150 replies to this topic

[Baruga]

Alrighty.

First: You should belt back a shot of whiskey, before you take on this project.

I have been left alone with this machine for 4 years. I don't know how to use it....by trial and error, I have learned how to use email and facebook, and google.
I don't know what a file is or where they go, or what is the difference between upload and download.
I have rarely used the right side of my mouse click thing.

I am your worst nightmare.....Feel like I have a mazeratti with no licence or keys.......

About 6 months ago, I got a free AVG anti-virus thing that I put on the machine. When I did that, things started to go wrong.....I kept losing my internet connection. So I tried to undo the AVG thing, and it would not go away. I went through a series of installing and uninstalling things until I just dumped all my security stuff so that I could at least connect to the internet...that is the only thing that would work.
Somewhere along the line, I lost my sound and ability to use my microphone. A friend helped me to get my sound back through FB chat.....but my microphone will not "pick up" and no one can hear me....I came to this what the tech group at one point and got a link to a scan thing. When I did the scan, it showed that I had over 260 viruses and 3 malwares. I don't do any online banking so I am not concerned about those things.....

But here are the troubles now:

I lost "realtek" thing, that picks up my microphone.
Would like to "clean" up all the viruses and malwares
And then put some security back on...which I have none of right now......

Whatever I need to do, I need to do it for free, or it can't be done. Period.

Here are the DDS things:
DDS (Ver_09-06-26.01) - NTFSx86
Run by Owner at 17:20:51.33 on 16/03/2011
Internet Explorer: 8.0.6001.19019 BrowserJavaVersion: 1.6.0_24
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.895.220 [GMT -3:00]

SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\SpiralFrog\Spiralfrog.exe
C:\Program Files\Samsung\Samsung SCX-4x21 Series\PSU\Scan2pc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\MyWebSearch\bar\6.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\6.bin\M3SRCHMN.EXE
C:\Program Files\Real\realplayer\Update\realsched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\MYWEBS~1\bar\6.bin\mwssvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\WUDFHost.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\System32\mobsync.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
uSEARCH PAGE = hxxp://ca.rd.yahoo.com/customize/ycomp/defaults/sp/*http://ca.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://en.ca.acer.yahoo.com
mDefault_Page_URL = hxxp://en.ca.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://ca.rd.yahoo.com/customize/ycomp/defaults/su/*http://ca.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\6.bin\MWSSRCAS.DLL
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\6.bin\MWSSRCAS.DLL
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: mwsBar BHO: {07b18ea1-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\6.bin\MWSBAR.DLL
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\6.bin\MWSBAR.DLL
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\6.bin\mwsoemon.exe
uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Acer Empowering Technology Monitor] c:\acer\empowering technology\SysMonitor.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [Acer Tour]
mRun: [SiSTray] %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
mRun: [eRecoveryService]
mRun: [Acer Product Registration] "c:\program files\acer registration\ACE1.exe" /startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [SpiralFrog] c:\program files\spiralfrog\Spiralfrog.exe
mRun: [WHITNEY_S2P] c:\program files\samsung\samsung scx-4x21 series\psu\Scan2pc.exe
mRun: [PCMMediaSharing] c:\program files\acer arcade live\acer homemedia connect\kernel\dms\PCMMediaSharing.exe
mRun: [Acer Tour Reminder] c:\acer\acertour\Reminder.exe
mRun: [Acer Assist Launcher] c:\program files\acer assist\launcher.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\6.bin\mwsoemon.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [My Web Search Bar Search Scope Monitor] "c:\progra~1\mywebs~1\bar\6.bin\m3SrchMn.exe" /m=2 /w /h
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [Acer Tour Reminder] c:\acer\acertour\Reminder.exe
StartupFolder: c:\users\owner\appdata\roaming\micros~1\windows\startm~1\programs\startup\acerpr~1.lnk - c:\program files\acer registration\ACE1.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\apcups~1.lnk - c:\program files\apc\apc powerchute personal edition\Display.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Search - http://edits.mywebse...html?p=ZRfox000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} - {7A3D6D17-9DD5-4C60-8076-D1784DABAF8C}
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Yahtzee/Images/stg_drm.ocx
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/PopularScreenSaversFWBInitialSetup1.0.1.0.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/SCRABBLE/Images/armhelper.ocx
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://www.popcap.com/webgames/popcaploader_v10.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: AVGRSSTX.DLL c:\progra~1\google\google~4\GOEC62~1.DLL

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 249424]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\acer arcade live\acer homemedia connect\kernel\dms\CLMSServer.exe [2007-9-14 269448]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-4-5 21504]
R2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\6.bin\mwssvc.exe [2010-11-20 28762]
R2 SSPORT;SSPORT;c:\windows\system32\drivers\SSPORT.SYS [2007-12-26 5120]
R3 SiS6350;SiS6350;c:\windows\system32\drivers\SISGRKMD.sys [2007-9-13 454520]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\drivers\SiSGB6.sys [2007-9-13 46592]
S1 avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwd6x.sys [2010-7-12 54112]
S2 avgfws;AVG Firewall;"c:\program files\avg\avg10\avgfws.exe" --> c:\program files\avg\avg10\avgfws.exe [?]
S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg10\identity protection\agent\bin\avgidsagent.exe" --> c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [?]
S2 avgwd;AVG WatchDog;"c:\program files\avg\avg10\avgwdsvc.exe" --> c:\program files\avg\avg10\avgwdsvc.exe [?]
S2 gupdate1c9c6d11bff959c;Google Update Service (gupdate1c9c6d11bff959c);c:\program files\google\update\GoogleUpdate.exe [2009-4-26 133104]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\toolbarbroker.exe --> c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-3-25 30192]

=============== Created Last 30 ================

2011-03-12 13:41 <DIR> --d----- c:\programdata\McAfee
2011-03-11 14:47 429,056 a------- c:\windows\system32\EncDec.dll
2011-03-11 14:47 322,560 a------- c:\windows\system32\sbe.dll
2011-03-11 14:47 177,664 a------- c:\windows\system32\mpg2splt.ax
2011-03-11 14:47 153,088 a------- c:\windows\system32\sbeio.dll
2011-03-11 14:41 2,067,968 a------- c:\windows\system32\mstscax.dll
2011-03-11 14:41 677,888 a------- c:\windows\system32\mstsc.exe
2011-03-02 20:04 <DIR> --d----- c:\program files\iPod
2011-03-02 20:04 <DIR> --d----- c:\program files\iTunes
2011-03-02 19:59 <DIR> --d----- c:\program files\Bonjour
2011-02-23 17:39 2,048 a------- c:\windows\system32\winrsmgr.dll

==================== Find3M ====================

2011-03-02 20:01 143,360 a------- c:\windows\inf\infstrng.dat
2011-03-02 20:01 86,016 a------- c:\windows\inf\infstor.dat
2011-03-02 20:01 51,200 a------- c:\windows\inf\infpub.dat
2011-02-02 22:40 472,808 a------- c:\windows\system32\deployJava1.dll
2011-02-02 18:11 222,080 -------- c:\windows\system32\MpSigStub.exe
2011-01-20 13:37 638,336 a------- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-20 13:08 478,720 a------- c:\windows\system32\dxgi.dll
2011-01-20 13:08 1,029,120 a------- c:\windows\system32\d3d10.dll
2011-01-20 13:08 219,648 a------- c:\windows\system32\d3d10_1core.dll
2011-01-20 13:08 189,952 a------- c:\windows\system32\d3d10core.dll
2011-01-20 13:08 160,768 a------- c:\windows\system32\d3d10_1.dll
2011-01-20 13:07 37,376 a------- c:\windows\system32\cdd.dll
2011-01-20 13:07 258,048 a------- c:\windows\system32\winspool.drv
2011-01-20 13:07 586,240 a------- c:\windows\system32\stobject.dll
2011-01-20 13:06 2,873,344 a------- c:\windows\system32\mf.dll
2011-01-20 13:06 26,112 a------- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 13:04 209,920 a------- c:\windows\system32\mfplat.dll
2011-01-20 13:04 98,816 a------- c:\windows\system32\mfps.dll
2011-01-20 11:28 1,554,432 a------- c:\windows\system32\xpsservices.dll
2011-01-20 11:27 876,032 a------- c:\windows\system32\XpsPrint.dll
2011-01-20 11:26 667,648 a------- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 11:25 847,360 a------- c:\windows\system32\OpcServices.dll
2011-01-20 11:24 288,768 a------- c:\windows\system32\XpsGdiConverter.dll
2011-01-20 11:24 135,680 a------- c:\windows\system32\XpsRasterService.dll
2011-01-20 11:15 979,456 a------- c:\windows\system32\MFH264Dec.dll
2011-01-20 11:14 357,376 a------- c:\windows\system32\MFHEAACdec.dll
2011-01-20 11:14 302,592 a------- c:\windows\system32\mfmp4src.dll
2011-01-20 11:14 261,632 a------- c:\windows\system32\mfreadwrite.dll
2011-01-20 11:12 1,172,480 a------- c:\windows\system32\d3d10warp.dll
2011-01-20 11:11 486,400 a------- c:\windows\system32\d3d10level9.dll
2011-01-20 10:47 683,008 a------- c:\windows\system32\d2d1.dll
2011-01-20 10:44 1,068,544 a------- c:\windows\system32\DWrite.dll
2011-01-20 10:44 797,184 a------- c:\windows\system32\FntCache.dll
2011-01-08 05:47 34,304 a------- c:\windows\system32\atmlib.dll
2011-01-08 03:28 292,352 a------- c:\windows\system32\atmfd.dll
2010-12-31 10:57 2,039,808 a------- c:\windows\system32\win32k.sys
2010-12-28 12:55 413,696 a------- c:\windows\system32\odbc32.dll
2010-12-18 03:27 916,480 a------- c:\windows\system32\wininet.dll
2010-12-18 03:22 43,520 a------- c:\windows\system32\licmgr10.dll
2010-12-18 03:22 109,056 a------- c:\windows\system32\iesysprep.dll
2010-12-18 03:22 71,680 a------- c:\windows\system32\iesetup.dll
2010-12-18 01:48 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-11-18 10:10 665,600 a------- c:\windows\inf\drvindex.dat
2009-08-06 14:21 108 a------- c:\users\owner\appdata\roaming\wklnhst.dat
2008-08-12 23:58 48 a---h--- c:\programdata\ezsidmv.dat
2008-08-12 23:58 48 a---h--- c:\progra~2\ezsidmv.dat
2008-04-05 21:59 174 a--sh--- c:\program files\desktop.ini
2006-11-02 09:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 09:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 09:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 06:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 06:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 06:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 06:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2010-09-29 16:11 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat
2010-09-29 16:11 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat
2010-09-29 16:11 32,768 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2010-10-18 08:38 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2010-10-18 08:38 32,768 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2010-10-18 08:38 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat
2010-08-13 19:37 262,144 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2010-11-19 22:42 262,144 a--sh--- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
2007-12-14 14:19 8,192 a--sh--- c:\windows\users\default\NTUSER.DAT

============= FINISH: 17:24:41.62 ===============


HERE IS THE NOTEPAD THING:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 14/12/2007 12:26:17 PM
System Uptime: 16/03/2011 3:15:55 PM (2 hours ago)

Motherboard: Acer | | F672CR
Processor: Intel® Pentium® D CPU 3.00GHz | Socket 775 | 2400/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 72 GiB total, 28.812 GiB free.
D: is FIXED (NTFS) - 72 GiB total, 70.737 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1008: 12/03/2011 1:36:09 AM - Windows Update
RP1009: 12/03/2011 12:41:39 PM - Installed Java™ 6 Update 24
RP1010: 13/03/2011 3:40:57 PM - Scheduled Checkpoint
RP1011: 14/03/2011 5:21:54 PM - Scheduled Checkpoint
RP1012: 15/03/2011 11:13:12 AM - Windows Update

==== Installed Programs ======================

Acer Arcade Live Main Page
Acer Assist
Acer DV Magician
Acer DVDivine
Acer eDataSecurity Management
Acer Empowering Technology
Acer ePerformance Management
Acer HomeMedia
Acer HomeMedia Connect
Acer Registration
Acer ScreenSaver
Acer SlideShow DVD
Acer Tour
Acer VideoMagician
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.3
APC PowerChute Personal Edition
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AVG 2011
Bonjour
CCleaner (remove only)
DivX Setup
Google Chrome
Google Desktop
Google Earth
Google Gmail Notifier
Google Photos Screensaver
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iPhone Configuration Utility
iTunes
Java Auto Updater
Java™ 6 Update 24
LightScribe 1.4.142.1
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
MobileMe Control Panel
Mozilla Firefox (3.0.8)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
My Web Search
Octoshape add-in for Adobe Flash Player
Picasa 2
QuickTime
RealPlayer
RealUpgrade 1.1
Revo Uninstaller 1.90
Safari
SAMSUNG Dr. Printer
Samsung SCX-4x21 Series
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
SiS VGA Utilities
Skype Toolbars
Skype™ 5.0
SmarThru 4
SmarThru PC Fax
SpiralFrog Download Manager 0.8.24
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.4053
Windows Media Player Firefox Plugin

==== Event Viewer Messages From Past Week ========

16/03/2011 3:17:57 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgfwfd
16/03/2011 3:17:57 PM, Error: Service Control Manager [7001] - The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
16/03/2011 3:17:57 PM, Error: Service Control Manager [7000] - The AVG WatchDog service failed to start due to the following error: The system cannot find the file specified.
16/03/2011 3:17:57 PM, Error: Service Control Manager [7000] - The AVG Firewall service failed to start due to the following error: The system cannot find the file specified.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.67.3.190:63331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.67.159.110:63331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.67.143.213:63331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.67.143.213:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.67.134.160:63331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.67.130.140:63331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.93.59:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.89.123:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.88.19:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.88.128:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.8.97:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.4.39:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.28.74:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.28.127:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.24.93:63331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.21.157:63331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.20.181:6331. The error status code is contained within the returned data.
16/03/2011 3:16:23 PM, Error: Microsoft-Windows-HttpEvent [15021] - An error occured while using SSL configuration for socket address 70.66.20.106:6331. The error status code is contained within the returned data.

==== End Of File ===========================

[Tomk]

Hi Baruga,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

.Feel like I have a mazeratti with no licence or keys......

I think that having a mazeratti but no keys for it... wouldn't be very dangerous. It would just be an expensive piece of art setting there in the driveway.

You're doing fine. Just remember that if I ask you to do something that confuses you... just make me repeat it a different way until you're comfortable with the instructions.

As we work through your logs. Please remember to run any tools by Right-clicking on the icon and selecting Run As Administrator....

Those logs don't look to bad. Let's see if we can spiff things up a bit.

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

[Baruga]

HI Tom..... Geez, I feel some bad for ya. K....I clicked on the "download" but it just seems to be "starting" but not really doing anything......there is a little square on the lower left, right about the windows picture.......says "mbam-setup-1.50.1...exe..Then below that "starting"

[Tomk]

Baruga,

Look at the top of your web page.

Right below your toolbar (probably says Favorites) there should be a page tabe that says "Thank you for downloading Malwarebytes....".

Is there a line right below that that says "To help protect your security, Windows has blocked this site from downloading. Click here for options..."?

If there is... then click there. A little window will pop up and you need to click on download file.

[Baruga]

I don't see anything like that. I am running "google chrome" Um....still have this little box with the mbam setup exe.....and now it says "opening when complete"......but has said that for the last hour... I don't see anywhere on this whole screen that gives me an option to do anything else......

[Tomk]

Ok... I gave you that input based upon I was guessing that you were using Internet Explorer (I use FireFox). Let's see if I can get a copy of Chrome installed and see what it looks like.

[Tomk]

Baruga,

Alrighty... let's try this.

Look at the bottom of your page on the right hand side. I think it will say "Show all Downloads"

Click on that.

I believe then a new page will pop up and hopefully will show mbam-setup-1.50.1.1100.exe. If it does, click on it and the install of Malwarebytes should start.

[Baruga]

Wow. That's where all that stuff is.... Anyway, I found it...but it is in black, (every other one is in blue) so it does nothing when I click on it. Is the malware preventing us from attempting to fix this machine?

[Baruga]

In faint black letters it says it is "cancelled"

[Tomk]

Ok... click on the link provided previously and start the download again.

The little box you saw at the bottom left of your screen should come up again and I think it should say something like Accept or Cancel directly to the right. Click on accept (might say download). Should only take a minute to download. Then you should be able to click on the box to start the install. If nothing happens again, click on the show downloads again and let me know what it says.

[Baruga]

Ok! I got it! *victory lap around the living room* Now, it gives me three scan options.......quick scan.....full scan....um...flash scan....which one should I do?

[Baruga]

Oh and I forgot to mention in my list of troubles...that the last couple of weeks, my machine has been freezing up, only when I am trying to "close windows"...it freezes midway...and I have to unplug the thing and wait a minute then plug it back in again.....

[Tomk]

Quick scan will be sufficient.

[Baruga]

Ok Tom, the scan is done. Um....I don't know how to "bring it here" I can't seem to copy and paste from inside the window it gives me.......

[Tomk]

A notepad window should have opened.

Click anywhere in that window.

Hold your Ctrl key and press A a the same time (everything in the window should highlight)
Hold Ctrl key and press C (this will copy to your clip board)
Reply here and paste in the box (you can do this by right clicking and selecting paste, or can hold Ctrl and press V at the same time)