Spyware / Malware / Virus Removal

MS Recovery fake alert and other malware

10 min read

Looking for the outcome? Ask AI

Jcatsmom Topic Starter

Post #1April 10, 2011, 6:26 PM UTC

I would appreciate your help cleaning up this computer. My friend's computer is running Vista Home Premium, SP1 with Internet Explorer 7. Her copy of Norton had expired. The computer was infected with MS Recovery which was blocking all programs from running. I was able to knock it down by running Malware Bytes in safe mode. I installed Avast to give the computer security. It and ESET online scanner have found and tried to remove additional infections. At the least, MyWebSearch is still active. Programs are running well now. Here are my logs. Thank you very much for your help.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6320

Windows 6.0.6001 Service Pack 1 (Safe Mode)
Internet Explorer 7.0.6001.18000

4/9/2011 4:03:22 PM
mbam-log-2011-04-09 (16-03-22).txt

Scan type: Quick scan
Objects scanned: 148881
Time elapsed: 2 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hDi16633aDmHe16633 (Trojan.Downloader) -> Value: hDi16633aDmHe16633 -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\hdi16633admhe16633\hdi16633admhe16633.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
====================
Avast Boottime scan
C:\programs files\fast broser search\ie\bho.dll Threat: win32:Malware-gen
c:\program files\SGPSA\BHO.dll Threat: win32:Malware-gen

Both were supposedly deleted, but Fast Broswer Search is still active

======================================
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6320

Windows 6.0.6001 Service Pack 1 (Safe Mode)
Internet Explorer 7.0.6001.18000

4/9/2011 4:03:22 PM
mbam-log-2011-04-09 (16-03-22).txt

Scan type: Quick scan
Objects scanned: 148881
Time elapsed: 2 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hDi16633aDmHe16633 (Trojan.Downloader) -> Value: hDi16633aDmHe16633 -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\hdi16633admhe16633\hdi16633admhe16633.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
=========================================================
ESET Online Scanner
C:\Program Files\DailyBibleGuideIE\bar\1.bin\eldatact.dll a variant of Win32/Toolbar.MyWebSearch.A application cleaned by deleting - quarantined
C:\Program Files\DailyBibleGuideIE\bar\1.bin\elhtml.dll probably a variant of Win32/Toolbar.MyWebSearch.F application cleaned by deleting - quarantined
C:\Program Files\DailyBibleGuideIE\bar\1.bin\elhtmlmu.dll probably a variant of Win32/Toolbar.MyWebSearch.B application cleaned by deleting (after the next restart) - quarantined
C:\Program Files\Fast Browser Search\IE\MTWB3SH.dll a variant of Win32/BHO.OCS trojan cleaned by deleting - quarantined
C:\Program Files\SGPSA\mtwb3sh.dll a variant of Win32/BHO.OCS trojan cleaned by deleting - quarantined
C:\Users\Steve and Becky Rose\AppData\Local\Temp\NOD3C9D.tmp probably a variant of Win32/Toolbar.MyWebSearch.B application cleaned by deleting (after the next restart) - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(000bf565).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(02a2663e).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(07bf3aa7).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(0daa575a).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(134d3bfb).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(182797bb).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(1c201077).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(20dbbbeb).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(21130b53).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(25d82bc7).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(26d9e895).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(2aff3ed5).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(2b92de42).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(2f651618).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(3299ce02).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(3536d5bd).exe probably a variant of Win32/Toolbar.MyWebSearch.L application deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\74119a51-37a6f652 probably a variant of Java/TrojanDownloader.Agent.AB trojan cleaned by deleting - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\79015eaf-78e9e416 multiple threats deleted - quarantined
C:\Users\Steve and Becky Rose\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\3403c2c7-2f316f8b probably a variant of Win32/Agent.IXMUAWZ trojan cleaned by deleting - quarantined
=====================================
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:32:49 PM, on 4/10/2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18565)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbrmon.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Hewlett-Packard\KBD\kbd.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\PROGRA~1\DAILYB~2\bar\1.bin\elmedint.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {9517d6a5-a627-48a7-bb03-f240c85d1b04} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll
R3 - URLSearchHook: PageRage Toolbar - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPage.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: PageRage - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPage.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: Search Assistant BHO - {ca5306dd-361c-4291-bee3-9e0a9d9e5cb6} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Toolbar BHO - {d8d716f2-aa5c-4406-9c39-c8ff582023e6} - C:\PROGRA~1\DAILYB~2\bar\1.bin\elbar.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers\YontooIEClient.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: DailyBibleGuide - {1399078b-7eb7-477a-893f-93d4ace22fda} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: PageRage Toolbar - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPage.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\Program Files\Hewlett-Packard\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "c:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePDIRShortCut] "c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "c:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" "c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [TSMAgent] "c:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer for HP TouchSmart] "c:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DVDAgent] "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DailyBibleGuideIE Browser Plugin Loader] C:\PROGRA~1\DAILYB~2\bar\1.bin\elbrmon.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunServices: [go[1]] C:\Users\Steve and Becky Rose\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LMJY6ZXS\go[1].exe
O4 - HKCU\..\RunServices: [computerpics] c:\users\steve and becky rose\pictures\2009-05-09 brittany and tr's computer pics\brittanypics.exe
O4 - HKCU\..\RunServices: [go[2]] c:\users\steve and becky rose\appdata\local\microsoft\windows\temporary internet files\content.ie5\zcmnoyz1\go[2].exe
O4 - HKCU\..\RunServices: [msnersrcToolbar] C:\Users\Steve and Becky Rose\AppData\Local\Microsoft\MSNE\en-us\msnersrcmsnersrc.exe
O4 - HKCU\..\RunServices: [bdaykaylans] C:\Users\Steve and Becky Rose\Pictures\2010-07-23 kaylans b-day 10\bdaykaylans.exe
O4 - HKCU\..\RunServices: [sp40966stub32i] C:\Users\Steve and Becky Rose\Desktop\sp40966stub3226.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: DailyBibleGuide Service (DailyBibleGuideIEService) - DailyBibleGuide - C:\PROGRA~1\DAILYB~2\bar\1.bin\elbarsvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 12234 bytes
=========================================================

OTL logfile created on: 4/10/2011 12:18:26 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Steve and Becky Rose\Desktop\computer stuff
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 49.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.46 Gb Total Space | 209.19 Gb Free Space | 73.02% Space Free | Partition Type: NTFS
Drive D: | 11.63 Gb Total Space | 1.59 Gb Free Space | 13.64% Space Free | Partition Type: NTFS

Computer Name: STEVEANDBECK-PC | User Name: Steve and Becky Rose | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Steve and Becky Rose\Desktop\computer stuff\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbarsvc.exe (DailyBibleGuide)
PRC - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elmedint.exe (DailyBibleGuide)
PRC - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbrmon.exe (DailyBibleGuide)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10l_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
PRC - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

========== Modules (SafeList) ==========

MOD - C:\Users\Steve and Becky Rose\Desktop\computer stuff\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\AVAST Software\Avast\snxhk.dll (AVAST Software)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (DailyBibleGuideIEService) – C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbarsvc.exe (DailyBibleGuide)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) – C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (HSXHWBS2) – C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\Windows\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (nvsmu) – C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (Ps2) – C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
IE - HKLM\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPage.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - File not found
IE - HKCU\..\URLSearchHook: {9517d6a5-a627-48a7-bb03-f240c85d1b04} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll (DailyBibleGuide)
IE - HKCU\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPage.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/10/12 17:55:51 | 000,000,000 | —D | M]

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll ()
O2 - BHO: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPage.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (Search Assistant BHO) - {ca5306dd-361c-4291-bee3-9e0a9d9e5cb6} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll (DailyBibleGuide)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Toolbar BHO) - {d8d716f2-aa5c-4406-9c39-c8ff582023e6} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbar.dll (DailyBibleGuide)
O2 - BHO: (Fast Browser Search Toolbar Helper) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers\YontooIEClient.dll (Yontoo Technology, Inc.)
O3 - HKLM\..\Toolbar: (DailyBibleGuide) - {1399078b-7eb7-477a-893f-93d4ace22fda} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbar.dll (DailyBibleGuide)
O3 - HKLM\..\Toolbar: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll ()
O3 - HKLM\..\Toolbar: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\prxtbPage.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (DailyBibleGuide) - {1399078B-7EB7-477A-893F-93D4ACE22FDA} - C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbar.dll (DailyBibleGuide)
O3 - HKCU\..\Toolbar\WebBrowser: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PageRage Toolbar) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - C:\Program Files\PageRage\prxtbPage.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DailyBibleGuideIE Browser Plugin Loader] C:\Program Files\DailyBibleGuideIE\bar\1.bin\elbrmon.exe (DailyBibleGuide)
O4 - HKLM..\Run: [DVDAgent] C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\Program Files\Hewlett-Packard\KBD\KbdStub.exe (Microsoft)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4 - HKLM..\Run: [TSMAgent] c:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\RunServices: [bdaykaylans] File not found
O4 - HKCU..\RunServices: [computerpics] File not found
O4 - HKCU..\RunServices: [go[1]] File not found
O4 - HKCU..\RunServices: [go[2]] File not found
O4 - HKCU..\RunServices: [msnersrcToolbar] File not found
O4 - HKCU..\RunServices: [sp40966stub32i] File not found
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Steve and Becky Rose\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Steve and Becky Rose\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/04/10 10:55:36 | 000,222,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2011/04/10 10:15:58 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2011/04/09 21:02:55 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/04/09 18:52:06 | 000,019,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2011/04/09 18:52:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2011/04/09 18:52:05 | 000,371,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2011/04/09 18:52:05 | 000,301,528 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2011/04/09 18:52:05 | 000,049,240 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2011/04/09 18:52:05 | 000,025,432 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2011/04/09 18:52:04 | 000,053,592 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2011/04/09 18:50:38 | 000,040,648 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2011/04/09 18:50:37 | 000,190,016 | —- | C] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2011/04/09 18:50:19 | 000,000,000 | —D | C] – C:\ProgramData\AVAST Software
[2011/04/09 18:50:19 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2011/04/09 16:21:28 | 000,000,000 | —D | C] – C:\Users\Steve and Becky Rose\Desktop\computer stuff
[2011/04/05 19:38:57 | 000,000,000 | —D | C] – C:\ProgramData\hDi16633aDmHe16633
[2011/03/26 14:43:17 | 000,000,000 | —D | C] – C:\Program Files\Conduit
[2011/03/26 14:43:15 | 000,000,000 | —D | C] – C:\Program Files\ConduitEngine
[2011/03/26 14:43:13 | 000,000,000 | —D | C] – C:\Program Files\PageRage
[2011/03/26 14:43:13 | 000,000,000 | —D | C] – C:\Users\Steve and Becky Rose\AppData\Local\Conduit
[2011/03/26 14:42:43 | 000,000,000 | —D | C] – C:\Program Files\Yontoo Layers
[2011/03/26 14:42:43 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer

========== Files - Modified Within 30 Days ==========

[2011/04/10 12:10:12 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/10 12:10:12 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/10 12:05:06 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/04/10 10:25:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/10 10:20:35 | 000,000,036 | —- | M] () – C:\Users\Steve and Becky Rose\AppData\Local\housecall.guid.cache
[2011/04/10 10:15:49 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/10 10:15:49 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/10 10:10:21 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/09 18:52:06 | 000,001,831 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/04/09 18:52:04 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2011/04/09 16:06:47 | 000,001,889 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/03/29 18:33:41 | 000,000,945 | —- | M] () – C:\Users\Steve and Becky Rose\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/03/26 21:45:31 | 000,007,052 | —- | M] () – C:\Users\Steve and Becky Rose\AppData\Local\d3d9caps.dat

========== Files Created - No Company Name ==========

[2011/04/10 10:20:35 | 000,000,036 | —- | C] () – C:\Users\Steve and Becky Rose\AppData\Local\housecall.guid.cache
[2011/04/09 18:52:06 | 000,001,831 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/03/29 18:33:41 | 000,000,945 | —- | C] () – C:\Users\Steve and Becky Rose\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/09/09 17:31:17 | 000,000,000 | —- | C] () – C:\Users\Steve and Becky Rose\AppData\Roaming\wklnhst.dat
[2009/10/12 17:49:16 | 000,148,197 | —- | C] () – C:\Windows\hpoins37.dat
[2009/05/26 23:53:00 | 000,007,052 | —- | C] () – C:\Users\Steve and Becky Rose\AppData\Local\d3d9caps.dat
[2009/05/07 21:54:29 | 000,018,432 | —- | C] () – C:\Users\Steve and Becky Rose\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/16 19:30:52 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2008/12/16 19:30:52 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2008/12/16 19:15:54 | 000,106,605 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2008/12/16 19:15:54 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/12/11 16:42:32 | 000,000,504 | —- | C] () – C:\Windows\hpomdl37.dat
[2006/11/02 07:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,332,832 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,604,264 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,103,964 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2010/09/09 17:31:27 | 000,000,000 | —D | M] – C:\Users\Steve and Becky Rose\AppData\Roaming\Template
[2009/10/02 15:55:18 | 000,000,000 | —D | M] – C:\Users\Steve and Becky Rose\AppData\Roaming\WildTangent
[2009/10/12 18:50:04 | 000,000,000 | —D | M] – C:\Users\Steve and Becky Rose\AppData\Roaming\WinBatch
[2011/04/09 22:44:46 | 000,032,616 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2008/01/20 21:24:42 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2008/12/16 19:07:06 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 16:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2009/10/12 19:37:56 | 000,000,125 | —- | M] () – C:\FINIS_IT.TXT
[2011/04/10 10:09:51 | 3399,303,168 | -HS- | M] () – C:\pagefile.sys
[2008/12/16 19:55:17 | 000,000,349 | —- | M] () – C:\updatedatfix.log
[2008/08/26 07:37:52 | 000,000,458 | —- | M] () – C:\Windows Sidebar

< %systemroot%\Fonts\*.com >
[2006/11/02 07:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 07:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/03/17 05:00:00 | 000,027,648 | —- | M] (CANON INC.) – C:\Windows\System32\spool\prtprocs\w32x86\CNMPD9W.DLL
[2009/03/17 05:00:00 | 000,070,656 | —- | M] (CANON INC.) – C:\Windows\System32\spool\prtprocs\w32x86\CNMPP9W.DLL
[2008/10/06 15:37:30 | 000,315,392 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpfpp083.dll
[2008/01/20 21:23:14 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 07:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/02/23 09:04:21 | 000,040,648 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 21:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 22:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 22:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 22:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/05/09 16:32:23 | 000,000,286 | -HS- | M] () – C:\Users\Steve and Becky Rose\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2009/05/01 13:43:28 | 003,766,552 | —- | M] (Hewlett-Packard Development Company, L.P. ) – C:\Users\Steve and Becky Rose\Desktop\sp40966.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-10 17:07:51

< End of report >
=============================================================
OTL Extras logfile created on: 4/10/2011 12:18:27 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Steve and Becky Rose\Desktop\computer stuff
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 49.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.46 Gb Total Space | 209.19 Gb Free Space | 73.02% Space Free | Partition Type: NTFS
Drive D: | 11.63 Gb Total Space | 1.59 Gb Free Space | 13.64% Space Free | Partition Type: NTFS

Computer Name: STEVEANDBECK-PC | User Name: Steve and Becky Rose | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{15C72B33-2AB1-4FEA-9A7C-E8BD22D789D7}" = lport=137 | protocol=17 | dir=in | app=system |
"{532A4895-82FC-494B-86D8-AC54DB374113}" = lport=138 | protocol=17 | dir=in | app=system |
"{60BDD87B-1360-4E2C-BE63-6132B8791186}" = lport=445 | protocol=6 | dir=in | app=system |
"{705A4963-0A71-4520-8B9B-B5B845CDADF6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{71A350FC-93F9-4320-957B-AEDDC2BBE5CA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{94A83F26-178D-403C-BDE8-BE2524A7923F}" = rport=137 | protocol=17 | dir=out | app=system |
"{980632FC-A12A-4C87-A9A0-AB0BA587D956}" = rport=138 | protocol=17 | dir=out | app=system |
"{A8539917-4C72-45BC-93AC-439942E497C9}" = lport=139 | protocol=6 | dir=in | app=system |
"{AB1A0747-DBEB-467A-9A96-69BAE621088B}" = rport=139 | protocol=6 | dir=out | app=system |
"{B6B27F07-9CBF-4EC2-9ED9-C9A0E011267E}" = rport=445 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02E47C32-B05A-42F9-85D7-7FF17215B327}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe |
"{0BEC75FB-1C6B-4855-A2F9-00DC012C91BC}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartvideo.exe |
"{174071F0-2DC8-4830-852F-A2FFE012C023}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{1AE831CB-E0AF-424C-8AA9-CB2E7F283EAE}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hpdvdsmart.exe |
"{27013AE1-23DA-4434-B1D8-260FCABC7DA1}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{2A4457D6-4D49-4F01-89DB-56DB54E35EF4}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartmusic.exe |
"{3136C43B-8FD3-4BE9-A2C2-48DD1DEEEE04}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe |
"{32A92707-6EBF-4D30-8992-CD118C341E86}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{34511F7D-D991-4183-8018-CE8D4FCF1737}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqcopy2.exe |
"{35D16828-DC90-40F8-B112-131A45045031}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{426CDA9B-0307-40D0-9FC6-CDC08219FD57}" = protocol=6 | dir=in | app=c:\users\steve and becky rose\appdata\local\temp\7zs7be3.tmp\symnrt.exe |
"{4B84B8DF-4DAD-4A45-A513-09A9A612AB8E}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartvideo.exe |
"{5663B291-DC8A-4DB7-ACA8-7C4C1F224089}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartphoto.exe |
"{59021720-5D30-4F1A-84D1-16074F1032B5}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5D5C907C-6579-4CEE-B32D-D5BD406A97D9}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\tsmagent.exe |
"{5FED3053-6B1B-406C-8C0D-EFFBDB3C40EF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{6166E55C-4056-4E1C-965E-162423565FF8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{738F8AA5-4135-4814-9F52-9130D776427C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{742F833A-BC2B-4C93-8934-5E3DFC68109E}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe |
"{78E41E17-C07A-4A94-A88A-7E4B5042E6AE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{7B52BA6D-B135-48AB-9380-C8CE108F20A6}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hpdvdsmart.exe |
"{842F9B73-6B2D-4B87-993D-255186119925}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\tsmagent.exe |
"{85A291B6-A85B-4AE0-9C62-951FAC179002}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{90A87B4D-5F90-43D1-AE25-94FAC055173D}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe |
"{90DDBBB7-58D1-4F64-BD4A-44FB32FF3B50}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartmusic.exe |
"{9EE16E6D-CF5B-466C-9C27-4DAADE2FD3EB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{B53447C4-58CE-485B-9552-B77D35ECFA63}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{B8DF904D-0021-410D-9DF0-C62660876FD8}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{CCA5360E-7A47-4F2A-A200-5158DFE36F8F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{CDF119B4-7AD7-4700-8C7A-317A115C3522}" = protocol=6 | dir=in | app=c:\users\steve and becky rose\appdata\local\temp\7zs9388.tmp\symnrt.exe |
"{CF6858C6-09B4-43A1-8D05-94D7052EA5F8}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe |
"{D9859051-F392-4D75-A0F8-B67E9E09A362}" = protocol=17 | dir=in | app=c:\users\steve and becky rose\appdata\local\temp\7zs9388.tmp\symnrt.exe |
"{E1F4D22D-99C5-4EE8-8DC9-CC3DBF47FA84}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartphoto.exe |
"{E5046EF8-EAC7-49F7-BD46-D528D4CD1E34}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\tsmagent.exe |
"{EC435781-DB67-4DEC-BB1C-566E502F45EB}" = protocol=17 | dir=in | app=c:\users\steve and becky rose\appdata\local\temp\7zs7be3.tmp\symnrt.exe |
"{F868B72A-06B7-4E05-B728-9EA94AE9E38E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{F98AF466-C459-4315-A6FB-A5970E453108}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe |
"{FCFA35F6-DF9D-4BF3-9124-E66F89823075}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"TCP Query User{494B5C80-05B9-416B-9B5A-D27C9866B4C2}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{A5E0C053-B6BB-472D-BA74-A823BED75F0D}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0167F157-DAB9-46b0-86C4-7C66DDA85B48}" = HP Deskjet F4400 All-In-One Driver Software 12.0 Rel .5
"{03A7C57A-B2C8-409b-92E5-524A0DFD0DD3}" = Status
"{03BF5CB1-B72E-4CA6-A278-F65680F05420}" = HP Picasso Media Center Add-In
"{0409c45d-df44-4b98-93b0-572697aa054a}" = F4400
"{087A66B8-1F0F-4a8d-A649-0CFE276AA7C0}" = WebReg
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19506BDB-4EA7-491F-E8AB-E97109FDB296}" = muvee Reveal
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{2A329FB6-389D-4396-A974-29656D6864AE}" = MarketResearch
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZero Preloader
"{38058455-8C21-4C2F-B2F6-14ED166039CB}" = HP Total Care Setup
"{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}" = Copy
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4D304678-738E-42a0-931A-2B022F49DEB8}" = TrayApp
"{54C7CFA4-9DDD-40c7-A58F-AF0E7916848C}" = HPPhotoGadget
"{5BD0CB24-11AF-4BA8-A198-38D25257C656}" = LightScribe Template Labeler
"{61EDBE71-5D3E-4AB7-AD95-E53FEAF68C17}" = Bing Rewards Client Installer
"{6423EF83-6E1D-4D22-A36F-689CD19FD4D2}" = Juno Preloader
"{64B9E2F5-558E-4C56-B419-A1679518F6E7}" = HP Customer Experience Enhancements
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{6B976ADF-8AE8-434E-B282-A06C7F624D2F}" = Python 2.5.2
"{6EED4269-588D-45b8-A80C-26A9CA62EE4E}" = HPSSupply
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A43E42-3658-4DD9-8551-FACDA3632538}" = HP Advisor
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{7F10292C-A190-4176-A665-A1ED3478DF86}" = LightScribe System Software
"{800E784D-53E3-4948-B491-9E7FA5EACBDC}" = SmartWebPrinting
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers 1.10.01
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9603DE6D-4567-4b78-B941-849322373DE2}" = SolutionCenter
"{9CCCFD9C-248F-47FE-9496-1680E3E5C163}" = Scan
"{9D1B99B7-DAD8-440d-B4FB-1915332FBCC2}" = HPProductAssistant
"{A0640EC2-B97E-4FC1-AD14-227C9E386BB4}" = HP Recovery Manager RSS
"{A2016015-8323-4AF8-8B3E-F56239D7D59D}" = HP Demo
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.3
"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library
"{d281ba0e-1617-4a62-bb37-b73671035e36}" = DJ_AIO_05_F4400_Software_Min
"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE Creature Creator Trial Edition
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{EFC5939F-470F-454E-B3DA-F51FDD83F6CE}" = HP MediaSmart SmartMenu
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F648FD09-7CEA-4257-BC68-A8389189FD51}" = GPBaseService2
"{F769B78E-FF0E-4db5-95E2-9F4C8D6352FE}" = DeviceDiscovery
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast" = avast! Free Antivirus
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"conduitEngine" = Conduit Engine
"DailyBibleGuideIEbar Uninstall" = DailyBibleGuide
"ESET Online Scanner" = ESET Online Scanner v3
"HOMESTUDENTR" = Microsoft Office Home and Student 2007 Trial
"HP Imaging Device Functions" = HP Imaging Device Functions 12.0
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 12.0
"HPExtendedCapabilities" = HP Customer Participation Program 12.0
"Imikimi Plugin" = Imikimi Plugin
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
"PageRage Toolbar" = PageRage Toolbar
"PC-Doctor for Windows" = Hardware Diagnostic Tools
"Shop for HP Supplies" = Shop for HP Supplies
"sp41099" = sp41099
"sp41121" = sp41121
"sp43115" = sp43115
"TBSB07183.TBSB07183Toolbar" = Fast Browser Search (My Web Tattoo)
"WildTangent hp Master Uninstall" = My HP Games
"Yahoo! Companion" = Yahoo! Toolbar

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/5/2011 9:21:05 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/6/2011 7:25:57 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/6/2011 11:37:18 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/7/2011 12:04:58 AM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/7/2011 11:11:48 AM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/7/2011 12:48:13 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/7/2011 1:36:15 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/9/2011 3:36:41 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/9/2011 4:09:15 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

Error - 4/9/2011 4:40:27 PM | Computer Name = SteveandBeck-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 4/9/2011 6:55:51 PM | Computer Name = SteveandBeck-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 4/9/2011 7:05:52 PM | Computer Name = SteveandBeck-PC | Source = HTTP | ID = 15016
Description =

Error - 4/9/2011 7:07:31 PM | Computer Name = SteveandBeck-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 4/9/2011 9:17:28 PM | Computer Name = SteveandBeck-PC | Source = HTTP | ID = 15016
Description =

Error - 4/9/2011 9:18:03 PM | Computer Name = SteveandBeck-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 4/9/2011 9:21:11 PM | Computer Name = SteveandBeck-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.2 for the Network Card with network
address 00248C5C332D has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 4/10/2011 11:10:14 AM | Computer Name = SteveandBeck-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.254.100 for the Network Card with network
address 00248C5C332D has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 4/10/2011 11:10:20 AM | Computer Name = SteveandBeck-PC | Source = HTTP | ID = 15016
Description =

Error - 4/10/2011 11:11:41 AM | Computer Name = SteveandBeck-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 4/10/2011 11:21:31 AM | Computer Name = SteveandBeck-PC | Source = Service Control Manager | ID = 7011
Description =

< End of report >

Tomk

Post #2April 15, 2011, 4:40 PM UTC

Hi Jcatsmom,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Let's see if we can get this finished up.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Jcatsmom

Post #3April 16, 2011, 12:38 AM UTC

TomK, Thank you so much for taking on this case. Combofix was busy removing a lot of those pesky toolbars. Here is the log:

ComboFix 11-04-14.03 - Steve and Becky Rose 04/15/2011 19:21:18.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2942.1703 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
/wow section - STAGE 3
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\IE\1.bat
c:\program files\Fast Browser Search\IE\about.html
c:\program files\Fast Browser Search\IE\affid.dat
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\fbsProtection.xml
c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\FBStoolbar.dll
c:\program files\Fast Browser Search\IE\fbstoolbar.jar
c:\program files\Fast Browser Search\IE\fbstoolbar.manifest
c:\program files\Fast Browser Search\IE\icons.bmp
c:\program files\Fast Browser Search\IE\info.txt
c:\program files\Fast Browser Search\IE\local.xml
c:\program files\Fast Browser Search\IE\logobg.bmp
c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
c:\program files\Fast Browser Search\IE\search.bmp
c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe
c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico
c:\program files\Fast Browser Search\IE\SGPU.ico
c:\program files\Fast Browser Search\IE\sgpUpdater.exe
c:\program files\Fast Browser Search\IE\sgpUpdater.xml
c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe
c:\program files\Fast Browser Search\IE\tbhelper.dll
c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
c:\program files\Fast Browser Search\IE\Toolbar Help.htm
c:\program files\Fast Browser Search\IE\uninstall.exe
c:\program files\Fast Browser Search\IE\uninstalSGP.exe
c:\program files\Fast Browser Search\IE\uninstalSGPU.exe
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\Fast Browser Search\IE\version.txt
c:\program files\SGPSA
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
c:\users\Public\RemoveSGP.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-03-16 to 2011-04-16 )))))))))))))))))))))))))))))))
.
.
2011-04-16 00:28 . 2011-04-16 00:28 ——– d—–w- c:\users\Steve and Becky Rose\AppData\Local\temp
2011-04-16 00:28 . 2011-04-16 00:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-04-16 00:18 . 2011-04-16 00:19 ——– d—–w- C:\32788R22FWJFW
2011-04-10 17:29 . 2011-04-10 17:29 388096 —-a-r- c:\users\Steve and Becky Rose\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-10 17:29 . 2011-04-10 17:29 ——– d—–w- c:\program files\Trend Micro
2011-04-10 15:55 . 2011-03-23 15:11 6792528 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{00914FFB-E8EE-4DD8-A228-A4AB7CF8FDFB}\mpengine.dll
2011-04-10 15:55 . 2011-02-02 23:11 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-04-10 15:15 . 2011-04-10 15:15 ——– d—–w- c:\programdata\McAfee
2011-04-10 02:02 . 2011-04-10 02:02 ——– d—–w- c:\program files\ESET
2011-04-09 23:52 . 2011-02-23 13:54 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-09 23:52 . 2011-02-23 13:56 371544 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-09 23:52 . 2011-02-23 13:56 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-04-09 23:52 . 2011-02-23 13:55 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-04-09 23:52 . 2011-02-23 13:55 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-04-09 23:52 . 2011-02-23 13:55 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-04-09 23:50 . 2011-02-23 14:04 40648 —-a-w- c:\windows\avastSS.scr
2011-04-09 23:50 . 2011-02-23 14:04 190016 —-a-w- c:\windows\system32\aswBoot.exe
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\programdata\AVAST Software
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\program files\AVAST Software
2011-04-06 00:38 . 2011-04-09 21:03 ——– d—–w- c:\programdata\hDi16633aDmHe16633
2011-03-26 19:43 . 2011-03-26 19:43 ——– d—–w- c:\program files\Conduit
2011-03-26 19:43 . 2011-03-26 19:43 ——– d—–w- c:\users\Steve and Becky Rose\AppData\Local\Conduit
2011-03-26 19:43 . 2011-03-26 19:43 ——– d—–w- c:\program files\PageRage
2011-03-26 19:42 . 2011-03-26 19:42 ——– d—–w- c:\program files\Yontoo Layers
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9517d6a5-a627-48a7-bb03-f240c85d1b04}"= "c:\program files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll" [2011-02-12 60416]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\prxtbPage.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{9517d6a5-a627-48a7-bb03-f240c85d1b04}]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 21:54 175912 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
2011-01-17 21:54 175912 —-a-w- c:\program files\PageRage\prxtbPage.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca5306dd-361c-4291-bee3-9e0a9d9e5cb6}]
2011-02-12 04:53 60416 —-a-w- c:\program files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8d716f2-aa5c-4406-9c39-c8ff582023e6}]
2011-02-12 04:53 702464 —-a-w- c:\progra~1\DAILYB~2\bar\1.bin\elbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2011-02-28 22:11 191488 ——w- c:\program files\Yontoo Layers\YontooIEClient.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1399078b-7eb7-477a-893f-93d4ace22fda}"= "c:\program files\DailyBibleGuideIE\bar\1.bin\elbar.dll" [2011-02-12 702464]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\prxtbPage.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{1399078b-7eb7-477a-893f-93d4ace22fda}]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9565115D-C7D6-46D3-BD63-B67B481A4368}"= "c:\program files\PageRage\prxtbPage.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
"{1399078B-7EB7-477A-893F-93D4ACE22FDA}"= "c:\program files\DailyBibleGuideIE\bar\1.bin\elbar.dll" [2011-02-12 702464]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{1399078b-7eb7-477a-893f-93d4ace22fda}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-08-05 1644088]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\program files\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-27 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-27 92704]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-18 1152296]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-18 189736]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-12-01 1148200]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"DailyBibleGuideIE Browser Plugin Loader"="c:\progra~1\DAILYB~2\bar\1.bin\elbrmon.exe" [2011-02-12 27648]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-05-31 05:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 135664]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/10/12 19:55];c:\program files\Hewlett-Packard\Media\DVD\000.fcl [2008-10-21 21:42 87536]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]
S2 DailyBibleGuideIEService;DailyBibleGuide Service;c:\progra~1\DAILYB~2\bar\1.bin\elbarsvc.exe [2011-02-12 36864]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
2011-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cndt
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-RunServices-go[1] - c:\users\Steve and Becky Rose\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LMJY6ZXS\go[1].exe
HKCU-RunServices-computerpics - c:\users\steve and becky rose\pictures\2009-05-09 brittany and tr's computer pics\brittanypics.exe
HKCU-RunServices-go[2] - c:\users\steve and becky rose\appdata\local\microsoft\windows\temporary internet files\content.ie5\zcmnoyz1\go[2].exe
HKCU-RunServices-msnersrcToolbar - c:\users\Steve and Becky Rose\AppData\Local\Microsoft\MSNE\en-us\msnersrcmsnersrc.exe
HKCU-RunServices-bdaykaylans - c:\users\Steve and Becky Rose\Pictures\2010-07-23 kaylans b-day 10\bdaykaylans.exe
HKCU-RunServices-sp40966stub32i - c:\users\Steve and Becky Rose\Desktop\sp40966stub3226.exe
HKLM-Run-SmartMenu - %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
MSConfigStartUp-go[1] - c:\users\Steve and Becky Rose\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LMJY6ZXS\go[1].exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_07\bin\jusched.exe
AddRemove-sp41099 - c:\hp\Softpaq\sp41099\sp41099.exe
AddRemove-sp41121 - c:\hp\Softpaq\sp41121\sp41121.exe
AddRemove-sp43115 - c:\hp\Softpaq\sp43115\sp43115.exe
AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\progra~2\TARMAI~1\{889DF~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-15 19:28
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-04-15 19:30:23
ComboFix-quarantined-files.txt 2011-04-16 00:30
.
Pre-Run: 224,151,629,824 bytes free
Post-Run: 224,176,848,896 bytes free
.
- - End Of File - - 6509CBEA9872E727CF58923F12A9CA95

Tomk

Post #4April 16, 2011, 12:58 AM UTC

Jcatsmom,

That looks much better.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
Folder::
c:\programdata\McAfee
C:\32788R22FWJFW
c:\program files\Conduit
c:\users\Steve and Becky Rose\AppData\Local\Conduit
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Jcatsmom

Post #5April 16, 2011, 4:19 AM UTC

Tomk, Here's the next combofix log. Thanks for your continued help.

ComboFix 11-04-15.01 - Steve and Becky Rose 04/15/2011 22:59:45.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2942.1829 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Steve and Becky Rose\Desktop\cfscript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Conduit
c:\program files\Conduit\Community Alerts\Alert.dll
c:\programdata\McAfee
c:\programdata\McAfee\MCLOGS\Common\McCHSvc\McCHSvc000.log
c:\programdata\McAfee\MCLOGS\Common\McUICnt\McUICnt000.log
c:\programdata\McAfee\MCLOGS\McLightInstaller\McUICnt\McUICnt000.log
c:\programdata\McAfee\MCLOGS\McUICnt\McUICnt\McUICnt000.log
c:\programdata\McAfee\MCLOGS\PartnerCustom\Au_\Au_000.log
c:\programdata\McAfee\MCLOGS\PartnerCustom\McCHSvc\McCHSvc000.log
c:\programdata\McAfee\MCLOGS\PartnerCustom\McUICnt\McUICnt000.log
c:\programdata\McAfee\MCLOGS\PartnerCustom\SecurityScan_Inner\SecurityScan_Inner000.log
c:\programdata\McAfee\MCLOGS\PartnerCustom\SecurityScan_Release\SecurityScan_Release000.log
c:\programdata\McAfee\MCLOGS\PartnerCustom\SSScheduler\SSScheduler000.log
c:\programdata\McAfee\MCLOGS\SecurityScanner\McUICnt\McUICnt000.log
c:\users\Steve and Becky Rose\AppData\Local\Conduit
c:\users\Steve and Becky Rose\AppData\Local\Conduit\CT2418376\PageRageAutoUpdateHelper.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-03-16 to 2011-04-16 )))))))))))))))))))))))))))))))
.
.
2011-04-16 04:05 . 2011-04-16 04:05 ——– d—–w- c:\users\Steve and Becky Rose\AppData\Local\temp
2011-04-16 04:05 . 2011-04-16 04:05 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-04-16 03:22 . 2011-03-23 15:11 6792528 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7FDE8C2C-6A8C-462B-BC1A-DC4B3DDBCB3A}\mpengine.dll
2011-04-10 17:29 . 2011-04-10 17:29 388096 —-a-r- c:\users\Steve and Becky Rose\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-10 17:29 . 2011-04-10 17:29 ——– d—–w- c:\program files\Trend Micro
2011-04-10 15:55 . 2011-02-02 23:11 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-04-10 02:02 . 2011-04-10 02:02 ——– d—–w- c:\program files\ESET
2011-04-09 23:52 . 2011-02-23 13:54 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-09 23:52 . 2011-02-23 13:56 371544 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-09 23:52 . 2011-02-23 13:56 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-04-09 23:52 . 2011-02-23 13:55 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-04-09 23:52 . 2011-02-23 13:55 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-04-09 23:52 . 2011-02-23 13:55 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-04-09 23:50 . 2011-02-23 14:04 40648 —-a-w- c:\windows\avastSS.scr
2011-04-09 23:50 . 2011-02-23 14:04 190016 —-a-w- c:\windows\system32\aswBoot.exe
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\programdata\AVAST Software
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\program files\AVAST Software
2011-04-06 00:38 . 2011-04-09 21:03 ——– d—–w- c:\programdata\hDi16633aDmHe16633
2011-03-26 19:43 . 2011-03-26 19:43 ——– d—–w- c:\program files\ConduitEngine
2011-03-26 19:43 . 2011-03-26 19:43 ——– d—–w- c:\program files\PageRage
2011-03-26 19:42 . 2011-03-26 19:42 ——– d—–w- c:\program files\Yontoo Layers
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9517d6a5-a627-48a7-bb03-f240c85d1b04}"= "c:\program files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll" [2011-02-12 60416]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\prxtbPage.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{9517d6a5-a627-48a7-bb03-f240c85d1b04}]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 21:54 175912 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
2011-01-17 21:54 175912 —-a-w- c:\program files\PageRage\prxtbPage.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca5306dd-361c-4291-bee3-9e0a9d9e5cb6}]
2011-02-12 04:53 60416 —-a-w- c:\program files\DailyBibleGuideIE\bar\1.bin\elSrcAs.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8d716f2-aa5c-4406-9c39-c8ff582023e6}]
2011-02-12 04:53 702464 —-a-w- c:\progra~1\DAILYB~2\bar\1.bin\elbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2011-02-28 22:11 191488 ——w- c:\program files\Yontoo Layers\YontooIEClient.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1399078b-7eb7-477a-893f-93d4ace22fda}"= "c:\program files\DailyBibleGuideIE\bar\1.bin\elbar.dll" [2011-02-12 702464]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\prxtbPage.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{1399078b-7eb7-477a-893f-93d4ace22fda}]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9565115D-C7D6-46D3-BD63-B67B481A4368}"= "c:\program files\PageRage\prxtbPage.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
"{1399078B-7EB7-477A-893F-93D4ACE22FDA}"= "c:\program files\DailyBibleGuideIE\bar\1.bin\elbar.dll" [2011-02-12 702464]
.
[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{1399078b-7eb7-477a-893f-93d4ace22fda}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-08-05 1644088]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\program files\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-27 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-27 92704]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-18 1152296]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-18 189736]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-12-01 1148200]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"DailyBibleGuideIE Browser Plugin Loader"="c:\progra~1\DAILYB~2\bar\1.bin\elbrmon.exe" [2011-02-12 27648]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-05-31 05:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 135664]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/10/12 19:55];c:\program files\Hewlett-Packard\Media\DVD\000.fcl [2008-10-21 21:42 87536]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]
S2 DailyBibleGuideIEService;DailyBibleGuide Service;c:\progra~1\DAILYB~2\bar\1.bin\elbarsvc.exe [2011-02-12 36864]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
2011-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cndt
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-15 23:05
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-04-15 23:07:02
ComboFix-quarantined-files.txt 2011-04-16 04:06
ComboFix2.txt 2011-04-16 00:30
.
Pre-Run: 223,991,386,112 bytes free
Post-Run: 223,965,134,848 bytes free
.
- - End Of File - - 45B8811D32088C12AB651034AFBEEA14

Tomk

Post #6April 16, 2011, 5:34 AM UTC

Jcatsmom,

Let's get a new online scan:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

I'm not really expecting it to find anything so also please let me know how things seem to be running.

Jcatsmom

Post #7April 16, 2011, 11:57 PM UTC

Hi Tomk, ESET indicates we're not clear yet. C:\Program Files\Yontoo Layers\YontooIEClient.dll Win32/Adware.Yontoo.A application C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(0002c8e9).exe probably a variant of Win32/Toolbar.MyWebSearch.L application C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(0004381f).exe probably a variant of Win32/Toolbar.MyWebSearch.L application C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(000820d8).exe probably a variant of Win32/Toolbar.MyWebSearch.L application Operating memory Win32/Adware.Yontoo.A application The computer is running quite well. It does try to install Windows Solution Center each time the machine starts up, but I don't have that particular disc. On my list of things to do, I need to install Internet Explorer 8 and Vista SP2.

Tomk

Post #8April 17, 2011, 1:25 AM UTC

Jcatsmom,

OK. Your friend may not like this. The adware appears to be embedded on two applications that they have. PageRage and Daily Bible Guide.

You should remove both of them using uninstall programs. Then we'll cleanup with ComboFix.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
Folder::
C:\Users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE
C:\Program Files\Yontoo Layers
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Jcatsmom

Post #9April 17, 2011, 7:09 AM UTC

Removing those programs was not a problem with her. We'd already talked about it and she wants to get rid of the things that are negatively impacting her computer. I hope to find her a replacement program for the bible program. I uninstalled unneeded Bing and Google toolbars while I was at it.

Here's the Combofix log
ComboFix 11-04-16.01 - Steve and Becky Rose 04/17/2011 1:45.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2942.1765 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Steve and Becky Rose\Desktop\cfscript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Yontoo Layers
c:\program files\Yontoo Layers\YontooIEClient.dll
c:\users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE
c:\users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(0002c8e9).exe
c:\users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(0004381f).exe
c:\users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(000820d8).exe
c:\users\Steve and Becky Rose\AppData\LocalLow\DailyBibleGuideIE\bar\setups\DailyBibleGuide Installer(000e0cad).exe
.
.
((((((((((((((((((((((((( Files Created from 2011-03-17 to 2011-04-17 )))))))))))))))))))))))))))))))
.
.
2011-04-17 06:51 . 2011-04-17 06:52 ——– d—–w- c:\users\Steve and Becky Rose\AppData\Local\temp
2011-04-17 06:51 . 2011-04-17 06:51 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-04-17 06:24 . 2011-02-12 04:53 702464 —-a-w- c:\program files\Uninstall DailyBibleGuide.dll
2011-04-16 03:24 . 2011-02-16 15:29 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-04-16 03:24 . 2011-02-16 13:24 292864 —-a-w- c:\windows\system32\atmfd.dll
2011-04-16 03:22 . 2011-03-23 15:11 6792528 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7FDE8C2C-6A8C-462B-BC1A-DC4B3DDBCB3A}\mpengine.dll
2011-04-16 03:21 . 2011-03-03 10:49 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-10 17:29 . 2011-04-10 17:29 388096 —-a-r- c:\users\Steve and Becky Rose\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-10 17:29 . 2011-04-10 17:29 ——– d—–w- c:\program files\Trend Micro
2011-04-10 15:55 . 2011-02-02 23:11 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-04-10 02:02 . 2011-04-10 02:02 ——– d—–w- c:\program files\ESET
2011-04-09 23:52 . 2011-02-23 13:54 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-09 23:52 . 2011-02-23 13:56 371544 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-09 23:52 . 2011-02-23 13:56 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-04-09 23:52 . 2011-02-23 13:55 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-04-09 23:52 . 2011-02-23 13:55 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-04-09 23:52 . 2011-02-23 13:55 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-04-09 23:50 . 2011-02-23 14:04 40648 —-a-w- c:\windows\avastSS.scr
2011-04-09 23:50 . 2011-02-23 14:04 190016 —-a-w- c:\windows\system32\aswBoot.exe
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\programdata\AVAST Software
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\program files\AVAST Software
2011-04-06 00:38 . 2011-04-09 21:03 ——– d—–w- c:\programdata\hDi16633aDmHe16633
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-08-05 1644088]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\program files\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-27 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-27 92704]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-18 1152296]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-18 189736]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-12-01 1148200]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 135664]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/10/12 19:55];c:\program files\Hewlett-Packard\Media\DVD\000.fcl [2008-10-21 21:42 87536]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
2011-04-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cndt
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{9565115d-c7d6-46d3-bd63-b67b481a4368} - (no file)
BHO-{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - c:\program files\Yontoo Layers\YontooIEClient.dll
WebBrowser-{9565115D-C7D6-46D3-BD63-B67B481A4368} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-17 01:52
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-04-17 01:54:05
ComboFix-quarantined-files.txt 2011-04-17 06:53
ComboFix2.txt 2011-04-16 04:07
ComboFix3.txt 2011-04-16 00:30
.
Pre-Run: 224,932,147,200 bytes free
Post-Run: 224,146,972,672 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - 59C03518EF262A1E2980F406349F3EF4

Tomk

Post #10April 17, 2011, 5:09 PM UTC

Jcatsmom,

You should be good to go.

Time for some housekeeping

Click START then RUN
Now type ComboFix /Uninstall in the runbox and click OK.
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Double click on OTL to run it.
Click on CleanUp!
When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Jcatsmom

Post #11April 19, 2011, 2:05 AM UTC

Tomk, I understand the cleanup procedures and appreciate the resources you attached- particularly those for controlling microsoft downloads. I was already to start the cleanup when I noticed this on opening a new tab in IE 7

"http://tab.fastbrowsersearch.com/?v=18&…F60E031DF6E0%7d"

Does this indicate that fastbrowser search is still present/ active on the computer. I checked add-ons. It shows up there as disabled, but I'm not able to delete it. Please advise. Thanks! Jcatsmom

Tomk

Post #12April 19, 2011, 3:10 AM UTC

Please run me a new set of DDS logs.

Jcatsmom

Post #13April 19, 2011, 2:26 PM UTC

Tomk, here's my DDS log. I re-enabled fast browser add-ons in case that would make a difference in detecting them.- Jcatsmom
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 9:21:47.44 on Tue 04/19/2011
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2942.1813 [GMT -5:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Windows\system32\msiexec.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\wbem\wmiprvse.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Hewlett-Packard\KBD\kbd.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Steve and Becky Rose\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cndt
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Fast Browser Search Toolbar Helper: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\fast browser search\ie\FBStoolbar.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Fast Browser Search Toolbar: {1bb22d38-a411-4b13-a746-c2a4f4ec7344} - c:\program files\fast browser search\ie\FBStoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] c:\program files\hewlett-packard\kbd\KbdStub.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\cyberlink dvd suite deluxe\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\cyberlink dvd suite deluxe" updatewithcreateonce "software\cyberlink\PowerStarter"
mRun: [TSMAgent] "c:\program files\hewlett-packard\touchsmart\media\TSMAgent.exe"
mRun: [CLMLServer for HP TouchSmart] "c:\program files\hewlett-packard\touchsmart\media\kernel\clml\CLMLSvc.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [DVDAgent] "c:\program files\hewlett-packard\media\dvd\DVDAgent.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-9 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-4-9 307288]
R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/10/12 19:55:40];c:\program files\hewlett-packard\media\dvd\000.fcl [2008-10-21 87536]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-4-9 19544]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-4-9 53592]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-4-9 42184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-29 135664]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-04-17 06:54:10 ——– d-sh–w- C:\$RECYCLE.BIN
2011-04-17 06:54:07 ——– d—–w- c:\users\stevea~1\appdata\local\temp
2011-04-17 06:42:04 ——– d—–w- C:\ComboFix
2011-04-16 03:24:01 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-04-16 03:24:01 292864 —-a-w- c:\windows\system32\atmfd.dll
2011-04-16 03:22:26 6792528 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{7fde8c2c-6a8c-462b-bc1a-dc4b3ddbcb3a}\mpengine.dll
2011-04-16 03:21:13 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat
2011-04-16 00:19:27 98816 —-a-w- c:\windows\sed.exe
2011-04-16 00:19:27 89088 —-a-w- c:\windows\MBR.exe
2011-04-16 00:19:27 256512 —-a-w- c:\windows\PEV.exe
2011-04-16 00:19:27 161792 —-a-w- c:\windows\SWREG.exe
2011-04-10 17:29:20 388096 —-a-r- c:\users\stevea~1\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-10 17:29:19 ——– d—–w- c:\program files\Trend Micro
2011-04-10 15:55:36 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-04-10 02:02:55 ——– d—–w- c:\program files\ESET
2011-04-09 23:52:05 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-09 23:52:04 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-04-09 23:50:38 40112 —-a-w- c:\windows\avastSS.scr
2011-04-09 23:50:19 ——– d—–w- c:\program files\AVAST Software
2011-04-09 23:50:19 ——– d—–w- c:\progra~2\AVAST Software
2011-04-06 00:38:57 ——– d—–w- c:\progra~2\hDi16633aDmHe16633
.
==================== Find3M ====================
.
2011-03-10 16:12:54 1161728 —-a-w- c:\windows\system32\mfc42u.dll
2011-03-10 16:12:54 1136640 —-a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:00:15 738816 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-03 12:53:48 2040832 —-a-w- c:\windows\system32\win32k.sys
2011-03-02 14:49:43 86528 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-02-18 15:48:42 833024 —-a-w- c:\windows\system32\wininet.dll
2011-02-18 15:45:02 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-02-18 14:09:54 389632 —-a-w- c:\windows\system32\html.iec
2011-02-18 13:48:10 1383424 —-a-w- c:\windows\system32\mshtml.tlb
2011-02-16 15:35:41 430080 —-a-w- c:\windows\system32\vbscript.dll
.
============= FINISH: 9:22:14.93 ===============

Tomk

Post #14April 19, 2011, 3:42 PM UTC

yeppers… it's right back where we removed it from.

Looks like you still have ComboFix so we'll use it again.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

DDS::
BHO: Fast Browser Search Toolbar Helper: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\fast browser search\ie\FBStoolbar.dll
TB: Fast Browser Search Toolbar: {1bb22d38-a411-4b13-a746-c2a4f4ec7344} - c:\program files\fast browser search\ie\FBStoolbar.dll

Folder::
c:\program files\fast browser search

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Jcatsmom

Post #15April 19, 2011, 4:31 PM UTC

Tomk,
Here's hoping:

ComboFix 11-04-18.04 - Steve and Becky Rose 04/19/2011 10:59:57.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2942.1818 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Steve and Becky Rose\Desktop\cfscript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-19 to 2011-04-19 )))))))))))))))))))))))))))))))
.
.
2011-04-19 16:05 . 2011-04-19 16:05 ——– d—–w- c:\users\Steve and Becky Rose\AppData\Local\temp
2011-04-19 16:05 . 2011-04-19 16:05 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-04-19 14:39 . 2011-04-11 07:04 7071056 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BC1D38EA-F8CD-4498-A334-92EC8027F384}\mpengine.dll
2011-04-16 03:24 . 2011-02-16 15:29 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-04-16 03:24 . 2011-02-16 13:24 292864 —-a-w- c:\windows\system32\atmfd.dll
2011-04-16 03:21 . 2011-03-03 10:49 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-10 17:29 . 2011-04-10 17:29 388096 —-a-r- c:\users\Steve and Becky Rose\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-10 17:29 . 2011-04-10 17:29 ——– d—–w- c:\program files\Trend Micro
2011-04-10 15:55 . 2011-02-02 23:11 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-04-10 02:02 . 2011-04-10 02:02 ——– d—–w- c:\program files\ESET
2011-04-09 23:52 . 2011-04-18 17:12 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-09 23:52 . 2011-04-18 17:17 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-09 23:52 . 2011-04-18 17:17 307288 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-04-09 23:52 . 2011-04-18 17:16 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-04-09 23:52 . 2011-04-18 17:13 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-04-09 23:52 . 2011-04-18 17:13 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-04-09 23:50 . 2011-04-18 17:25 40112 —-a-w- c:\windows\avastSS.scr
2011-04-09 23:50 . 2011-04-18 17:25 199304 —-a-w- c:\windows\system32\aswBoot.exe
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\programdata\AVAST Software
2011-04-09 23:50 . 2011-04-09 23:50 ——– d—–w- c:\program files\AVAST Software
2011-04-06 00:38 . 2011-04-09 21:03 ——– d—–w- c:\programdata\hDi16633aDmHe16633
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-04-18 17:25 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-08-05 1644088]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\program files\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-27 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-27 92704]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-18 1152296]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-18 189736]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-12-01 1148200]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 135664]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/10/12 19:55];c:\program files\Hewlett-Packard\Media\DVD\000.fcl [2008-10-21 21:42 87536]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-04-18 53592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
2011-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cndt
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-19 11:05
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-04-19 11:07:21
ComboFix-quarantined-files.txt 2011-04-19 16:07
ComboFix2.txt 2011-04-17 06:54
ComboFix3.txt 2011-04-16 04:07
ComboFix4.txt 2011-04-16 00:30
.
Pre-Run: 224,419,414,016 bytes free
Post-Run: 224,394,633,216 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - CFEF52A7C9127524760D815779B041B8

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

MS Recovery fake alert and other malware

✨ Ask AI

Ask AI