What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HELP. my Windows 7 crashed

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I removed over 300 maleware objects prior to running Hijackthis. This is my results from Hijackthis: I would appreciate any help you can give. :pullhair:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:11:22 AM, on 4/24/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\helppane.exe
C:\Program Files\Security\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 1\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a…&tbid=60186
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchElf 1.1 Toolbar - {00f2c0c6-2194-484e-9064-44e57787867b} - C:\Program Files\SearchElf_1.1\tbSear.dll
R3 - URLSearchHook: (no name) - {27ef9ca8-4d9c-4042-8158-303ae1b49cb5} - (no file)
R3 - URLSearchHook: YTNavAssist.YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTNavAssist.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: InstaCodeToolBar - {6f56ef32-48e7-4a06-b802-e41206a510b0} - C:\Program Files\JBR Media Ventures\InstaCodes ToolBar Installer\adxloader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll
O3 - Toolbar: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - (no file)
O3 - Toolbar: SearchElf 1.1 Toolbar - {00f2c0c6-2194-484e-9064-44e57787867b} - C:\Program Files\SearchElf_1.1\tbSear.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: InstaCode Toolbar - {37646f8d-131d-4016-8fa7-ecdaa82c07a5} - C:\Program Files\JBR Media Ventures\InstaCodes ToolBar Installer\adxloader.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [LXCICATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCItime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files\Citrix\ICA Client\concentr.exe" /startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PC Pitstop Diskmd3 Reminder] C:\Program Files\PCPitstop\DiskMD3\Reminder-Diskmd3.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Program Files\NOS\bin\getPlusUninst_Adobe.exe" /Get1noarp
O4 - HKLM\..\RunOnce: [BrandClearStubs] RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{434e0f87-9138-4235-acb0-7977fc122b52}
O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Magellan CmTray] C:\Program Files\Content Manager\CmTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [osk.exe] osk.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [osk.exe] osk.exe (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} (LSICapture Control) - http://www.link-systems.com/sdkhtml/SDK/paste/lsiw9x.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} (CAScanner Control) - http://cainternetsecurity.net/scanner/cascanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - (no file)
O18 - Protocol: rebinfo - {AF808758-C780-404C-A4EE-4526323FD9B6} - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Update Service (gupdate1ca0a7e9544d6b9) (gupdate1ca0a7e9544d6b9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxci_device - - C:\Windows\system32\lxcicoms.exe
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9582 bytes
Post #2 last edited
I was told on the Windows Forum, to use this forum for Malware problems. I have cleared a lot of the maleware but someone there thinks I still have more. I know you are busy and this is a holiday weekend. I found a post for problems with Win 7 that recommended running DDS. I loaded that and here is the results: All help is appreciated. . DDS (Ver_11-03-05.01) - NTFSx86 NETWORK Run by [removed] at 16:27:52.10 on Sun 04/24/2011 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_22 . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\Explorer.EXE C:\Windows\system32\ctfmon.exe C:\Windows\system32\ctfmon.exe C:\Program Files\Security\Trend Micro\HiJackThis\HiJackThis.exe C:\Program Files\Mozilla Firefox 4.0 Beta 1\firefox.exe C:\Program Files\Adobe\Reader 9.0\Reader\Eula.exe C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe C:\Program Files\Java\jre6\bin\java.exe C:\Windows\system32\conhost.exe C:\Windows\system32\prevhost.exe C:\Program Files\Windows Media Player\wmprph.exe C:\Windows\explorer.exe C:\Downloads\dds.com C:\Windows\system32\conhost.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ uSearch Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60186 uInternet Settings,ProxyOverride = ;*.local uURLSearchHooks: SearchElf 1.1 Toolbar: {00f2c0c6-2194-484e-9064-44e57787867b} - c:\program files\searchelf_1.1\tbSear.dll uURLSearchHooks: H - No File uURLSearchHooks: YTNavAssist.YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn2\YTNavAssist.dll mURLSearchHooks: SearchElf 1.1 Toolbar: {00f2c0c6-2194-484e-9064-44e57787867b} - c:\program files\searchelf_1.1\tbSear.dll mURLSearchHooks: H - No File mWinlogon: Userinit=userinit.exe, BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: InstaCodeToolBar: {6f56ef32-48e7-4a06-b802-e41206a510b0} - c:\program files\jbr media ventures\instacodes toolbar installer\adxloader.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn2\YTSingleInstance.dll TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File TB: SearchElf 1.1 Toolbar: {00f2c0c6-2194-484e-9064-44e57787867b} - c:\program files\searchelf_1.1\tbSear.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll TB: InstaCode Toolbar: {37646f8d-131d-4016-8fa7-ecdaa82c07a5} - c:\program files\jbr media ventures\instacodes toolbar installer\adxloader.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File TB: {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No File TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File TB: {27EF9CA8-4D9C-4042-8158-303AE1B49CB5} - No File uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet uRun: [Magellan CmTray] c:\program files\content manager\CmTray.exe mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot mRun: [LXCICATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCItime.dll,_RunDLLEntry@16 mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startup mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [PC Pitstop Diskmd3 Reminder] c:\program files\pcpitstop\diskmd3\Reminder-Diskmd3.exe mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript mRunOnce: [Uninstall Adobe Download Manager] "c:\program files\nos\bin\getPlusUninst_Adobe.exe" /Get1noarp mRunOnce: [BrandClearStubs] RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{434e0f87-9138-4235-acb0-7977fc122b52} mRunOnce: [GrpConv] grpconv.exe -o dRunOnce: [osk.exe] osk.exe dRunOnce: [Application Restart #0] c:\windows\system32\osk.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mif5ba~1\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL Trusted Zone: ornlfcu.com\auth Trusted Zone: peopletopeople.com\postenroll Trusted Zone: phoenix.edu\axiaecampus Trusted Zone: squaretrade.com\www DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} - hxxp://www.link-systems.com/sdkhtml/SDK/paste/lsiw9x.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: igfxcui - igfxdev.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\becky\appdata\roaming\mozilla\firefox\profiles\7bjdi0of.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p= FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll FF - plugin: c:\progra~1\sonyon~1\npsoe.dll FF - plugin: c:\progra~1\sonyon~1\npsoeact.dll FF - plugin: c:\program files\common files\motive\npMotive.dll FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\google updater\2.4.1636.7222\npCIDetect13.dll FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\np_gp.dll FF - plugin: c:\program files\musicnotes\npmusicn.dll FF - plugin: c:\program files\musicnotes\NPSibelius.dll FF - plugin: c:\program files\nos\bin\np_gp.dll FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll FF - plugin: c:\program files\sony\media go\npmediago.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\users\becky\appdata\local\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll . —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - true ============= SERVICES / DRIVERS =============== . R? b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 R? BBSvc;Bing Bar Update Service R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86 R? cpudrv;cpudrv R? cpuz132;cpuz132 R? ctxusbm;Citrix USB Monitor Driver R? DrvAgent32;DrvAgent32 R? FreeAgentGoNext Service;Seagate Service R? fssfltr;fssfltr R? fsssvc;Windows Live Family Safety Service R? gupdate1ca0a7e9544d6b9;Google Update Service (gupdate1ca0a7e9544d6b9) R? lxci_device;lxci_device R? MpFilter;Microsoft Malware Protection Driver R? MpKsl0d6eb8ae;MpKsl0d6eb8ae R? MpKsl24dce118;MpKsl24dce118 R? MpKsl26f01a05;MpKsl26f01a05 R? MpKsl3caefbdf;MpKsl3caefbdf R? MpKsl54381d9c;MpKsl54381d9c R? MpKsl62ed5c0e;MpKsl62ed5c0e R? MpKslac5b598f;MpKslac5b598f R? MpKsldc0525ca;MpKsldc0525ca R? MpKslf2bdb23e;MpKslf2bdb23e R? MpKslfc49f877;MpKslfc49f877 R? MpNWMon;Microsoft Malware Protection Network Driver R? NisDrv;Microsoft Network Inspection System R? NisSrv;Microsoft Network Inspection R? nosGetPlusHelper;getPlus® Helper 3004 R? PCPitstop Scheduling;PCPitstop Scheduling R? RdpVideoMiniport;Remote Desktop Video Miniport Driver R? spxk;spxk R? Synth3dVsc;Synth3dVsc R? TsUsbFlt;TsUsbFlt R? tsusbhub;tsusbhub R? VGPU;VGPU R? WatAdminSvc;Windows Activation Technologies Service . =============== Created Last 30 ================ . 2011-04-24 05:50:09 ——– d—–w- c:\windows\system32\MpEngineStore 2011-04-23 18:57:05 ——– d—–w- C:\rei 2011-04-23 18:57:00 ——– d—–w- c:\program files\Reimage 2011-04-23 17:47:39 32592 —-a-w- c:\program files\mozilla firefox\plugins\np_gp.dll 2011-04-23 17:11:20 0 —-a-w- c:\users\becky\appdata\local\Vfedoqaxal.bin 2011-04-23 17:11:17 ——– d—–w- c:\users\becky\appdata\local\{96B9489C-6E7D-4E1F-BE71-1F0CA211BD52} 2011-04-23 14:02:27 28752 —-a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{67a20303-847c-46a7-beef-62b5beb04d3f}\MpKsl0d6eb8ae.sys 2011-04-23 14:01:50 7071056 —-a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{67a20303-847c-46a7-beef-62b5beb04d3f}\mpengine.dll 2011-04-23 03:11:16 ——– d—–w- C:\divx 2011-04-22 13:41:33 161792 —-a-w- c:\windows\system32\d3d10_1.dll 2011-04-22 03:14:20 ——– d—–w- c:\users\becky\appdata\local\DDMSettings 2011-04-22 03:08:56 ——– d—–w- c:\program files\common files\PX Storage Engine 2011-04-22 03:07:03 ——– d—–w- c:\program files\common files\DivX Shared 2011-04-22 02:53:41 ——– d—–w- c:\program files\DivX 2011-04-22 02:48:24 ——– d—–w- c:\progra~2\DivX 2011-04-16 22:16:03 ——– d—–w- c:\program files\Content Manager 2011-04-13 01:52:42 2333184 —-a-w- c:\windows\system32\win32k.sys 2011-04-13 01:52:40 191488 —-a-w- c:\windows\system32\FXSCOVER.exe 2011-04-13 01:52:38 288256 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2011-04-13 01:52:36 741376 —-a-w- c:\windows\system32\inetcomm.dll 2011-04-13 01:52:21 69632 —-a-w- c:\windows\system32\drivers\bowser.sys 2011-04-13 01:52:21 123904 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-04-13 01:52:20 96768 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2011-04-13 01:52:20 223232 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-04-13 01:52:16 1137664 —-a-w- c:\windows\system32\mfc42.dll 2011-04-13 01:52:15 1164288 —-a-w- c:\windows\system32\mfc42u.dll 2011-04-13 01:52:06 310272 —-a-w- c:\windows\system32\drivers\srv2.sys 2011-04-13 01:52:05 311808 —-a-w- c:\windows\system32\drivers\srv.sys 2011-04-13 01:52:04 114176 —-a-w- c:\windows\system32\drivers\srvnet.sys 2011-04-13 01:51:45 132608 —-a-w- c:\windows\system32\dnsrslvr.dll 2011-04-13 01:51:44 28672 —-a-w- c:\windows\system32\dnscacheugc.exe 2011-04-13 01:51:35 34304 —-a-w- c:\windows\system32\atmlib.dll 2011-04-13 01:51:35 294912 —-a-w- c:\windows\system32\atmfd.dll 2011-04-08 12:14:03 ——– d-sh–w- c:\windows\system32\%APPDATA% 2011-04-07 18:42:35 ——– d—–w- c:\windows\system32\SPReview 2011-04-07 18:27:59 505856 —-a-w- c:\windows\system32\taskschd.dll 2011-04-07 18:26:59 80384 —-a-w- c:\windows\system32\davclnt.dll 2011-04-07 18:25:59 327680 —-a-w- c:\windows\system32\zipfldr.dll 2011-04-07 18:24:59 516096 —-a-w- c:\program files\windows mail\wab.exe 2011-04-07 18:23:59 10240 —-a-w- c:\windows\system32\drivers\acpipmi.sys 2011-04-07 18:22:02 780288 —-a-w- c:\windows\system32\wbem\wbemcore.dll 2011-04-07 18:22:01 363008 —-a-w- c:\windows\system32\wbemcomn.dll 2011-04-07 18:22:00 606208 —-a-w- c:\windows\system32\wbem\fastprox.dll 2011-04-07 18:21:59 351232 —-a-w- c:\windows\system32\wmicmiplugin.dll 2011-04-07 18:21:37 697344 —-a-w- c:\windows\system32\SmiEngine.dll 2011-04-07 18:21:21 209920 —-a-w- c:\windows\system32\PkgMgr.exe 2011-04-07 18:21:21 189952 —-a-w- c:\windows\system32\wdscore.dll 2011-04-07 18:19:06 323072 —-a-w- c:\windows\system32\drvstore.dll 2011-04-07 18:19:05 257024 —-a-w- c:\windows\system32\dpx.dll 2011-04-06 23:21:35 439632 ——w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{003e3556-4188-4752-9ece-93d3e03e3a6a}\gapaengine.dll 2011-03-31 23:38:06 ——– d—–w- c:\users\becky\appdata\local\assembly 2011-03-31 23:36:51 ——– d—–w- c:\users\becky\appdata\local\Conduit 2011-03-26 00:57:31 439632 ——w- c:\progra~2\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll . ==================== Find3M ==================== . 2011-04-07 19:09:54 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-03-21 06:20:27 1146876 —-a-w- c:\progra~2\SPLDC4B.tmp 2011-02-19 06:30:54 805376 —-a-w- c:\windows\system32\FntCache.dll 2011-02-19 06:30:51 1076736 —-a-w- c:\windows\system32\DWrite.dll 2011-02-19 06:30:50 739840 —-a-w- c:\windows\system32\d2d1.dll . ============= FINISH: 16:30:34.68 =============== . ==== End Of File =========================== Please let me know what I need to do next. Thank you.
Post #3 last edited
This is the zipped Attach file from the DDS. Thank you again for your help. Tuesday 4/26: Can anyone help me with this? It has been 3 days and not one reply. You know what it is like not to be able to use your computer. Please tell me what I should do next. I am about to run HiJackThis again and let it fix everything. IF you have questions let me know. I am running in safe mode with networking.

Attachments:

  • [attachment removed: Attach_bkolt_042411.zip]
Post #4
Hi bkolt,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please don't "fix" everything in HJT… as this will result in a machine that won't run. :pullhair:

Please give this a go:

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #5
TomK, I have downloaded the comboFix. My anti maleware and security programs are not running in safe mode. When I tried to run this ComboFix it goes to a blue screen full of text that I don't have time to read and shuts the computer down. It comes back to the black screen to boot in safe mode. :pullhair: Tried it again, same result bkolt
Post #7
TomK, I already tried that. Still went to blue screen quicker than you could say Oh Snap!. "Windows is shutting down to…." gone.
Post #8
Then let's give this a go…

Do not reboot your computer after running rkill as the malware programs will start again.

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 5 different versions. If one of them won't run then download and try to run the other one. If you get a popup warning you that the file you are trying to run is infected, leave the warning open and run the file again.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.
  • rkill.exe
  • rkill.com
  • rkill.scr
  • WiNlOgOn.exe
  • uSeRiNiT.exe

Do not reboot your computer after running rkill as the malware programs will start again.

===================================================

Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)

===================================================

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Post #9
Hello, TomK, I tried to run all of the Rkill applications and every one caused the computer to shut down. First it went to the blue screen full of text and then it was gone. I downloaded Malwarebytes again and ran it. the text file is below. I also ran the exehelper and that file is also below. I still cannot boot up in normal mode. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6459 Windows 6.1.7601 Service Pack 1 (Safe Mode) Internet Explorer 9.0.8112.16421 4/27/2011 6:45:31 PM mbam-log-2011-04-27 (18-45-31).txt Scan type: Quick scan Objects scanned: 207460 Time elapsed: 11 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 9 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swreg.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swsc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe (Security.Hijack) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Windows\Temp\tbjg\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\downloads\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. c:\downloads\WiNlOgOn.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. ******************************************************************************** ******************************************** exeHelper by Raktor Build 20100414 Run at 17:39:52 on 04/27/11 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished– exeHelper by Raktor Build 20100414 Run at 18:54:07 on 04/27/11 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished–
Post #10
bkolt,

Something really isn't working right with that system…. please give this online system a try:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #11 last edited
TomK, I am running the ESET online scanner. It has been going for about 2 1/.2 hours. so far it has found 9 infected files. The list says Win32/RegistryBooster application, Win32/AdInstaller application and a variant of Win32/SweetIM.B application. The scan is almost finished. It is scanning Windows folder now. I will post the file when it finishes. we have had severe storms here all evening. Fortunately, we did not lose power. I am using my ACER to answer this thread while it is running. Thursday Morning: The scan finished and found 34 threats. Here is the txt file it produced. For some reason I cannot attach files, so I am pasting it here: What do I do next? C:\Program Files\Uniblue\RegistryBooster\Launcher.exe Win32/RegistryBooster application C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe Win32/RegistryBooster application C:\Program Files\Uniblue\RegistryBooster\rbnotifier.exe Win32/RegistryBooster application C:\Program Files\Uniblue\RegistryBooster\rb_move_serial.exe Win32/RegistryBooster application C:\Program Files\Uniblue\RegistryBooster\rb_track_install.exe Win32/RegistryBooster application C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe Win32/RegistryBooster application C:\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.17.exe Win32/AdInstaller application C:\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.2.exe Win32/AdInstaller application C:\Users\Becky\Videos\Games\Facemoods.exe a variant of Win32/SweetIM.B application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL Win32/Toolbar.MyWebSearch application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL Win32/Adware.FunWeb application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL Win32/Adware.FunWeb application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL Win32/Toolbar.MyWebSearch.B application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL Win32/Toolbar.MyWebSearch application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL Win32/Toolbar.MyWebSearch application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL Win32/Adware.FunWeb application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR Win32/Toolbar.MyWebSearch application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL Win32/Toolbar.MyWebSearch.D application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL Win32/Toolbar.MyWebSearch application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE Win32/Adware.FunWeb application F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\M3TPINST.DLL a variant of Win32/Toolbar.MyWebSearch.I application F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\Launcher.exe Win32/RegistryBooster application F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\rbmonitor.exe Win32/RegistryBooster application F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\rbnotifier.exe Win32/RegistryBooster application F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\rb_move_serial.exe Win32/RegistryBooster application F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\rb_track_install.exe Win32/RegistryBooster application F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\registrybooster.exe Win32/RegistryBooster application F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.17.exe Win32/AdInstaller application F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.2.exe Win32/AdInstaller application F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Videos\Games\Facemoods.exe a variant of Win32/SweetIM.B application F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\f29bcdf-52fbb824 multiple threats F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\232ff0c5-2e4a302c multiple threats
Post #12
bkolt,

Sorry, I missed your edit.

The majority of found threats are on your backup… but we wouldn't want you to restore them so we'll nuke them. :)

Please download the OTM by OldTimer.
  • Save it to your desktop.
  • Please double-click OTM.exe to run it.
    (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes

:Files
F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache
F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster
F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch
C:\Program Files\Uniblue\RegistryBooster
F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Videos\Games\Facemoods.exe
F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.2.exe
F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.17.exe
F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\riched20.dll 
F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\msimg32.dll
C:\Users\Becky\Videos\Games\Facemoods.exe
C:\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.2.exe
C:\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.17.exe
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Those are all adware so I'd be surprised if this clears up your trouble.

Do you have your Operating system disks?
Post #13
TomK, How did my backup get so infected? All this because I tried to download Lord of the Rings! Also I am running Win 7 ultimate and I do not have original disks. I do not even know what the key is. I received this version at the Win 7 launch party and the guy installed it for me. He did not give me a CD. I have 2 Win 7 repair disks and a Win 7 recovery disk.
Post #14
All processes killed ========== PROCESSES ========== ========== FILES ========== F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully. F:\Seagate Backup\ADMIN-PC\History\Level2\C\Users\Becky\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\xt\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\xt folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\xs\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\xs folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\tr\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\tr folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\se\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\se folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\ru\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\ru folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\pt\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\pt folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\pl\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\pl folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\no\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\no folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\nl\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\nl folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\jp\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\jp folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\it\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\it folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\gr\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\gr folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\fr\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\fr folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\fi\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\fi folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\es\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\es folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\en\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\en folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\dk\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\dk folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\de\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\de folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\br\LC_MESSAGES folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale\br folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster\locale folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\Uniblue\RegistryBooster folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\Settings folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\Overlay folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\Notifier folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\Message folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\icons folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\Game folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\Avatar folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin\chrome folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar\1.bin folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch\bar folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Program Files\MyWebSearch folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\xt\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\xt folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\xs\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\xs folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\tr\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\tr folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\se\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\se folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\ru\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\ru folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\pt\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\pt folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\pl\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\pl folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\no\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\no folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\nl\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\nl folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\jp\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\jp folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\it\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\it folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\gr\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\gr folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\fr\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\fr folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\fi\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\fi folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\es\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\es folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\en\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\en folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\dk\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\dk folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\de\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\de folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\br\LC_MESSAGES folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale\br folder moved successfully. C:\Program Files\Uniblue\RegistryBooster\locale folder moved successfully. C:\Program Files\Uniblue\RegistryBooster folder moved successfully. F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Videos\Games\Facemoods.exe moved successfully. F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.2.exe moved successfully. F:\Seagate Backup\ADMIN-PC\C\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.17.exe moved successfully. DllUnregisterServer procedure not found in F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\riched20.dll F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\riched20.dll moved successfully. DllUnregisterServer procedure not found in F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\msimg32.dll F:\Seagate Backup\ADMIN-PC\C\Program Files\Windows Live\Messenger\msimg32.dll moved successfully. C:\Users\Becky\Videos\Games\Facemoods.exe moved successfully. C:\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.2.exe moved successfully. C:\Users\Becky\Desktop\Kollett\Users\becky\Documents\old hard drive\DesktopBK\My Downloads\SmileyCentralSetup2.0.4.17.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Access Printer ->Temp folder emptied: 442969 bytes ->Temporary Internet Files folder emptied: 49023597 bytes ->Java cache emptied: 556351 bytes ->Flash cache emptied: 90759 bytes User: admin ->Temp folder emptied: 376114534 bytes ->Temporary Internet Files folder emptied: 28780340 bytes ->FireFox cache emptied: 84733907 bytes ->Flash cache emptied: 29313 bytes User: All Users User: Anastasia User: Becky ->Temp folder emptied: 8605379 bytes ->Temporary Internet Files folder emptied: 12531123 bytes ->Java cache emptied: 8701577 bytes ->FireFox cache emptied: 75200946 bytes ->Google Chrome cache emptied: 0 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 122809 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 56543 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 438816 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 194583682 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 8662018 bytes Total Files Cleaned = 809.00 mb OTM by OldTimer - Version 3.1.17.2 log created on 04282011_223213
Post #15
Give this a try…

Reboot your computer and tap the F8 key. This should cause the Advanced Boot Options menu to open. Probably the first item on the list says Repair your Computer… select it.

The first item in the next screen should be Startup Repair… select it. Then just follow the prompts (if there are any).

Let me know how it went.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI