What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Windows - Delayed Write Filed

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello k_selvage

Thank you for the logs.

Lets concentrate on cleaning your computer first and once we have taken care of it we'll move on to your storage drive.

  • Unhide


    • Download and run unhide.exe by grinler from here and save the file to your desktop.
    • Run the tool and allow it to complete.
  • aswMBR


    • Download aswMBR.exe to your desktop.
    • Double click the aswMBR.exe to run it.
    • Click the "Scan" button to start scan.

    [external image: Posted Image]

    • On completion of the scan click save log, save it to your desktop and post in your next reply.

    [external image: Posted Image]

Please post the aswMBR log in your next reply and let me know if your files and folders have re-appeared.
Post #17
Oh my gosh - my files and folders have reappeared! :) It's magic - you're a genius! I went through some of the folders, and everything seems to be the way it used to be before the infection. Regarding the aswMBR scan, when I opened the program, a pop-up appeared asking whether I wanted to download the latest Avast! virus definitions. I clicked "no" and here are the results for the aswMBR log: aswMBR version 0.9.7.777 Copyright© 2011 AVAST Software Run date: 2011-07-19 16:46:24 —————————– 16:46:24.171 OS Version: Windows 5.1.2600 Service Pack 3 16:46:24.171 Number of processors: 1 586 0x409 16:46:24.187 ComputerName: DHFXFW91 UserName: 16:46:25.593 Initialize success 16:47:22.452 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 16:47:22.452 Disk 0 Vendor: Maxtor_6L160P0 BAJ41G10 Size: 152587MB BusType: 3 16:47:22.468 Disk 0 MBR read successfully 16:47:22.468 Disk 0 MBR scan 16:47:22.468 Disk 0 unknown MBR code 16:47:22.484 Disk 0 scanning sectors +312496380 16:47:22.593 Disk 0 scanning C:\WINDOWS\system32\drivers 16:47:41.312 Service scanning 16:47:42.718 Disk 0 trace - called modules: 16:47:42.734 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS 16:47:42.734 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8334dab8] 16:47:42.734 3 CLASSPNP.SYS[f8777fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8334bb00] 16:47:42.734 Scan finished successfully 16:48:00.140 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\delbert selvage\Desktop\MBR.dat" 16:48:00.140 The log file has been saved successfully to "C:\Documents and Settings\delbert selvage\Desktop\aswMBR.txt" If you wanted me to click "yes" on downloading the latest Avast! virus definitions, I can re-do the scan and then re-post the log. Let me know what you'd like me to do. Thanks again for making my files and folders reappear! Hopefully, we're one step closer towards disinfecting my maching…
Post #18
Hello k_selvage

my files and folders have reappeared!

:) Glad that got them back. We are indeed another step closer.

Lets continue with the following:


  • Please scan the following files


    • Please go to VirusTotal


    • On the page you'll find a "Browse" button.
    • Click on the Browse button.
    • In the Choose File to Upload window which opens, copy and paste this into the File Name box.


    C:\Documents and Settings\delbert selvage\Desktop\MBR.dat


    • Next, click the Open button.
    • Then click the "Send File" button just below.
    • This will scan the file. Please be patient.
    • If you get a message saying File has already been analyzed: click Reanalyze file now.
    • Once scanned, copy and paste the link to the results page in your next reply.

  • Please perform the following scan:


    • Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.

    • Double click on the mbam-setup.exe icon to install the program.
    • Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
    • Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
    • Click on the "Update" tab and then on "Check for Updates".
    • The program will now install the latest Malware definition files.
    • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
    • Once the program has scanned your computer, a log file will be created in Notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.


    • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
    • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
    • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
    • Come back here to this thread and Paste the log in your next reply.

    Please post the link to the Virus Total results page in your next reply along with the MBAM log.

    Also, please describe exactly how the machine is running now.
Post #19
The VirusTotal link is http://www.virustotal.com/file-scan/report…3967-1311197410.

When I opened up Malwarebytes, a pop-up box appeared that asked whether I wanted to use the full trial version, and I declined it. After running the scan, two files were checked, so I removed them and then had to restart the computer. Here is the log that was created after the scan:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7213

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/20/2011 7:11:30 PM
mbam-log-2011-07-20 (19-11-30).txt

Scan type: Quick scan
Objects scanned: 199460
Time elapsed: 18 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\mdnkso81qq2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Regarding how my computer is running: I still have a balloon that pops up from the taskbar that says, "Your computer might be at risk. McAfee VirusScan is turned off. Click this balloon to fix this problem." It also still says that my Firewall is turned off in the McAfee Total Protection Firewall Settings window. Finally, I'm not sure if this is supposed to happen after running Unhide, but now I have a hidden file in all of my folders called "Thumbs.db". Oh, one final thing: my Internet seems to work only at spurts of time; other times, it doesn't work or runs VERY slowly.
Post #20
Hello k_selvage

Thank you for the logs.

Your disabled security concerns me.

I would like to see a ComboFix report from this machine if possible. Please drag the copy of ComboFix on your dektop to the Recycle Bin and then Empty the Bin.

Follow the instructions provided in post number 4 to download a fresh copy.

Disable McAfee and then run the tool (it should take no longer than 60 minutes to complete).

If ComboFix stalls/takes over an hour (as it did last time) please uninstall McAfee and try it again (Do not surf the web except to post replies back here).

If you encounter any problems with the ComboFix scan come back and let me know :)
Post #21
I tried doing the ComboFix scan, but my computer stalled out (again). I am in the middle of moving right now, so I have no Internet at home (I'm using my work computer right now). I will try to uninstall McAfee and re-do the scan. I probably won't be able to do this for at least a couple of weeks; will this discussion stay open, or will it be deleted during that time frame? Sorry about the delay! :)
Post #22
Hello k_selvage

will this discussion stay open, or will it be deleted during that time frame?

Your thread will not be deleted. I will leave it open until your problems are resolved. I will post back here in a couple of weeks to see how things are going.

Good luck with the move :)

JonTom
Post #23
I FINALLY am a little settled at my new home and was finally able to work on my computer. I removed McAfee VirusScan by going to Start - Control Panel - Add/Remove Programs. However, when I went into my Program Files folder on the C: drive, two McAfee folders were still there, and my computer would not let me remove those folders. To make a long story short, I think I removed my antivirus program, but I'm not sure. Also, my computer has a red shield in the taskbar in the bottom right with an "X" on it. It says, "Your computer might be at risk. McAfee VirusScan is turned off. Click this balloon to fix this problem." So, I guess the antivirus program is at least shut off, if it's not deleted.

I was actually able to run ComboFix this time. :) Regarding the Microsoft Windows Recovery Console, I wasn't able to update it because I have no Internet connection yet. However, I did have ComboFix keep scanning for malware. Here's the log that was created:

ComboFix 11-08-09.02 - delbert selvage 08/11/2011 6:01.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.260 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\delbert selvage\Desktop\Windows XP Repair.lnk
c:\documents and settings\delbert selvage\Start Menu\Programs\Windows XP Repair
c:\documents and settings\delbert selvage\Start Menu\Programs\Windows XP Repair\Uninstall Windows XP Repair.lnk
c:\documents and settings\delbert selvage\Start Menu\Programs\Windows XP Repair\Windows XP Repair.lnk
.
.
((((((((((((((((((((((((( Files Created from 2011-07-11 to 2011-08-11 )))))))))))))))))))))))))))))))
.
.
2011-07-18 22:13 . 2011-07-18 22:13 ——– d—–w- C:\_OTM
2011-07-16 06:53 . 2011-07-16 06:53 ——– d—–w- c:\documents and settings\delbert selvage\Application Data\Malwarebytes
2011-07-15 21:20 . 2011-07-15 21:20 ——– d—–w- c:\documents and settings\Administrator.DHFXFW91\Application Data\Malwarebytes
2011-07-15 21:19 . 2011-07-07 00:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-15 21:19 . 2011-07-15 21:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-07-15 21:19 . 2011-07-20 21:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-07-15 21:19 . 2011-07-07 00:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-15 21:18 . 2011-07-15 21:18 ——– d-sh–w- c:\documents and settings\Administrator.DHFXFW91\PrivacIE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-19 15:18 . 2011-06-03 10:55 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02 . 2004-08-10 17:51 1858944 —-a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2005-05-15 332800]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-12 53248]
"MSKDetectorExe"="c:\progra~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 1121792]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"VirusScan Online"="c:\program files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-11-11 1005096]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"MPSExe"="c:\progra~1\mcafee.com\mps\mscifapp.exe" [2006-03-30 296488]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-04-26 98304]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"MSKAGENTEXE"="c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592]
.
c:\documents and settings\delbert selvage\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2006-5-3 256000]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-4-26 24576]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/28/2011 3:59 PM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/28/2011 3:59 PM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [7/15/2011 4:19 PM 41272]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-28 20:58]
.
2011-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-28 20:58]
.
2011-08-08 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (DHFXFW91-delbert selvage).job
- c:\program files\mcafee.com\vso\mcmnhdlr.exe [2006-04-26 23:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.esu9.org/webmail/src/login.php
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\mclsp.dll
Trusted Zone: musicmatch.com\online
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-McAfee Personal Firewall Plus - c:\progra~1\mcafee.com\shared\mcappins.exe
AddRemove-McAfee Privacy Service - c:\progra~1\mcafee.com\shared\mcappins.exe
AddRemove-McAfee SpamKiller - c:\progra~1\mcafee.com\shared\mcappins.exe
AddRemove-VirusScan Online - c:\progra~1\mcafee.com\shared\mcappins.exe
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-11 06:15
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(688)
c:\windows\system32\mclsp.dll
c:\windows\system32\SPORDER.dll
c:\windows\system32\mclsphlr\gdlsphlr.dll
c:\windows\system32\McRtl32.dll
.
Completion time: 2011-08-11 06:18:01
ComboFix-quarantined-files.txt 2011-08-11 11:17
.
Pre-Run: 90,203,262,976 bytes free
Post-Run: 90,657,390,592 bytes free
.
- - End Of File - - 810ADF342CE183E1D84A149C3B5DAB91
Post #24
Hello k_selvage

I'm glad to hear that you are getting settled into your new place :)

Regarding the Microsoft Windows Recovery Console, I wasn't able to update it because I have no Internet connection yet

Thanks for letting me know.

Your ComboFix log looks okay. I would like to follow with an MBAM scan and then an online scan to check for anything that may have been missed. However, the lack of an internet connection means we will be unable to update MBAM to the most recent virus signature database nor will we be able to run the online scan.


I must also let you know that I will be offline from 13th Aug to 20th Aug inclusive. If you think you will be able to get an internet connection up and running before I am back please let me know and I will request that another helper continue with you while I am away so you are not left waiting.

Alternatively, if you are happy to get your internet connection sorted out during the time I am away we can continue when I get back.

Please let me know which option is most convenient for you and we will go from there.
Post #25
I can definitely wait until you're back after August 20. Actually, my husband and I haven't really discussed reconnecting our Internet. As odd as this may sound, I think we might actually try to do without it. My computer is actually running pretty quickly at this point in time, and it seems like nothing is wrong with it…do you think that could be true? After we were going to fix my computer, we were going to work on my external hard drive/flash drives that I infected when I was tranferring information back and forth from my infected computer to another one. Do you have any suggestions about that? I'm in no big hurry - I'll wait for you to respond when you get back. :)
Post #26
Hello k_selvage

Thank you for your patience :)

My computer is actually running pretty quickly at this point in time, and it seems like nothing is wrong with it…do you think that could be true?

If the original symptoms are no longer occurring it sounds as though we are making progress although an absence of symptoms does not always mean an absence of Malware. I feel uneasy about giving you the "all clear" without seeing an updated MBAM and online scan as I mentioned previously.

After we were going to fix my computer, we were going to work on my external hard drive/flash drives

You can scan your external hard drive using MalwareBytes AntiMalware. Plug in your external drive, open MBAM, secect "Perform full Scan", select the drive you want to scan and click on Scan. If anything is detected, allow MBAM to remove it.

As for flash drives, using flash disinfector/autorun eater as described in post number 10 ( http://forums.whatthetech.com/index.php?sh…st&p=740494 ) will help to reduce the chances of cross infection. If you have any doubts about the integrity of the flash drives you use I advise you to replace them with new ones.

Please be advised that without an active internet connection we are very limited in the number of things we can do to ensure your machine is malware free.


Lets continue with the following:


  • MBAM

    • I would like to see the results from another MBAM quick scan.
    • Please open MBAM, run a quick scan and post the log in your next reply.

  • SAS portable


    • Using another computer, please follow the instructions found on this page to download a portable copy of SuperAntiSpyware to a USB/flash drive.
    • The file will save with a random name (so that it is not recognized by malware). Please do not change the name to anything else.
    • Once you have it on the flash drive, I'd like you to run it from the flash drive on your machine and see if it will scan. You don't want to try to move the file to your computer or it may be blocked. It is designed to be launched from the flash drive.
    • Please post the resulting log file.

    Please post the MBAM log, the SAS log and a new DDS scan log in your next reply.

    If you decide not to get a new internet connection please let me know in your next reply :)
Post #28
I started doing the scans last night and can hopefully finish them up tonight and post the logs tomorrow. After running SUPERAntiSpyware, should I delete the potentially dangerous items? Or, do you want me to post the log first and then delete them after you've looked at it? My family is actually surviving without an Internet connection, so I think we're not going to get one until we feel like we absolutely need it. :)
Post #30
I performed two MBAM logs. The first one includes two flash drives that I scanned:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7213

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/24/2011 9:34:37 PM
mbam-log-2011-08-24 (21-34-37).txt

Scan type: Full scan (F:\|G:\|)
Objects scanned: 185770
Time elapsed: 1 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Here is the second MBAM log that I did when I included a scan for my external hard drive:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7213

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/24/2011 9:48:24 PM
mbam-log-2011-08-24 (21-48-24).txt

Scan type: Full scan (F:\|)
Objects scanned: 198019
Time elapsed: 11 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


I also did two SAS logs, the first one again to include my C: drive and two flash drives:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/24/2011 at 10:28 PM

Application Version : 5.0.1118

Core Rules Database Version : 7598
Trace Rules Database Version: 5410

Scan type : Complete Scan
Total Scan Time : 00:35:52

Operating System Information
Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 493
Memory threats detected : 0
Registry items scanned : 38269
Registry threats detected : 0
File items scanned : 35499
File threats detected : 67

Adware.Tracking Cookie
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@adbrite[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@adultadworld[1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@advertising[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@atdmt[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@atdmt[3].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@collective-media[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@doubleclick[1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@imrworldwide[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@insightexpressai[1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@invitemedia[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@invitemedia[3].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@lucidmedia[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@media6degrees[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@porndad[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@questionmarket[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@revsci[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@ru4[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@specificclick[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@trafficmp[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@zedo[1].txt
C:\DOCUMENTS AND SETTINGS\KRISTINA HUBL\COOKIES\KRISTINA HUBL@MICROSOFTEUP.112.2O7[1].TXT

Malware.Installer-Pkg/Gen
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{6B6A7665-DB48-4762-AB5D-BEEB9E1CD7FA}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{26D2C2C3-CF14-4ED7-B1FC-0BE64AFBA3B3}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{3C48F877-A164-45E9-B9DA-26A049FFC207}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{6293BC00-4EB8-4C65-8548-53E2FC3BF937}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{989E4C3B-B2C9-4486-9A09-D5A8F953837C}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{C0A0AA4D-C79B-48CA-8843-2B02B626C9E6}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{D1A6F3FD-7B40-443F-8767-BADB25A0D222}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{E0814F95-5380-4892-B8C8-7FA4B349EF46}.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH TRADEWINDS.LNK
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH POLAR BOWLER.LNK
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH DINER DASH.LNK
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH SCRABBLE.LNK
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH BEJEWELED 2 DELUXE.LNK
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH BLACKHAWK STRIKER 2.LNK
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH BLASTERBALL 2.LNK
C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\PROGRAMS\DELL GAMES\LAUNCH CHUZZLE DELUXE.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH TRADEWINDS.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH POLAR BOWLER.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH DINER DASH.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH SCRABBLE.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH BEJEWELED 2 DELUXE.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH BLACKHAWK STRIKER 2.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH BLASTERBALL 2.LNK
C:\QOOBOX\QUARANTINE\C\DOCUME~1\DELBER~1\LOCALS~1\TEMP\SMTMP\1\PROGRAMS\DELL GAMES\LAUNCH CHUZZLE DELUXE.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019262.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019263.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019264.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019265.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019266.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019268.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019270.LNK
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0019271.LNK


The second SAS log was for my external hard drive only:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/25/2011 at 08:50 PM

Application Version : 5.0.1118

Core Rules Database Version : 7598
Trace Rules Database Version: 5410

Scan type : Complete Scan
Total Scan Time : 00:05:13

Operating System Information
Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 507
Memory threats detected : 0
Registry items scanned : 38269
Registry threats detected : 0
File items scanned : 4991
File threats detected : 34

Adware.Tracking Cookie
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@adbrite[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@adultadworld[1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@advertising[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@atdmt[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@atdmt[3].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@collective-media[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@doubleclick[1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@imrworldwide[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@insightexpressai[1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@invitemedia[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@invitemedia[3].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@lucidmedia[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@media6degrees[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@porndad[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@questionmarket[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@revsci[2].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@ru4[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@specificclick[1].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@trafficmp[2].txt
C:\Documents and Settings\delbert selvage\Cookies\[removed][1].txt
C:\Documents and Settings\delbert selvage\Cookies\delbert_selvage@zedo[1].txt


Finally, here is the new DDS scan log:

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 20:52:06 on 2011-08-25
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.200 [GMT -5:00]
.
AV: McAfee VirusScan *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.esu9.org/webmail/src/login.php
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McBrwHelper Class: {227b8aa8-daf2-4892-bd1d-73f568bcb24e} - c:\progra~1\mcafee.com\mps\mcbrhlpr.dll
BHO: McAfee Privacy Service Popup Blocker: {3ec8255f-e043-4cae-8b3b-b191550c2a22} - c:\program files\mcafee.com\mps\popupkiller.dll
BHO: McAfee AntiPhishing Filter: {41d68ed8-4cff-4115-88a6-6ebb8af19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [OASClnt] c:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MSKDetectorExe] c:\progra~1\mcafee\spamki~1\MSKDetct.exe /startup
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [DeviceDiscovery] c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MPSExe] c:\progra~1\mcafee.com\mps\mscifapp.exe /embedding
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe
mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MskAgent.exe
StartupFolder: c:\documents and settings\delbert selvage\start menu\programs\startup\PowerReg Scheduler.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqthb08.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40} - c:\program files\mcafee\spamkiller\mcapfbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\mclsp.dll
Trusted Zone: musicmatch.com\online
DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - hxxp://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - hxxp://chat.yahoo.com/cab/yacsui.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - hxxp://chat.yahoo.com/cab/yvwrctl.cab
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MPFIREWL;MPFIREWL;c:\windows\system32\drivers\MpFirewall.sys [2006-4-26 80640]
R1 SASDIFSV;SASDIFSV;c:\docume~1\delber~1\locals~1\temp\sas_selfextract\SASDIFSV.SYS [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\docume~1\delber~1\locals~1\temp\sas_selfextract\SASKUTIL.SYS [2011-7-12 67664]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-1-28 136176]
S2 McDetect.exe;McAfee WSC Integration;c:\program files\mcafee.com\agent\mcdetect.exe –> c:\program files\mcafee.com\agent\mcdetect.exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-1-28 136176]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe –> c:\progra~1\mcafee.com\agent\mcupdmgr.exe [?]
.
=============== Created Last 30 ================
.
2011-08-25 02:50:12 ——– d—–w- c:\documents and settings\delbert selvage\application data\SUPERAntiSpyware.com
2011-08-25 02:50:12 ——– d—–w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-08-11 10:57:35 98816 —-a-w- c:\windows\sed.exe
2011-08-11 10:57:35 518144 —-a-w- c:\windows\SWREG.exe
2011-08-11 10:57:35 256000 —-a-w- c:\windows\PEV.exe
2011-08-11 10:57:35 208896 —-a-w- c:\windows\MBR.exe
2011-08-11 10:57:27 ——– d—–w- C:\ComboFix
.
==================== Find3M ====================
.
2011-07-07 00:52:42 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 00:52:42 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-06-22 12:05:40 5852 –sha-w- c:\windows\system32\KGyGaAvL.sys
2011-06-22 12:05:37 88 –sh–r- c:\windows\system32\CC71837CDE.sys
2011-06-19 15:18:25 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02:05 1858944 —-a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 20:52:54.46 ===============


I hope I ran all the scans correctly. Hopefully, I didn't confuse you too much. If you want me to do the scans differently, just let me know.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI