xBA0D8000 MountMgr.sys 0xB9F49000 ftdisk.sys 0xBA5B0000 dmload.sys 0xB9F23000 dmio.sys 0xBA330000 PartMgr.sys 0xBA0E8000 VolSnap.sys 0xB9E4E000 iaStor.sys 0xB9E36000 atapi.sys 0xB9DF3000 ftsata2.sys 0xB9DDB000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS 0xBA0F8000 disk.sys 0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xB9DBB000 fltmgr.sys 0xB9DA9000 sr.sys 0xBA118000 bb-run.sys 0xBA128000 PxHelp20.sys 0xB9D92000 KSecDD.sys 0xB9D05000 Ntfs.sys 0xB9CD8000 NDIS.sys 0xBA138000 sbp2port.sys 0xB9CBE000 Mup.sys 0xBA1C8000 \SystemRoot\system32\DRIVERS\AmdK8.sys 0xBA488000 \SystemRoot\system32\DRIVERS\aracpi.sys 0xB9172000 \SystemRoot\system32\DRIVERS\ati2mtag.sys 0xB915E000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xBA490000 \SystemRoot\system32\DRIVERS\usbohci.sys 0xB913A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xBA498000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xBA218000 \SystemRoot\system32\DRIVERS\imapi.sys 0xBA5EE000 \SystemRoot\System32\Drivers\ElbyDelay.sys 0xB9C8E000 \SystemRoot\system32\drivers\pfc.sys 0xB9C8A000 \SystemRoot\System32\Drivers\cdrbsdrv.SYS 0xBA228000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xBA238000 \SystemRoot\system32\DRIVERS\redbook.sys 0xB9117000 \SystemRoot\system32\DRIVERS\ks.sys 0xB900B000 \SystemRoot\system32\DRIVERS\AGRSM.sys 0xBA4A0000 \SystemRoot\System32\Drivers\Modem.SYS 0xB8FE4000 \SystemRoot\system32\DRIVERS\hcwPP2.sys 0xB8E90000 \SystemRoot\system32\drivers\P17.sys 0xB8E6C000 \SystemRoot\system32\drivers\portcls.sys 0xBA248000 \SystemRoot\system32\drivers\drmk.sys 0xB8E3C000 \SystemRoot\system32\DRIVERS\ctoss2k.sys 0xB8E16000 \SystemRoot\system32\DRIVERS\ctsfm2k.sys 0xB8E02000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys 0xB8DEE000 \SystemRoot\system32\DRIVERS\parport.sys 0xBA258000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xBA4B0000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xBA5FA000 \SystemRoot\system32\DRIVERS\armoucfltr.sys 0xBA340000 \SystemRoot\system32\DRIVERS\PS2.sys 0xBA368000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xBA5FC000 \SystemRoot\system32\DRIVERS\arkbcfltr.sys 0xB96B4000 \SystemRoot\system32\DRIVERS\arpolicy.sys 0xBA765000 \SystemRoot\system32\DRIVERS\audstub.sys 0xBA268000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xB96B0000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xB8DD7000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xBA278000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xBA288000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xBA370000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xB8DC6000 \SystemRoot\system32\DRIVERS\psched.sys 0xBA298000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xBA378000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xBA380000 \SystemRoot\system32\DRIVERS\raspti.sys 0xBA2A8000 \SystemRoot\System32\Drivers\pcouffin.sys 0xB8D96000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xBA2B8000 \SystemRoot\system32\DRIVERS\termdd.sys 0xBA5FE000 \SystemRoot\system32\DRIVERS\swenum.sys 0xB8D38000 \SystemRoot\system32\DRIVERS\update.sys 0xB9694000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xBA2C8000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xBA2F8000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xBA602000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xBA604000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xBA6E5000 \SystemRoot\System32\Drivers\Null.SYS 0xBA606000 \SystemRoot\System32\Drivers\Beep.SYS 0xBA3A0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xBA3A8000 \SystemRoot\System32\drivers\vga.sys 0xBA608000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xBA60A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xBA3B0000 \SystemRoot\System32\Drivers\Msfs.SYS 0xBA3B8000 \SystemRoot\System32\Drivers\Npfs.SYS 0xBA588000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xB4475000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xB441C000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xB43F5000 \SystemRoot\System32\Drivers\Mpfp.sys 0xB43CF000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xBA318000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys 0xB43A7000 \SystemRoot\system32\DRIVERS\netbt.sys 0xB4385000 \SystemRoot\System32\drivers\afd.sys 0xBA168000 \SystemRoot\system32\DRIVERS\netbios.sys 0xB42C4000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 0xB9340000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xBA3C0000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 0xB4299000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xB4229000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xB41F6000 \SystemRoot\system32\drivers\mfehidk.sys 0xB9330000 \SystemRoot\System32\Drivers\Fips.SYS 0xBA3C8000 \SystemRoot\System32\Drivers\ElbyCDIO.sys 0xB416D000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 0xB9310000 \SystemRoot\system32\DRIVERS\IrBus.sys 0xBA3D0000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0xBA3E0000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xBA3E8000 \SystemRoot\system32\DRIVERS\hidir.sys 0xB92D0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xBA3F0000 \SystemRoot\system32\DRIVERS\arhidfltr.sys 0xB4149000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xB8D24000 \SystemRoot\system32\DRIVERS\usbscan.sys 0xBA408000 \SystemRoot\system32\DRIVERS\usbprint.sys 0xB8D1C000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xB8D14000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xB8D10000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xBA178000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xB4131000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xBA634000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xBA584000 \SystemRoot\System32\drivers\Dxapi.sys 0xBA430000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xBA75D000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\ati2dvag.dll 0xBF051000 \SystemRoot\System32\ati2cqag.dll 0xBF08A000 \SystemRoot\System32\atikvmag.dll 0xBF0BF000 \SystemRoot\System32\ati3duag.dll 0xBF30C000 \SystemRoot\System32\ativvaxx.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xB1F11000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xB1BCC000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xB1B8F000 \SystemRoot\system32\drivers\wdmaud.sys 0xB1D59000 \SystemRoot\system32\drivers\sysaudio.sys 0xB1920000 \SystemRoot\System32\Drivers\HTTP.sys 0xB17D9000 \SystemRoot\system32\DRIVERS\srv.sys 0xBA5EC000 \SystemRoot\system32\drivers\MSPQM.sys 0xBA410000 \SystemRoot\system32\drivers\mfebopk.sys 0xB0E17000 \SystemRoot\system32\drivers\mfeavfk.sys 0xB08E9000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 46): 0 System Idle Process 4 System 592 C:\WINDOWS\system32\smss.exe 664 csrss.exe 692 C:\WINDOWS\system32\winlogon.exe 736 C:\WINDOWS\system32\services.exe 748 C:\WINDOWS\system32\lsass.exe 896 C:\WINDOWS\system32\svchost.exe 980 svchost.exe 1020 C:\WINDOWS\system32\svchost.exe 1112 svchost.exe 1328 C:\WINDOWS\system32\LEXBCES.EXE 1360 C:\WINDOWS\system32\spoolsv.exe 1396 C:\WINDOWS\system32\LEXPPS.EXE 1508 svchost.exe 1540 C:\WINDOWS\arservice.exe 1776 C:\WINDOWS\explorer.exe 1792 C:\WINDOWS\system32\CTSVCCDA.EXE 1832 C:\WINDOWS\ehome\ehrecvr.exe 1876 C:\WINDOWS\ehome\ehSched.exe 140 C:\Program Files\Java\jre6\bin\jqs.exe 264 C:\Program Files\McAfee\SiteAdvisor\McSACore.exe 388 C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe 468 C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe 512 C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe 648 C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe 940 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 1096 C:\Program Files\McAfee\MPF\MpfSrv.exe 1604 svchost.exe 2068 C:\WINDOWS\system32\svchost.exe 2140 C:\WINDOWS\system32\svchost.exe 2176 mcrdsvc.exe 2472 C:\WINDOWS\system32\rundll32.exe 2544 C:\Program Files\McAfee.com\Agent\mcagent.exe 2748 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 2776 C:\WINDOWS\system32\ctfmon.exe 3000 C:\WINDOWS\system32\dllhost.exe 3176 alg.exe 3260 C:\WINDOWS\system32\wscntfy.exe 4004 C:\Program Files\Microsoft Works\WksWP.exe 4036 C:\Program Files\Microsoft Works\WkDStore.exe 4068 C:\Program Files\Microsoft Works\wkgdcach.exe 276 C:\Program Files\Microsoft Works\WksWP.exe 3676 C:\PROGRA~1\McAfee\MSC\mcshell.exe 976 C:\gkp\gpik.exe 2968 C:\Documents and Settings\HP_Administrator\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000043`bf9c6000 (FAT32) \\.\K: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD3000JS-60PDB0, Rev: 21.00M21 PhysicalDrive1 Model Number: SAMSUNGHD103SI, Rev: 1AG01118 Size Device Name MBR Status ——————————————– 279 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: 4A3BF69CA3259413E25A52D6E01242850E3B0E3A 931 GB \\.\PhysicalDrive1 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done! I did not remove anything. I just hit "N" to exit. Boffo
Post #19
Hello boffo123

Thank you for the MBR log.

I would like to take a closer look at that MBR if I may. Please do the following:


Re-run MBRCheck again.
When prompted, enter Y
Then enter 1 to dump the MBR to physical disk.

The Physical disk number we want is 0

Name the dumped file as Dump.dat

Enter -1 to exit

A log file named "dump.dat" will be located in the same folder as MBRCheck was saved, please zip it up and attach in your next reply :)
Post #20
Hello JonTom I do not know how to zip any files. Could not add Dump.data as an attachment. This is what was in the file opened with notepad. Hope it helps. 3ÿ¾ Ž×¼ z» ‹ÎŽÛŽÃó¤ê\    z f‹U´BÆ |2Àf‰" ¾ ²€Í‚µ >þUªÃ¬ Àtú´» Íëò‹é‹Ù¿î¹ 8mt4è¼ÿuf>RECOuf>VERYu‹ßÆEŠE<t < t$õ<u‹ïˆ-ƒïâÀ Ût= ít9‹ûöRuföRuc´ÍuLŠQ ÒtUþÊxQ6Šl€Á´Íu26:luóëåf3ÒèAÿ±¿¾€=€tLƒÇâö‹6UèKÿ‹6WèDÿ´ ÍÍ´ Í 3348 C:\Documents and Settings\HP_Administrator\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000043`bf9c6000 (FAT32) \\.\K: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD3000JS-60PDB0, Rev: 21.00M21 PhysicalDrive1 Model Number: SAMSUNGHD103SI, Rev: 1AG01118 Size Device Name MBR Status ——————————————– 279 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: 4A3BF69CA3259413E25A52D6E01242850E3B0E3A 931 GB \\.\PhysicalDrive1 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Options: [1] Dump the MBR of a physical disk to file. [2] Restore the MBR of a physical disk with a standard boot code. [3] Exit. Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit): 0Dumping \\.\PhysicalDisk0… Enter filename to dump to: Dump.datDumped successfully! Enter the physical disk number to dump (0-99, -1 to exit): -1 Done! Boffo
Post #22
Hello boffo123

We may be looking at one of the newer variants of malware infection on the loose right now. The infection has the ability to alter the appearance of your MBR when windows is running. In order to check the intergrity of your MBR we are going to have to take a copy of it from outside of Windows.

Please read through all of the instructions carefully before doing anything.

Once you have read them, take your time with each step. If you have any questions just come back and ask. There is no rush.

  • xPUD

    We will need a USB stick and access to an uninfected machine.

    We need to prepare the USB stick. It is not absolutely essential that it is formatted, but it may help if it is:

  • Insert your USB drive ino the uninfected machine.
  • Click on Start > My Computer > right click your USB drive > choose Format > Quick format.

Next

  • Download both http://sourceforge.net/projects/unetbootin…87.exe/download and http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of the uninfected machine.
  • Make sure you have the formatted USB stick in the uninfected system.
  • Double click on the unetbootin-xpud-windows-387.exe that you just downloaded.
  • Press Run and then OK.
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded.
  • Verify the correct drive letter is selected for your USB device then click OK.
  • It will install a little bootable OS on your USB device
  • After it has completed do not choose to reboot the clean computer, simply close the installer.

Next


Next

  • Take the USB to the infected computer and boot with it.
  • The computer must be set to boot from the USB (as soon as BIOS is loaded tap F12 and choose to boot from the USB drive).
  • A Welcome to xPUD screen will appear.
  • Press File.
  • Expand mnt.
  • sda1,2…usually corresponds to your HDD.
  • sdb1 is likely your USB drive.
  • Click on the folder that represents your USB drive (sdb1 ?).
  • Confirm that you see dumpit that you downloaded there.
  • Double click on dumpit.
  • Once completed, a file called mbr.zip will be saved to the USB drive.
  • Take the USB drive back to the uninfected system and attach the mbr.zip in your next reply.
Post #23 last edited
Hello JonTom

Next


◦Use the clean computer to download dumpit from the following link: http://noahdfear.net/downloads/dumpit
◦Once dumpit is downloaded save it to the USB stick.


The above link is not for a file but for some kind of script. Is that the way it is supposed to be, if so how do I save it as a file. I was able to save it to the USB stick as dumpit.txt.



boffo
Post #24
Hello boffo123

The above link is not for a file but for some kind of script

That is correct. xPUD is Linux-based and so runs on custom designed scripts.

if so how do I save it as a file

Just save it exactly "as is" to the desktop of the uninfected machine. Once there you should be able to drag it onto the USB stick.

Let me know how you get on.
Post #25
Hello JonTom My uninfected computer is running windows 7. I don't know version of internet explorer. Once I download the dumpit script ,Tthere is no option open to save it that I can see or drag it anywhere. It only seems that copy and paste works That is why I copied it t and pasted it to notepad. But, the script looks diffrent from the original. The part at the end of the dumpit script with the lines drawn throughmuch of it is not in the notepad version fo ther file. What do I do now? Boffo
Post #26
Hello boffo123

I run Vista and the script saves just fine on my machine.

Am I correct in assuming that when you click on the dumpit link the file is not automatically saved to the Win7 desktop?

Could you please check to see if the file is located in your "downloads" folder? (A likely path for the folder would be C:\users\your name\downloads).
Post #27 last edited
Hello JonTom



The link opens as a web page with all the script showing not as a file to be saved. Tthe Protocol is in HyperText Transfer Protocol.

I see no option to save it. What option do I use to save it.

Not like other files or programs that you have asked me to download. They usually ask where they should be save to.

When I first when to the site http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso - my anti virus McAffe, gave me warning about the site. I had to tell it to trust the site

to get any kind of download.

There is nothing in C:\users\your name\downloads by the name of dumpit, or any thing else from thie site..


Could my anti virus McAfee be interfering with this operation.


This is some of what I see after clicking on the link - http://noahdfear.net/downloads/dumpit

!/bin/sh -e sed -e '1,/^exit$/d' "$0" | tar xzf - && `xterm -e bash mbrdump.sh` exit ‹“}GMìZ pTU–~:I'›Ø“]Ð Ïló§’tBB@ˆF „ C€¦Ó?¼’îžî×ü(Œq’ìÐÓÄM9ê°%nkÝÕZ©vÀZ,{VdÊÙ¥k†X‹©‰;Ýj@À,"Ùó÷^÷ë;q§j¬Úªi¼œ÷Ýsî¹çÜsî}÷<ìêˆxc]áê¨"ýÉ~Nú5662¥ŸHëêê¥ÚÚ†ºÚY³fR?ÆY’씾‚_,ªº#²,EB!õzrˆÿÿô÷×·×t‚5î¨Rìéô¹#Å¿Ü.ÏðÉOÂòšbUñ‹=aF5±h„¥å)÷Ôx}k‚±ÎÎŒ|†khðº:"Õ¦nŸG ÉU÷Ñ/#ýdwgÄçön‘}›Q5ZeHt„"j ¸^GBŸ7ñ§3ê+ö{Ñ òŒN™Íˆzïë²m]ñ…åŸLŒ,À­QŸöLÖ´@CMÍú¹Ñš»«ïЪïh¯1g ©Ùqú<”Æ­®©i&¾|7Øè‹V«›Õâ….kªj&Û6û<ò¬y&Î&%Ðé“á›ì«•}u²o¦ì«/ö†Š½^9àoª©røêªð÷Ì*9äoâ‡jZE¹#ÚÔP['{B± ÚT›³â!òÁ#gD Ëä\»Ûêêä{X*ìŽD}°Ç¼LÅÉ*ˆVÉ‚èïÅØq¯ÜÔ$;sƒˆzB^Ÿì'C½r(¨©1"ˆà"€SCÏ £«®·Î?´F^™¤s¬¢\ãi1}U12oFWì™4ÌÓÒ)k«ìwSÀ¼UÅþþË™ÇyÞ”Yű`ԧʔC-Ù2i0e•fœÉt8å uu¹)Á*»7’îJ½júÉî1öQ®‚®@4 (Š©Î€ºåºCÇ8$ÈDB¬—Uf6qg§ÜB¾Þnt´F|ѨšBJšM†¼‰×ú¡ê­9Oª¯*´¡•ÓÄh)ñÇZ+CÿcÄ7Ûwú.˜ü«é tÔtzgt‚±ÍÕÑPuÆ+Óù=Ò¦¯µ¦“Ü“ÜÔ<:N­‘ÚJ}Þy:½—Ú2j6—Sk§öµ[õ¾¥:]Kí/ôç ñÎGmµuÔîx_£v·¤ÅÒøM ¶D~P§+¨µèÏäžÔLm*µÉÔÕû×P[$è_@íq¬©ï/©­¦æ0õÕèôj÷Që öµÙÔVé¼Ô ú¦¶X÷íÈC½ÿ“Lò y ã"jÕÔfé1㮳 ¯ÑµÒ?rOÚœgzž"ðn0òËu ½E­Ö|. ü*boϤv'µj÷èýsu:Þ4f¢°?Œ7÷$Î§vöŒŽo¤Ö¦?O3½I§7S«ÔŸËôµ_«û…œì~-¯j­î#rbú¤•¯/úMröùDåú6wÙ'·{Ä哪M Û¿gÉÅóü )¯ð)ËÅÏ ó}(àaaüaþï |›óúmŸðIAŸ_˜¿Q‹ö ãmÿo…ñ?äoðBa|µÀøã…õ<+ð¿.Ìÿ¢ÀFÐÿA¾Eü§|QŸ*è/p¯ ÿŠ€ëÿÞÆß)ð§ öü\?+à¼GÀo øïýÛ{~I¿IàËÿ€ ÿ1ûù ;ù7…ùZü7‚ü+â~äþ:¿#ÈOðk‚ü?ó¯ä—òvJÀ?ä×x§€ƒ^&Žì»,ðÿ]˜¿C_(ày‡¿y>"îG7ú&øÛdoóÚB›•ß'ùÑòdŽí’…äewC‡ O&{ÂoXm·°>zK»\ë»BA*Õå’èúæÁµm–äZø(õzAW,êóJ~g,ªHQ5â o¡QáH ¨ú]eƒ„*–ÅÃ1Õ#QAßò¸;}R4B59F=]aЈG‰ÐÐM5ÔÕÁCþH$‘<!š#Ñ„I4°>è:¢jh“'JƒÈ@ÏŒqá3… Ò sƒD•s'Í&‘T,LÊ$¶X ‡Â¾ ´Þ§†^É£t…¼$¹)@Ö¸\uKØç"ž 6Ä"®.÷fÌ«†:¥@Ô­ª[$¿/ä—ü$£“TÅ‚„J…ÖNP*jwR±²”.c{@©0}”Š¤×A©ÈÙ JEé>P*(€R!{”ò< JØaP*šß¥Bë=P*ºŽRÁõ>(£'@é²~ ” ßÓ T¸R‘ž¥¢ì,è<Š?(·@©h½W’®€¢@_J”Ši+(þ6P*ªK@é%\J[9(ú@©P¯¥Â]¥—¿” íi TàßJE·t ÅôŠ?è£P*¶›A—RüAé¸tÅ” õVP*—ƒ® øƒ>Nñ]IñýÅtÅ´âJEZ”.7mñ—õœµ¦°'ÚŸ>TþVž”øî•ÑÑѾãj~êêMõQz§†k‘V¶=4Ú0B;gtò|k¢ßèdìþÑôi6:;F/}Œ1vŽ‚-˜N2ÆRð™$½—1v’‚R-½›1v”‚r7=À;KÁÉ—îfŒ¦àÓF:Ì;MAÄÒëcÇ)øt’neŒ§àóEº™1v ‚ÏEi'cìDŸwÒ2cìH¥Ëcg*a.c‡*›‡¯c§*Ýì?cìXe;ûÏ;W`ÿc+;ÙÆØÉÊnöŸ1v´ò*ûÏ;[ÙËþ3ÆW°ÿŒ±Ó•$ûÏ;^y—ýgŒ¯cÿãPN°ÿŒq(§ÙÆ8”ûÏ'ƒ2Ìþ3Æ ¡Œ°ÿ_wsü-ðŸq/Çøãíà$ãཌ8þÀ»?Çñ`¼“ãÜÍxÇ8Ìx7Çxã=àVƯrü›¿Îñv2ÞËñ–ïãø—1>Àñ–äøcŸLNrüÙƇ9þì?ãw9þì?ã÷8þì?ãcöŸñûöŸñ Ž?ûÏøÇŸýg|šãÏþ3âø³ÿŒSöŸñYŽ?ûÏx˜ãÏþ3¾ÀñgÿpüÙÆW8þìÿçÀ8)Ü?Ò§ãÄTð$}Œ1NN¥ 8É'¨‚2%½—1NREÞÍ'ª2 x€1NVÅ ÜÍ'¬28Ì'­Ò ¼Ž1N\ep+cœ¼ ÊÞt3cœÀÊJ`'cœÄÊ:`™1NdE.cŒ“YÁgŸ´Ä'´²xø2ïànöŸ1Nle;ûÏ'·2Àþ3Æ ®ìdÿã$Wv³ÿŒq¢+¯²ÿŒq²+{ÙÆ8á•ì?cœôJ’ýgŒ_y—ýgŒ“_9Æþ3Æ@9Áþ3Æ›@9Íþ6 ¬ýhmü×=CíËSºŸ( /该+”²ýV[ꇴr~ú»¤»©….QRì¾DÅz80^3Ê鯏äõ¯ó«¨Üÿ#èïù‰%Î"£åσ¯ÉÏùUä¿ßɇ KÏakûšCñKýñ¹爵³+I´/©ŽçO%ôPtÄê@ßè±£‡rí©MÆ?ÌOö•^ØÆ JâVGj;$}ÉØ…ÁwÆJû7JéÊn¢ñ‰ÖÖÄJ•^…¥s[究x¹#õ"ù͉Öy` ïÛÙ¾ÅF_Ôèó÷lvÐõ4ÑÚB¬ñs[›5þ2¿JRË­ÍÆÐÙ&Öf-0X“²3-7úŠ²}+¾‹—3}«¾_gûÖ}?3ú°ÈÏž‡(²YúNÆ'¡ÛÞ÷ú‰I#X“êÒÁ+ôпüÐH¿:EêIYzFFU9QÜó;[ßQõ“ïƒ/q¤6^6ù™àH>úñòŒW:R«ˆw$<ÄdððVð 8\N1€~Ä«ö$"¶›rôH‹ÃöÚ· lmñ‡5õÌ™+;uoÒ1ÅãÖ—š/ØzYhlÉ‚' XÇŠ'su<<–Žéèù¼"vP3GËWÃÇ5í¹úÙº¦›ìÙC5{Êt{JVèv]NØ ¯ëKý`,]ÿõ9ì*ŒíKýÇ?Z$çIâíz¦À–j£þÒŸ¼løk]•ã§-Õñ†Åþ“˜å.bÒh2ã¾Ø•üãÌÈÓ¨5ùLfxj* ¥ýýºý&Ÿ‹Ç²³A·ó=êÜ@s¥ö!êVÇžG.Ñõ2©*ݳ©f'ñÌ; -ƒµ/kvêK<èE :¤ ºƒ¦ƒ^cЗDŠÚç¨ûÌÏ4úΧÇW,{úì.|§m:EèÄ¿ ÆçÕ&ûFí}'Áh8\¿dï{ hÒŽ­œù•‰Rçjz:jï+¥%JT$ÑÜÞ·˜Ð`·–Ä•‰&"U8€ ,Dª"@“zY•½ï W°$)x» ©)(å퀭à¥U­M&Ú†|3+`£½O¥êóéð½}­‹Rr£¶w° _<¥-Ç„^Ä;­o±t#í<äßàžš¢1åyò§ ùÿ¹j’g>-iz%´ð>ÜMóö¯éNT쁵«Š/G.|×"eª%g¡ $”h¸Áxl€®9—£íÓß™øËx½ƒµm%Uo?KªX-àR .eUGí½o“ÚJ­ÖòàГ¹Cé¿»ªï»M¶9à ‘§O¼l¶wM2Ès$í}ÿfAZð£öÞvqŽƒÂ/Js4`ŽAe›‡—M"=I eiÙ`+ñ´ç’Ìz®§¡ÚÂh«yZ¢Þ}tÁüÒÊŒL¹ùS#ØI¿÷ïãúLT<‡uÞ¥gÉëf–;J¦c†žãçsô,ù¿ê1œûéÑ2ßäÜ%{ï:ӁQ¬—yY÷ ˺(׌ŸbIXõ5äo9oä.ËïåÅ°9GfTPØü9rb ‚\œ´¥âõ<¢óc] dΘÄ["VB{öáD)fGÂÿ›ƒ•ªŽ2CñOÅ_?§[˜ÝqèŽ~ªç¥bï³¼ê|5_O[å9}Xv¿ÇçÛzËíkפoû”Ïí±¶üа>îÌàÀ5Ï…·I(}gfßkZsîSÄzœÎyC¬…~#+Ê s„·œÞ—‹F…})ZFƒú.eÂÞ{’6)ÓË ÇÇcÇ™}›:ÌqÖPN|G€Vn]k¨¿ÕÒ—ŒW ã›vºBàÿ›HÑò$›ÈÿdÉÞToÈ.úçíhÃל~kû%kß´öB[™.oûçµÃÚ(qÖ·ÄEò¡asâš_” ¼zÿ%ë[ºÊý¨IÊÛåÏ_S ÅPPô‘ùí?èÔªåsó“t³·÷þ3lÛEµÇá F4¼ ô ÖÓ_sŽ©%Æ•¼û©íM)žE$Mùxt<Í9"óZM,?³¬ †¬EÌB³ZL£œÌj1F ›XÌÖY©ªóZmqù̹>VÒ|r&'‹ïÐï9©Ç©?Áýg´tûàZÑyÒ·_½æ9²ãLÎÕëz ¤>û¡†®?« ßx />£G?m¿jœ3‰Š½4{¢tl0Œ–+tG·ˆ/9e6¡èL6ªèšñ@VØ$†lI}@† ²òŠ}šÎI¿Âs&[UpïtÖO4A´öh/â¿X?Ôsv^ÏÈfõÖž‘ÇÔ‰=#µ+9a+W|dàÛŽÔOÝ÷4Û{ñ?&ë™jüµË€½w®±M‹×jWÌçpá¬h%¿ßö}¦õ„JÒk0Îí½Œ/ñwì½*_PYŽŒ¾u—EŠ?dÅ""YÑö›¹B?rÿÿröýñ5–ýãçlç°±¹‡•­-ýjØjÚ,=bá‰ä©¡*éT£qÎÁéÞ<‹‰DY«'¥ú<Â1aCB¢V”õ4¹ï¦Z òïûÇuÝ÷}¶ÑóúúÃîûº¯Ÿï÷ûzÿ¾®C}€ªH&¹wG Û Ìïófہ½ÞŽ %“LÅÝí¹Ëý:ÎÌ!O}~ò¡/™âÒÞ}ÆÌtàãb$2ÖKö½½<UUa_ái»Ÿ•PH:‰½+¾YDÒ„ƒî!Áh¼z\ÝÇÅvü(×`L4®oc—§Q-}&É£쓺©Þ@ö6Ïäï8S+°s7ãÎAr£Rûñ<@pP¥žƒú©Ùþ8ê÷<Åò;y¬WŒ}‰ýüûÁø†¶:Ñß¹dÈUüÞÓB#¹øýØŸÄO`‚˜2 Òh“Èà#dFöG{îÏÎdU t®­efâÀ(Ãt-Çx–ùùË®‡/ÒÀµYõò€§N{ûÂóv·1ù` ÕBþPæÎE >ª‘cpýéŒ‘Þ (Ü\<‘6ƈLJâl’§µª§NUT‡“ˆÇö\µú«I…8ç¹æòµœ:˜ó´† ¸Y¿gàwÄyudc#ë[õì»ëhº•„èg<8v† Þø>Qx VsOíÜ jÜ•t¤zhaRiÞùG•¢R»Ó6 ]Ç÷”hºe·:-,”Fðn·;Ô¿9ä\pBX /öÓ¯bz²$ÊÀ)e}«¼ó#y¨UŠüdÕjî?~Y­æŽãV­Fw‘ÃÈ£hwâÝÑ=PGüKûÊOŽo Ú ÷ε°Rµ«ƒê©äÂM: ]tÇzäês¸†cõ^hÞÖ1ŸPÓÃúÕL ”©cÝ`3$+ÒÕ‘Yy¹! =ÝÕƒŽJlWûl¶Õv÷þÓ¨òÕÛxŸQBÝ‚HXm' ½àó*1‡8‡÷мt›ü’ñ­Å,¶ W•Å¡Xõ3·ÿƒéÓеîµH °©ßol= "ìÄ;+Ìîvn¼µÕû¢PQ^Ÿ¢ÅHÍî°¤RsßÄÏ2÷Í¡Óè{Û½øËœ“¥Àz VNé%Ý…µI¥Žrÿ„“0)óãWì'âM…ݨ«ø¯# úÕ–þLê)–‹ïŽ)XÞð_YN"X;VÉ|Yñá)“‚[×Ãwh„´P–†d)zÍ@ÖŒ‹‡ãTcá¨Áûq\p© †(= •¿¥n¾ujZ„}¯«|mÆußWT‡~_aF›z_­pBzZÍفÐ@ÖªM«B®Çjæá‚•8×ï…К:‹…–j -¬¡Ê$|_ó[Q$"¬~CàW¿ˆúµÃu‚iÌW,D“:¤£h¢÷löûlŸß•fåÇhæñnPƒªüG_™&‹¼ˆ­ûÿDH ”iyˆ®íB«x^ 2BCñyôOŒ·@¹â›Â6aKrwR¿qDvû*µ…ÐÛ@·,ä†eŽPšk-0%ÇÔŸ ³ù}ÂOÈ*«°=bïÞFŸŠwÙ<é'Rh§v…çb·ÐµJd+øF|Dþ¼cP5ÅØ®íE’;âÉ6ýÑ -Q™ž¦ùðɬ¦æÃë?H)Œò•Ä{XÑ\oðQl[0ë2ÖÔøx «x÷áü´Q5$.x6>T Š›ƒµŸ?Hï¼ÜÑû70ìà}7N¬4?øÑDÔ5ÐKy¨çÉçÍfjâÍîIåéa‰`ôw^æOq6uy»t%¿ãÇ Ü|üc0nÞB’]$ýè’ °¦Zɦjoø;©ÜšÔíÁÝŽoÔíPìÖ%ýÚø%»Ð”ëh«S’„ØØb/`ºÀ ‚þé§Ë@]Öo0ýøW¡âpGp£th°ê·Öþ7ãçÝÁüºª†B*dš Š(÷1r°±Ïe3ëEH9às­à’:Q"xªÏ5j'•Â—Z›Ñ¬Æ|jòù&SYJ¶c"jUîÌÊÞ4ŒK¬ 1ÕÌñÉ+¾‘Šd $º€§V{|D’‚8VÁf"%hœH3犖‹&=ŠAâ³€½i9(áß‹aˆ¹™Šï<öBeþr4 êô«ø®nk³M‚òv,ÿ›Q~*ŠËo Áò4£ü<—Ï{ΉåFù‹í¸üº,Ï4Êßé€ïƒå»ÿ!'ÖÓºüˆ2NK9ÃüA(‡Ô®œw øÞm)Ƈ‚Ôöv!Ça¾b^§`^©-Íòå &jj”Y>OÌw?ì±Ô¶fù—ὝñîßíTÞ“¶"è./Ê÷Ý„ô:5éu<¹sM]}Ñw(Ufærd¿Ü™+žô›%òÖ=¡øNÉ*ó_!@>Â|Eñ] ø‹2o¹‹3àõ;¯Ã{­]§&vêÆGqûÑô´É¿×I?ÌBßô'鱩x8Eñíl+×5ÿ ž`ìe®{%ã{Þc§[Ìòª6T>w à'µ·Y> ð—ÚÇ„Ó¨Ð8+żʝë`'ãÖÕû¡ŸÏ[—­ø°eÞ½´°1r½_sÿó&·ÇâûõÖ½óÖMT|xæIâcn=•N2è ”è`²x÷ÌC¡†£0>ô.çyý×I¾þSÃs>bëzž…0~ê &<ûG-•Á³#u/ÃDý¸ŸyµÁñ‡ó©Tð}„A?§€Ïò¾¶Óøó‡ ¾ ú¯# Œ¡A¦×™àNbÓ'ÖQ´DǨ:ìëÀýðÊîïÓ¹-;'~äÈJ 8+=`Þ»àBûU¥ÞÒ%µX\ÎÙâ´é‚Û|ýp{ÿæ'í#$Ç%)Ó°šMoÃ93žÉúšæ …Í3Î64pwOÒ{zO éï|ŠÞ]œkD·Ž‡È@Ž‘ŠeËCÂ߀N–3ßRMú²h”ük‡ M`¡aætIÀÅŸ“ù_ù¤J!CœÚ6¶ž…£¨õev%çãT"TPAÏÂÄ”Yá9×5]ßÛ0°úN:âo\ð(ú¿ º)ns/@_[σ´ŽhÖíÅ› ‡0 ÚdÃæýlô4í©I[€w€"‹Çt€wP+[°!ëa°·örùx–|I.I´ßñ‘ÔÉ!Q9ü[<_àØ×VkÈl»a?Ž8ÀÕž;ÄÕö¼p™Ù dèjm‹8@´¤™š+R¤:Õá?ëvK»¨+éˆö€@yu'ÐÇ:£²%úÕv6c¸=QñOZón·÷»8í'ÖÍAëKÁAë×öÃh+h1¨Ú'Ö»Ýà2ÿYÏbc¦õfúÐ~‹ñìùÝìë8 Ÿ¬Ægp¾e‚ßA ¡³# Æ…Öç è¡øŽÜÃè¾Ø$º´cÈv=èîZŒšZkÒÜ<±Å¹ô2“³©‡ÁϤÿÛ"ñ?‡›ŽµØ©(C€R¯ø~ëL"| p•¤Ç¾½(· ÇWâ9›nCÏc/Úî‰d~áP|ÑûŽcw y;N¿Ž§ŸRÖÒª£Ì^0—”U‰±g™wRäBÌHÇ®ß}mp'Tpº–¿7¼ã`Þ:‡»‡ÔeZ©ñõ ÉN Šdûw{Ú«1cƳkaîßž Q:›Þß^/òt5Çž«Ôu¼IÏ*þðLdIUb£«ñÈ6q¯-ÐKuÁ[¸ûºb,UÖG¾˜ÇêÓÅ¿.¡<ØÞ?RÅBÿ›‰ØOšð´ ض³`PÔài£Fº„O"þæ ÷ÖIÝÄ#"œ}œÔÆ]¹ÒîLÌ•Š;™¿Û¦ÇÁʝ9ãeõ™â à¨øëL™’cÀtßëE>c×;1± ·%ÛÇ_töñb¬3•c)‘ÅUŒ1ÿ±"îwI9Šÿx-YPÏ7ø–횊ÜïÿàÙhþV˜”‹ëá³ïà‚lW®'\Š¢85µ ŽÓ·Jôþ}öN~¤#îŽælGÜ#f»|‘«O°äiX-DñÏ‹âÆ["h6üfà ‚â{&‹7õûÐ×Diwî'–ˆÅ燐qp¼™œÐÞ}˜"_1EGÁžEy¹¡ =ÝÑøÚv{ˆzÚ¸–ýùECƒ}{yèsŽSžîÿÊÒÃ̤Œ{pü:ØÈþ,&äàøaÇ^šMšÍ‰ûI‹h´W÷±h=Ö÷§D€4vfH{oTÔîÞE¨ÿo‰ãùX!õGàk"ç­"ª$ ,¤zMÒ̃^%ò¾-yÊíi&O¹5ç"ZJžÝ`‘¿{œø9º¢&öŽGÇëcá“1÷\cÇ?ˆq®rçaé·ÿŽû©—Ô©zÒk…TÝ'yTKd³ÀÜŠ]ØtfrÊOú)JkY ½W¾í©?55Åõ™5RÿÖ¸ Qµ*† 7ÒiµM5ÁÊW+_/üfú͝ÈE=Ší˜-ÐûßÙS?A:s¨ýêfçx+CJú æx-cªlG¯†Õ,íz=”>Ä ¾§×þ Sñ¹ª9QB%,(rU²wè¨LrÊâxƵ³™¶—í% v`Àì ¢Q›¹ƒ\Ń°ƒ›E£e/†ð®I|É”Be î+¨b_)(2,¢L¢Ä_Î ‰3çC춒ë1Q…ç¢þÝÐu±®Ýfn2 wÌæ3Ú“فõ892$„Bz—´‘"w›J;–ëk)•åzÙ ød·¤Õ“P/Ãœ–íÙEŠtžT¤Ÿ¤fJä=xRJV§ì½ #OÐ\åæò“Þ“š§I'Òë`ùÚö¤4H€·»CÊ'úv†ÓréE«¦VSë—X\w‡â=6À¿Åh¶]û¥÷|CÉFä1›‰Ïí¿–øMx¹â[ïÂ4GÖ¯<1ÅXI¥JlQ~Á¦ÌH0µ€>£òægÑÛ*£-R<ªÑ€N-ϯA¸¬/ljn’)*LNûž \Œ(ojÞÿ ¬êš_¥½À䆱¼Éâº#”ŽÿÓ FL ‡aù…eá#ð D?˜©½Ú®e³ÚûL =µÖ1 sÿÞ‘×é òK¾Y)ü’H@–ôAͤ#À_+ùé»ð¨Ç­]ßÕS¯5ó†@®il¢¡¡·þW3Pñ ¦–,)à4†¯ëW|Eäo™bôs#ÕK‘õ>‡z©ø(ü&þVô]úåô5ÔÏ}`ÿþ~›õ×ÃÒfuý«_ig¦È9Z¸–ßvÉÉ Säâ$¾lèwãÚóÃ3‡Mm_ñ·ÄÄsÒ¦ÆÙFæBïíP«ð´™sÉû§9iÓQ_‚Uô·´+,¾æ\xºñDcøÈÿq‚ha µÅ‰+ÑÛS’ÞNüƒéí•ŽÄ,Àa6ÄÓqÀÿ`V ‡fÜÆsR )ð*%ª$Ž“ú†KŠ‡¹?_D¾8(I$”ü?ÔÉõ’&î¦Z¯ìKïÿ3qk´¢Z(¾èTÃx„½yŒ<Ãä&ÛÇw,‘§ýÂdäl%œ“üü¨ %Ýö¬ÆÔÌÌ@å9…“®}1j_ç1ä'¼Å¡¼~V"êò$fdèIñ/9N’j¸}O÷Áç"sÍߢÞ·‚MßÌÁgkLñêÀÔ³ÃRý]¨®ûÿ DJV½\²ê—þ4H Yõ\ɪ_EVíþÓp7joocÿ’ÿØX £† ¾§Ïÿ‰ø¯öÕf쾟ê kG¾A:þáÞdáûi§ÐÅ1líMÍB©¦Ì[+“`á¥fDo‡%‚*õû-€WØW¥è\V)I&ÆËÊK(ÆXÂÚ¥‚R¿-j#ݱ÷ŸZ‚H)‡mv¡Šf <¥¶,T±Ë»JIgyO‘ì‰)ÞLrš$pYø׊¿½_1'InÕý=Iŵ¬]/}na:@Ø‹(w;©óŸA§M*sõ7xºæåºrm¦9#“ µyÌ>Zì5h;T)bEÉÓZ¸Bðº®br(1þ£71䄸ÆsÖ­Aöeßþð:Î5F_æåP-¼-i·÷B(ú×3tp²xý ÊSŒÈöÿóJŽÈx_”VE^Ñ+O``ìç@¯F±±`Ç~‘‡ÀŸ°ëÃ[dÍáè¿ SDÛ*Kq5ÛBäjÐÆ»4`š©Ý‘u(K¶é÷a‚EL­8Ü—(2y*,)´­ô–ð!P¸ ®øR‘j#)y[xÎÖ‘‘ˆÓÈÂ$îÈU|L$Š-JʆŸn–+–-˛ؐìÄÆ%Zx¨D{o€·XR»Çm¡œ€D³íEP'+ë½¥m¨S¨r´ž ¼¾ë·åõ‹2ýÒõÑÁÉ„'áò"Í`?tÔƒ3g”õ­8Bæ‰P֏¾lw[2´3Äw¶¶ÛŒ“>3þ £¹”¶pHÈ„ÝyMsoºl‚YÓJ:SI=’þ dÓþìæÑe¾`eâçOØ×úäþ{ë&V¤/mÇò.ã{}ÿ‹Ó²t3 ¸ ÓuȾþѧþK=ñ­@ze*¾oë‘­¢+n#tÿTŒ”D²6}8v¦´±Ûª¿`ïœÚNÚôwÃæÓ3ä™>œZØœFçÿ>±¤þôØl°ÿ¦Þ†P|C“‚QI†ˆr¸#@‚d#iÞï„J+¸žÓí…gŸc)=Ã5Õï­‹R|+;‘È™Š“(€É`>ÕŸ£BG;]M’ΔW× yPOtR!¼6±5kdˆ$O.IHg­>W¾¼ˆû*ýSύ|ºåÕ: ÀGÝ÷ª‘ÑÌGï*N$>ê'Ks,,Þ[j÷Då(I$¶Œõ´„×ì¶ðÏߐó@fNyæAà/ª™Qê¨huhÀ&™¤$t‘¢ŽŠ ä»öR@‘k…¥2œÂŸ¸d¨:;Å¢ªÂD¯Fº6¡ï«eCOP–”õ¥®òhëy»8sÍjþS&ì)BO¹â¯ EHxSÉg!Üþ†@fŽâû> HE3\™»‡˜twƒy:°ŸGME÷y ó˜Ô­þÒO¾ìzœŸìB$ƒn©ff#ôªæ\& í¥ –{áµ C¡>Àä´ô2ªi/bK‡“þ[/‘•DSщ¦–}¼M¨Ä¤!$Ô$Ž›ThÂP5¾Jh 0ÓC¿]8ä.l¿‚i!úFŠcJ*õ³>¹ü´ÃÀ’ÑØ‚&µñâ'ìf[÷½þƒî{€îàDÌ@¿ÓngÄÀG¿Ïôâ,bd™àÍ#Iö¿jñ¿jÐ'嶂 (C^Bø¤?j…å7…r7M1ýÊ¿²£™õø5²Rh_¬Í–·™“¡À ½Ê"É}A@8‘icY›ÁüzìÜ`5ãc ×|qƒd˜è+µ¦WùHžÙ÷Ác2úGÊB³0Tà€âÛzfW|ë¯CLXü‹¾Lw©éDb3¬',#0¡0BûuÌ{+þ'ö2ωÛ{øEz~¯5ôÈ »_„¹nOKudà¤JǾX5=Ö{Á–­,Ä»¨í¼„¶E4}ã8}¦¡ è#„&íÕBÐ ?ɋ؈ÖçÁk¡)/f\øKyq¬%Ê‹¤R=d “2÷^…ҝmÿ¢v2$ÄcÎkuò0 õ ÖZ|§¡F¿r ëŽÄD}D¿ ±î¥´ ÂxÔ>Ù[‚¬ ø$¬Zp¦¯V™× y¬¨=<”gÆ&3ãDÚÒá_ô4#œæˆÊ¡šíJV³\)ö”ïm#Q¾ëEÌW i}Ü}˜Ž¯ø'·¥u1¦µ6Æ¡–¨~uÓ"Ê3é~~ýÛódìµÌ †«‡ƒ2c½Ÿ…x¿´yÏã´hvù¼ÎyÙm)  õRìNš)^PvoK'}*æ¯9ä6﶐ÀWÞ¯lÞ‹6á‚‘Þóöaêt—ސk fs­®"=ÿoº÷$5Z„/Büÿ»[–ƒów¾h†öG|Œ

I was able to use "save target as" dumpit, but it saves as a txt file. I do not know if that is a problem.





Boffo
Post #28
Hello boffo123

If you are using Internet Explorer Right click on the dumpit link, Save Target As, save as "dumpit" (including the quotation marks), and save as "All files".

If you are able to save it as a .txt file this should work also :thumbup:

Alternatively, use Firefox for the download and the file should be saved automatically "as is".

Please give the above a try and let me know how you get on :)
Post #29
Hello JonTom If you are using Internet Explorer Right click on the dumpit link, Save Target As, save as "dumpit" (including the quotation marks), and save as "All files". If you are able to save it as a .txt file this should work also I tried with the quotation marks and " all files" selected and that worked. It saved with no file extention. Boffo
Post #30
Hello boffo123

I tried with the quotation marks and " all files" selected and that worked. It saved with no file extention.

That sounds better :thumbup: Continue with the rest of the xPUD instructions and if you run into any problems just come back and let me know :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI