What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

bios infected?

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
This is my last try for successful help before I trash my p/c. I am unable to rid my p/c of malware. I have taken it twice to a local computer shop. The first time they claimed to have removed the infection. They didn't and I rook it back and asked that my 2 hard drives be wiped. This failed to rid the malware as well. I removed the 2 drives and put in a new hard drive. My p/c is still infected. Can malware infect the bios? Below is my scan using hijackthis:
Thanks

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:53:00 PM, on 8/3/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\hp\kbd\kbd.exe
c:\Users\Bishop\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [SnapfishMediaDetector] C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Snapfish Media Detector.lnk = C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 9380 bytes
Post #2
Hello nonag and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Uninstall this program:

Ad-Aware

Ad-Aware these days has an antivirus element included and is pretty ineffective against modern malware, I suggest you remove it. 1. Click Start, Control Panel, Programs, and then Programs and Features.
2. Click on Ad-Aware and then Uninstall.
I also notice remnants of Norton on your machine which should be removed.

To remove remnants of Norton
  • download the Norton Removal Tool from here and save it to your desktop.
  • double click on Norton_Removal_Tool.exe to run the tool.
  • follow the on-screen instructions.
Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.

===================================================

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

• disable any script blocking protection (How to Disable your Security Programs)
• double click DDS icon to run the tool (may take up to 3 minutes to run)
• when done, DDS.txt will open.
• after a few moments, attach.txt will open in a second window.
• save both reports to your desktop.
• Post the contents of the DDS.txt and Attach.txt reports in your next reply
===================================================

Run aswMBR• download aswMBR.exe ( 511KB ) to your desktop
• double click the aswMBR.exe to run it
• click the "Scan" button to start the scan
On completion of the scan click save log, save it to your desktop and post in your next reply

Logs to include with next post:

DDS.txt
Attach.txt
aswMBR log

Can you also tell me what symptoms cause you to think your machine is infected.

Thanks

Satchfan
Post #3
Hi Satchfan, I ran into a problem disabling script blocking in Spy Bot. Under System Start up, I didn't see a Tea Timer box nor a Tea Timer system tray icon. How should I proceed?
Post #5
Among the reasons, I believe the p/c to still be infected are as follows: -The number & length of disk accesses seem excessive for simple tasks. -My Firewall has multiple ports open granting permissions for both incoming and outgoing data which I did not grant access. -Task Manager shows unfamiliar processes running. -My browser has been hijacked. -System works much slower than it used to. -Files mysteriously disappear or appear. Etc… Below is the info you requested. Thanks. . DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by [removed] at 20:28:39 on 2011-08-04 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.1966 [GMT -4:00] . AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB} FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32\taskeng.exe C:\Windows\ehome\ehsched.exe C:\Windows\ehome\ehRecvr.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\hp\support\hpsysdrv.exe C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe C:\Windows\System32\rundll32.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files\Windows Sidebar\sidebar.exe C:\hp\kbd\kbd.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2011\ievkbd.dll BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autoRun uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe mRun: [KBD] c:\hp\kbd\KbdStub.EXE mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe" mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe" mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [CCUTRAYICON] FactoryMode mRun: [] mRun: [SnapfishMediaDetector] c:\program files\snapfish media detector\SnapfishMediaDetector.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [avp] "c:\program files\kaspersky lab\kaspersky internet security 2011\avp.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe StartupFolder: c:\users\bishop\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\snapfi~1.lnk - c:\program files\snapfish media detector\SnapfishMediaDetector.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2011\ie_banner_deny.htm IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll TCP: DhcpNameServer = [removed] [removed] TCP: Interfaces\{EFAE58BE-85C3-462E-9FA4-6069385383E7} : DhcpNameServer = [removed] [removed] Notify: klogon - c:\windows\system32\klogon.dll AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll Hosts: 127.0.0.1 www.spywareinfo.com . ================= FIREFOX =================== . FF - ProfilePath - c:\users\bishop\appdata\roaming\mozilla\firefox\profiles\tbvt3wmd.default\ . ============= SERVICES / DRIVERS =============== . R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010-6-9 11352] R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2010-4-22 22104] R2 AVP;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky internet security 2011\avp.exe [2010-7-2 352976] R2 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.exe [2006-9-3 208896] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2011-7-8 21504] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-7-8 1153368] R3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2011-7-7 354432] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19984] R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\system32\drivers\netr73.sys [2011-7-7 255488] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 IntelDHSvcConf;Intel DH Service;c:\program files\intel\inteldh\intel media server\tools\IntelDHSvcConf.exe [2006-5-10 29696] S3 MCLServiceATL;Intel® Application Tracker;c:\program files\intel\inteldh\intel media server\shells\MCLServiceATL.exe [2006-9-11 167936] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2011-08-04 02:21:13 ——– d—–w- c:\users\bishop\appdata\roaming\HpUpdate 2011-08-04 02:21:06 ——– d—–w- c:\windows\Hewlett-Packard 2011-08-04 02:08:58 ——– d—–w- c:\programdata\NetZero 2011-08-02 14:01:06 6881616 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{3d9ad984-2ba0-4039-b10a-86c8fa3680e6}\mpengine.dll 2011-08-01 23:20:23 110592 —-a-r- c:\users\bishop\appdata\roaming\microsoft\installer\{7fc665ee-a818-4d19-8ba7-485d03d3f676}\ARPPRODUCTICON.exe 2011-08-01 23:20:21 ——– d—–w- c:\program files\CASIO 2011-08-01 23:19:37 ——– d—–w- c:\users\bishop\appdata\roaming\CASIO 2011-07-29 14:36:44 876032 —-a-w- c:\windows\system32\XpsPrint.dll 2011-07-28 23:57:07 ——– d—–w- c:\program files\Windows Portable Devices 2011-07-28 20:04:13 92672 —-a-w- c:\windows\system32\UIAnimation.dll 2011-07-28 20:04:13 3023360 —-a-w- c:\windows\system32\UIRibbon.dll 2011-07-28 20:04:13 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll 2011-07-28 20:02:26 4096 —-a-w- c:\windows\system32\oleaccrc.dll 2011-07-28 20:02:25 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll 2011-07-28 20:02:25 234496 —-a-w- c:\windows\system32\oleacc.dll 2011-07-28 16:46:24 231424 —-a-w- c:\windows\system32\msshsq.dll 2011-07-28 01:29:03 303616 —-a-w- c:\windows\system32\wmpeffects.dll 2011-07-27 22:45:44 ——– d—–w- c:\windows\system32\eu-ES 2011-07-27 22:45:44 ——– d—–w- c:\windows\system32\ca-ES 2011-07-27 22:45:43 ——– d—–w- c:\windows\system32\vi-VN 2011-07-27 22:43:24 ——– d—–w- c:\windows\system32\SPReview 2011-07-27 22:30:32 928768 —-a-w- c:\windows\system32\scavenge.dll 2011-07-27 22:30:29 57856 —-a-w- c:\windows\system32\compcln.exe 2011-07-27 22:24:59 ——– d—–w- c:\windows\system32\EventProviders 2011-07-27 01:05:00 652296 —-a-w- c:\programdata\microsoft\ehome\packages\sportstemplate\sportstemplatecore\Microsoft.MediaCenter.Sports.UI.dll 2011-07-27 01:04:55 749832 —-a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll 2011-07-27 01:04:53 416128 —-a-w- c:\programdata\microsoft\ehome\packages\nettv\browse\NetTVResources.dll 2011-07-21 20:37:41 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-07-16 20:06:50 ——– d—–w- c:\users\bishop\appdata\roaming\Malwarebytes 2011-07-16 20:06:36 ——– d—–w- c:\programdata\Malwarebytes 2011-07-13 22:51:19 7680 —-a-w- c:\program files\internet explorer\iecompat.dll 2011-07-13 22:50:45 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-07-13 22:49:59 355832 —-a-w- c:\program files\internet explorer\pdm.dll 2011-07-13 22:49:59 265720 —-a-w- c:\program files\internet explorer\msdbg2.dll 2011-07-13 15:00:03 2043392 —-a-w- c:\windows\system32\win32k.sys 2011-07-13 15:00:01 49152 —-a-w- c:\windows\system32\csrsrv.dll 2011-07-13 15:00:01 375808 —-a-w- c:\windows\system32\winsrv.dll 2011-07-12 15:51:21 28672 —-a-w- c:\windows\system32\Apphlpdm.dll 2011-07-12 15:51:20 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2011-07-12 10:11:26 18904 —-a-w- c:\windows\system32\StructuredQuerySchemaTrivial.bin 2011-07-12 10:04:57 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2011-07-12 10:04:57 49472 —-a-w- c:\windows\system32\netfxperf.dll 2011-07-12 10:04:57 297808 —-a-w- c:\windows\system32\mscoree.dll 2011-07-12 10:04:57 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2011-07-12 10:04:57 1130824 —-a-w- c:\windows\system32\dfshim.dll 2011-07-12 10:01:05 2048 —-a-w- c:\windows\system32\winrsmgr.dll 2011-07-11 18:38:58 69632 —-a-w- c:\windows\system32\drivers\bowser.sys 2011-07-11 18:37:59 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat 2011-07-11 18:37:57 677888 —-a-w- c:\windows\system32\mstsc.exe 2011-07-11 18:37:57 63488 —-a-w- c:\windows\system32\tscupgrd.exe 2011-07-11 18:37:57 2067968 —-a-w- c:\windows\system32\mstscax.dll 2011-07-11 18:37:56 905088 —-a-w- c:\windows\system32\drivers\tcpip.sys 2011-07-11 18:37:55 531968 —-a-w- c:\windows\system32\comctl32.dll 2011-07-11 18:37:54 276992 —-a-w- c:\windows\system32\schannel.dll 2011-07-11 16:37:10 ——– d—–w- C:\PerfLogs 2011-07-11 15:53:05 ——– d—–w- C:\a757cb603acdabe56d7f07fc3c0a1167 2011-07-08 22:30:54 ——– d—–w- c:\programdata\Electronic Arts 2011-07-08 22:29:58 447752 —-a-r- c:\windows\system32\vp6vfw.dll 2011-07-08 22:29:54 ——– d—–w- c:\program files\Microsoft WSE 2011-07-08 22:29:31 2414360 —-a-w- c:\windows\system32\d3dx9_31.dll 2011-07-08 13:49:33 2730536 —-a-w- c:\programdata\microsoft\windows defender\definition updates\default\MpEngine.dll 2011-07-08 13:49:23 705536 —-a-w- c:\windows\system32\imagesp1.dll 2011-07-08 13:49:16 116736 —-a-w- c:\windows\system32\sstpsvc.dll 2011-07-08 13:49:05 1008184 —-a-w- c:\program files\windows defender\MSASCui.exe 2011-07-08 13:47:59 297472 —-a-w- c:\windows\system32\cmipnpinstall.dll 2011-07-08 13:46:59 475648 —-a-w- c:\windows\system32\msidcrl30.dll 2011-07-08 13:45:59 96768 —-a-w- c:\windows\system32\dfrgfat.exe 2011-07-08 13:44:54 9216 —-a-w- c:\windows\system32\LogonUI.exe 2011-07-08 13:43:22 357888 —-a-w- c:\windows\system32\wbemcomn.dll 2011-07-08 13:43:22 102400 —-a-w- c:\windows\system32\wbem\mofinstall.dll 2011-07-08 13:43:19 139264 —-a-w- c:\windows\system32\SmiInstaller.dll 2011-07-08 13:43:19 129536 —-a-w- c:\windows\system32\sqmapi.dll 2011-07-08 13:43:06 35328 —-a-w- c:\windows\system32\mspatcha.dll 2011-07-08 13:43:06 258560 —-a-w- c:\windows\system32\dpx.dll 2011-07-08 13:43:05 305152 —-a-w- c:\windows\system32\msdelta.dll 2011-07-08 12:51:49 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-07-08 12:36:29 ——– d—–w- c:\users\bishop\appdata\local\Adobe 2011-07-08 12:25:50 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2011-07-08 12:25:50 ——– d—–w- c:\program files\Spybot - Search & Destroy 2011-07-08 12:17:56 377344 —-a-w- c:\windows\system32\winhttp.dll 2011-07-08 04:32:21 ——– d–h–w- C:\kleaner.tmp 2011-07-08 04:22:23 23552 —-a-w- c:\windows\system32\lpk.dll 2011-07-08 04:22:23 10240 —-a-w- c:\windows\system32\dciman32.dll 2011-07-08 04:20:13 61440 —-a-w- c:\windows\system32\winipsec.dll 2011-07-08 04:20:12 272896 —-a-w- c:\windows\system32\polstore.dll 2011-07-08 04:17:44 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE 2011-07-08 04:17:44 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE 2011-07-08 04:17:44 27136 —-a-w- c:\windows\system32\NETSTAT.EXE 2011-07-08 04:17:44 19968 —-a-w- c:\windows\system32\ARP.EXE 2011-07-08 04:17:44 17920 —-a-w- c:\windows\system32\ROUTE.EXE 2011-07-08 04:17:44 11264 —-a-w- c:\windows\system32\MRINFO.EXE 2011-07-08 04:17:44 105984 —-a-w- c:\windows\system32\netiohlp.dll 2011-07-08 04:17:44 10240 —-a-w- c:\windows\system32\finger.exe 2011-07-08 04:17:35 ——– d—–w- c:\programdata\Kaspersky Lab Setup Files 2011-07-08 04:15:39 1401856 —-a-w- c:\windows\system32\msxml6.dll 2011-07-08 04:15:38 2048 —-a-w- c:\windows\system32\msxml6r.dll 2011-07-08 04:15:38 2048 —-a-w- c:\windows\system32\msxml3r.dll 2011-07-08 04:15:08 218624 —-a-w- c:\windows\system32\msv1_0.dll 2011-07-08 04:02:16 53248 —-a-w- c:\windows\system32\rrinstaller.exe 2011-07-08 04:02:16 24576 —-a-w- c:\windows\system32\mfpmp.exe 2011-07-08 04:02:16 2048 —-a-w- c:\windows\system32\mferror.dll 2011-07-08 03:59:54 71680 —-a-w- c:\windows\system32\atl.dll 2011-07-08 03:57:31 160256 —-a-w- c:\windows\system32\wkssvc.dll 2011-07-08 03:57:10 53248 —-a-w- c:\windows\system32\tsgqec.dll 2011-07-08 03:57:10 136192 —-a-w- c:\windows\system32\aaclient.dll 2011-07-08 03:55:36 714240 —-a-w- c:\windows\system32\timedate.cpl 2011-07-08 03:54:10 23040 —-a-w- c:\program files\movie maker\WMM2EXT.dll 2011-07-08 03:54:10 195072 —-a-w- c:\program files\movie maker\WMM2AE.dll 2011-07-08 03:53:22 69632 —-a-w- c:\windows\system32\Mpeg2Data.ax 2011-07-08 03:52:13 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2 2011-07-08 03:51:45 623616 —-a-w- c:\windows\system32\localspl.dll 2011-07-08 03:50:42 172032 —-a-w- c:\windows\system32\wintrust.dll 2011-07-08 03:50:24 9728 —-a-w- c:\windows\system32\lsass.exe 2011-07-08 03:50:24 72704 —-a-w- c:\windows\system32\secur32.dll 2011-07-08 03:50:24 499712 —-a-w- c:\windows\system32\kerberos.dll 2011-07-08 03:50:24 439864 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2011-07-08 03:50:24 175104 —-a-w- c:\windows\system32\wdigest.dll 2011-07-08 03:50:24 1259008 —-a-w- c:\windows\system32\lsasrv.dll 2011-07-08 03:48:59 4164096 —-a-w- c:\windows\system32\NlsLexicons0002.dll 2011-07-08 03:47:39 6656 —-a-w- c:\windows\system32\kbd106n.dll 2011-07-08 03:46:36 62464 —-a-w- c:\windows\system32\l3codeca.acm 2011-07-08 03:46:36 220672 —-a-w- c:\windows\system32\l3codecp.acm 2011-07-08 03:46:22 30720 —-a-w- c:\windows\system32\drivers\tcpipreg.sys 2011-07-08 03:46:22 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys 2011-07-08 03:46:22 200704 —-a-w- c:\windows\system32\iphlpsvc.dll 2011-07-08 03:46:22 15360 —-a-w- c:\windows\system32\drivers\TUNMP.SYS 2011-07-08 03:14:06 150200 —-a-w- c:\program files\mozilla firefox\extensions\[removed]\components\kavlinkfilter.dll 2011-07-08 03:14:06 109240 —-a-w- c:\program files\mozilla firefox\extensions\[removed]\components\abhelperxpcom.dll 2011-07-08 03:06:19 98304 —-a-w- c:\windows\system32\cabview.dll 2011-07-08 03:03:56 37888 —-a-w- c:\windows\system32\printcom.dll 2011-07-08 03:03:42 6881616 —-a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll 2011-07-08 03:03:38 222080 ——w- c:\windows\system32\MpSigStub.exe 2011-07-08 03:02:06 14848 —-a-w- c:\windows\system32\wshrm.dll 2011-07-08 03:01:26 43520 —-a-w- c:\windows\system32\msdxm.tlb 2011-07-08 03:01:26 313344 —-a-w- c:\windows\system32\wmpdxm.dll 2011-07-08 03:01:26 18432 —-a-w- c:\windows\system32\amcompat.tlb 2011-07-08 03:01:24 7680 —-a-w- c:\windows\system32\spwmp.dll 2011-07-08 03:01:24 4096 —-a-w- c:\windows\system32\msdxm.ocx 2011-07-08 03:01:24 4096 —-a-w- c:\windows\system32\dxmasf.dll 2011-07-08 03:01:24 107520 —-a-w- c:\program files\windows media player\wmpshare.exe 2011-07-08 03:01:23 107520 —-a-w- c:\program files\windows media player\wmpconfig.exe 2011-07-08 03:00:39 347136 —-a-w- c:\windows\system32\RMActivate_ssp.exe 2011-07-08 03:00:39 346624 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe 2011-07-08 03:00:39 332288 —-a-w- c:\windows\system32\msdrm.dll 2011-07-08 03:00:39 152576 —-a-w- c:\windows\system32\secproc_ssp_isv.dll 2011-07-08 03:00:39 152064 —-a-w- c:\windows\system32\secproc_ssp.dll 2011-07-08 03:00:38 526336 —-a-w- c:\windows\system32\RMActivate_isv.exe 2011-07-08 03:00:38 518144 —-a-w- c:\windows\system32\RMActivate.exe 2011-07-08 03:00:38 471552 —-a-w- c:\windows\system32\secproc_isv.dll 2011-07-08 03:00:38 471552 —-a-w- c:\windows\system32\secproc.dll 2011-07-08 02:46:18 ——– d–h–w- C:\hp 2011-07-08 02:46:14 94208 —-a-w- c:\windows\system32\mdmxsdk.dll 2011-07-08 02:46:14 172032 —-a-w- c:\windows\system32\UCI32m15.dll 2011-07-08 02:46:14 12672 —-a-w- c:\windows\system32\drivers\mdmxsdk.sys 2011-07-08 02:46:11 255488 —-a-w- c:\windows\system32\drivers\netr73.sys 2011-07-08 02:46:03 250368 —-a-w- c:\windows\system32\drivers\iaStor.sys 2011-07-08 02:45:59 ——– d—–w- c:\windows\system32\OEM 2011-07-08 02:45:59 ——– d—–w- c:\windows\Panther 2011-07-08 02:45:45 ——– d-sh–w- C:\Boot 2011-07-08 02:42:17 84480 —-a-w- c:\windows\system32\INETRES.dll 2011-07-08 02:42:08 60928 —-a-w- c:\windows\system32\msasn1.dll 2011-07-08 02:41:46 784896 —-a-w- c:\windows\system32\rpcrt4.dll 2011-07-08 02:41:27 411648 —-a-w- c:\windows\system32\drivers\http.sys 2011-07-08 02:41:27 30720 —-a-w- c:\windows\system32\httpapi.dll 2011-07-08 02:41:27 24064 —-a-w- c:\windows\system32\nshhttp.dll 2011-07-08 02:39:55 243712 —-a-w- c:\windows\system32\rastls.dll 2011-07-08 02:39:48 355328 —-a-w- c:\windows\system32\WSDApi.dll 2011-07-08 02:39:31 ——– d—–w- c:\program files\MSXML 4.0 2011-07-08 02:32:37 ——– d—–w- c:\windows\SMINST 2011-07-08 02:27:40 ——– d—–w- c:\program files\Yahoo! 2011-07-08 02:26:00 ——– d—–w- c:\program files\Online Services 2011-07-08 02:26:00 ——– d—–w- c:\program files\earthlink totalaccess 2011-07-08 02:24:36 753664 —-a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iKernel.dll 2011-07-08 02:24:36 69714 —-a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\ctor.dll 2011-07-08 02:24:36 5632 —-a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\DotNetInstaller.exe 2011-07-08 02:24:36 331908 —-a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\setup.dll 2011-07-08 02:24:36 274432 —-a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iscript.dll 2011-07-08 02:24:36 200836 —-a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iGdi.dll 2011-07-08 02:24:36 184320 —-a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iuser.dll 2011-07-08 02:24:05 ——– d—–w- c:\programdata\PC-Doctor 2011-07-08 02:23:55 ——– d—–w- c:\program files\PC-Doctor 5 for Windows 2011-07-08 02:22:37 ——– d—–w- c:\programdata\{623D32E9-0C62-4453-AD44-98B31F52A5E1} 2011-07-08 02:22:35 ——– d—–w- c:\program files\Activation Assistant for the 2007 Microsoft Office suites 2011-07-08 02:22:22 33104 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll 2011-07-08 02:22:22 32656 —-a-w- c:\windows\system32\msonpmon.dll 2011-07-08 02:21:56 ——– d—–w- c:\windows\PCHEALTH 2011-07-08 02:19:52 ——– d—–w- c:\program files\Snapfish Media Detector 2011-07-08 02:18:49 ——– d—–w- c:\program files\muvee Technologies 2011-07-08 02:18:49 ——– d—–w- c:\program files\common files\muvee Technologies 2011-07-08 02:18:34 ——– d—–w- c:\program files\common files\xing shared 2011-07-08 02:18:31 ——– d—–w- c:\program files\common files\Real 2011-07-08 02:17:59 569397 —-a-w- c:\program files\internet explorer\plugins\richfx\player\nprfxins.dll 2011-07-08 02:17:58 ——– d—–w- c:\program files\Rhapsody 2011-07-08 02:17:35 ——– d—a-w- c:\program files\common files\LS Getting Started 2011-07-08 02:17:29 ——– d—–w- c:\program files\common files\SureThing Shared 2011-07-08 02:16:27 ——– d—–w- c:\program files\common files\PX Storage Engine 2011-07-08 02:16:14 ——– d—–w- c:\program files\Roxio 2011-07-08 02:16:14 ——– d—–w- c:\program files\common files\Sonic Shared 2011-07-08 02:12:03 ——– d—–w- c:\program files\HP 2011-07-08 02:12:03 ——– d—–w- c:\program files\common files\HP 2011-07-08 02:08:43 ——– d—–w- c:\program files\HP Games 2011-07-08 02:08:42 ——– d—–w- c:\programdata\WildTangent 2011-07-08 02:04:32 ——– d—–w- c:\program files\common files\Intel 2011-07-08 02:04:10 ——– d—–w- c:\windows\Downloaded Installations 2011-07-08 02:02:25 90191 —-a-w- c:\windows\system32\nvsvc.dll 2011-07-08 02:00:12 2421760 —-a-w- c:\windows\system32\wucltux.dll 2011-07-08 02:00:04 87552 —-a-w- c:\windows\system32\wudriver.dll 2011-07-08 01:59:53 33792 —-a-w- c:\windows\system32\wuapp.exe 2011-07-08 01:59:53 171608 —-a-w- c:\windows\system32\wuwebv.dll 2011-07-08 01:57:47 8704 —-a-w- c:\windows\system32\hccoin.dll 2011-07-08 01:57:26 61440 ——w- c:\windows\system32\OsdRemove.exe 2011-07-08 01:57:09 48760 —-a-w- c:\windows\system32\RUNCLOSE.OCX 2011-07-08 01:56:39 253952 —-a-w- c:\windows\system32\cPC_DMIRD.dll 2011-07-08 01:55:13 327680 —-a-w- c:\windows\system32\pythoncom24.dll 2011-07-08 01:55:13 102400 —-a-w- c:\windows\system32\pywintypes24.dll 2011-07-08 01:55:06 348160 —-a-w- c:\windows\system32\msvcr71.dll 2011-07-08 01:55:06 1060864 —-a-w- c:\windows\system32\mfc71.dll 2011-07-08 01:54:54 ——– d-sh–w- c:\windows\Installer 2011-07-08 01:51:39 70144 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\CNBPP3.DLL 2011-07-08 01:37:26 97859 —-a-w- c:\windows\system32\drivers\klick.dat 2011-07-08 01:37:26 115369 —-a-w- c:\windows\system32\drivers\klin.dat 2011-07-08 01:36:42 ——– d—–w- c:\programdata\Kaspersky Lab 2011-07-08 01:36:42 ——– d—–w- c:\program files\Kaspersky Lab . ==================== Find3M ==================== . 2011-07-11 16:22:45 101888 —-a-w- c:\windows\system32\ifxcardm.dll 2011-07-11 16:22:44 82432 —-a-w- c:\windows\system32\axaltocm.dll 2011-07-08 04:16:09 68096 —-a-w- c:\windows\system32\wlanhlp.dll 2011-07-08 04:16:09 65024 —-a-w- c:\windows\system32\wlanapi.dll 2011-07-08 04:16:09 513536 —-a-w- c:\windows\system32\wlansvc.dll 2011-07-08 04:16:09 302592 —-a-w- c:\windows\system32\wlansec.dll 2011-07-08 04:16:09 293376 —-a-w- c:\windows\system32\wlanmsm.dll 2011-07-08 04:16:09 127488 —-a-w- c:\windows\system32\L2SecHC.dll 2011-07-08 04:16:07 15181 —-a-w- c:\windows\system32\gatherWirelessInfo.vbs 2011-07-08 03:48:59 1452544 —-a-w- c:\windows\system32\NlsLexicons0003.dll 2011-07-08 02:42:56 2560 —-a-w- c:\windows\apppatch\AcRes.dll 2011-07-08 02:38:59 91136 —-a-w- c:\windows\system32\avifil32.dll 2011-07-08 02:38:59 82944 —-a-w- c:\windows\system32\mciavi32.dll 2011-07-08 02:38:59 65024 —-a-w- c:\windows\system32\avicap32.dll 2011-07-08 02:38:59 123904 —-a-w- c:\windows\system32\msvfw32.dll 2011-07-08 02:38:58 50176 —-a-w- c:\windows\system32\iyuv_32.dll 2011-07-08 02:38:58 31744 —-a-w- c:\windows\system32\msvidc32.dll 2011-07-08 02:38:58 22528 —-a-w- c:\windows\system32\msyuv.dll 2011-07-08 02:38:58 13312 —-a-w- c:\windows\system32\msrle32.dll 2011-07-08 02:38:58 1314816 —-a-w- c:\windows\system32\quartz.dll 2011-07-08 02:38:58 12288 —-a-w- c:\windows\system32\tsbyuv.dll 2011-07-08 02:38:45 604672 —-a-w- c:\windows\system32\WMSPDMOD.DLL 2011-07-08 02:38:33 310784 —-a-w- c:\windows\system32\unregmp2.exe 2011-07-08 02:03:54 319456 —-a-w- c:\windows\DIFxAPI.dll 2011-07-08 02:03:53 315392 —-a-w- c:\windows\HideWin.exe . ============= FINISH: 20:29:11.88 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-06-23.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 7/7/2011 9:51:51 PM System Uptime: 8/4/2011 4:54:06 PM (4 hours ago) . Motherboard: ASUSTek Computer INC. | | Basswood3G Processor: Intel® Core™2 Quad CPU @ 2.40GHz | Socket 775 | 2400/266mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 457 GiB total, 392.146 GiB free. D: is FIXED (NTFS) - 9 GiB total, 1.008 GiB free. E: is CDROM () F: is Removable G: is Removable H: is Removable I: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: Compact Flash Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20021111153705700&0# Manufacturer: Generic- Name: Compact Flash PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20021111153705700&0# Service: WUDFRd . Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: MS/MS-Pro Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MS#MS-PRO&REV_1.00#20021111153705700&3# Manufacturer: Generic- Name: MS/MS-Pro PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MS#MS-PRO&REV_1.00#20021111153705700&3# Service: WUDFRd . Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: SD/MMC Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SD#MMC&REV_1.00#20021111153705700&2# Manufacturer: Generic- Name: SD/MMC PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SD#MMC&REV_1.00#20021111153705700&2# Service: WUDFRd . Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: SM/xD-Picture Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD-PICTURE&REV_1.00#20021111153705700&1# Manufacturer: Generic- Name: SM/xD-Picture PNP Device ID: WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD-PICTURE&REV_1.00#20021111153705700&1# Service: WUDFRd . ==== System Restore Points =================== . RP40: 7/27/2011 9:27:10 PM - Windows Vista™ Service Pack 2 RP41: 7/27/2011 10:58:26 PM - Removed Snapfish Media Detector RP42: 7/27/2011 10:59:14 PM - Removed Snapfish Media Detector RP43: 7/27/2011 11:02:10 PM - Removed Ad-Aware RP44: 7/28/2011 11:06:06 AM - Windows Update RP45: 7/28/2011 3:59:52 PM - Windows Update RP46: 7/29/2011 10:36:43 AM - Windows Update RP47: 7/30/2011 3:00:17 AM - Windows Update RP48: 7/31/2011 2:03:51 AM - Scheduled Checkpoint RP49: 8/1/2011 9:08:29 AM - Scheduled Checkpoint RP50: 8/1/2011 7:20:01 PM - Installed fx-CG10 OS Update (Single License). RP51: 8/2/2011 10:00:54 AM - Windows Update RP52: 8/3/2011 2:00:12 AM - Scheduled Checkpoint RP53: 8/3/2011 12:31:13 PM - Windows Update RP54: 8/3/2011 10:28:47 PM - Windows Update RP55: 8/4/2011 3:58:09 PM - Removed Ad-Aware . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) Activation Assistant for the 2007 Microsoft Office suites Adobe Flash Player 10 Plugin Adobe Flash Player 9 ActiveX Adobe Flash Player ActiveX Adobe Reader 8.3.0 EA Download Manager Enhanced Multimedia Keyboard Solution fx-CG10 OS Update (Single License) Hardware Diagnostic Tools Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP Customer Experience Enhancements HP Customer Feedback HP Easy Setup - Frontend HP On-Screen Cap/Num/Scroll Lock Indicator HP Photosmart Essential 2.0 HP Photosmart Essential2.5 HP Picasso Media Center Add-In HP Total Care Advisor HP Update Intel® Matrix Storage Manager Intel® Viiv™ Software Kaspersky Internet Security 2011 LightScribe 1.4.142.1 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Works Microsoft WSE 3.0 Runtime Mozilla Firefox 5.0.1 (x86 en-US) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) muvee autoProducer 6.0 My HP Games NVIDIA Drivers PSSWCORE Python 2.4.3 RealPlayer Realtek High Definition Audio Driver Rhapsody Rhapsody Player Engine Roxio Activation Module Roxio Creator Audio Roxio Creator Basic v9 Roxio Creator Copy Roxio Creator Data Roxio Creator EasyArchive Roxio Creator Tools Roxio Express Labeler 3 Roxio MyDVD Basic v9 Security Update for 2007 Microsoft Office System (KB2288621) Security Update for 2007 Microsoft Office System (KB2288931) Security Update for 2007 Microsoft Office System (KB2345043) Security Update for 2007 Microsoft Office System (KB2509488) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft Office 2007 System (KB2541012) Security Update for Microsoft Office Excel 2007 (KB2541007) Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office PowerPoint 2007 (KB2535818) Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB2344993) Snapfish Media Detector Soft Data Fax Modem with SmartCP Spybot - Search & Destroy The Sims™ 3 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 System (KB2539530) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 (KB980729) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Yahoo! Toolbar Yahoo! Toolbar for Internet Explorer . ==== Event Viewer Messages From Past Week ======== . 8/4/2011 8:24:22 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting. 8/4/2011 4:25:43 PM, Error: Microsoft-Windows-PrintSpooler [6161] - The document Microsoft Word - roblem with the Canon PIXMA MP780 All, owned by Lords, failed to print on printer Canon Inkjet MP780 Series. Try to print the document again, or restart the print spooler. Data type: NT EMF 1.008. Size of the spool file in bytes: 254880. Number of bytes printed: 209540. Total number of pages in the document: 3. Number of pages printed: 1. Client computer: \\BISHOP-PC. Win32 error code returned by the print processor: 122. The data area passed to a system call is too small. 8/4/2011 4:23:53 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 8/4/2011 2:19:21 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.100.2 for the Network Card with network address 001BFC9B0FCE has been denied by the DHCP server [removed] (The DHCP Server sent a DHCPNACK message). 8/4/2011 11:35:06 AM, Error: Microsoft-Windows-PrintSpooler [6161] - The document Microsoft Word - roblem with the Canon PIXMA MP780 All, owned by Lords, failed to print on printer Canon Inkjet MP780 Series. Try to print the document again, or restart the print spooler. Data type: NT EMF 1.008. Size of the spool file in bytes: 254880. Number of bytes printed: 88492. Total number of pages in the document: 3. Number of pages printed: 1. Client computer: \\BISHOP-PC. Win32 error code returned by the print processor: 0. The operation completed successfully. 8/4/2011 10:03:11 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease [removed] for the Network Card with network address 001BFC9B0FCE has been denied by the DHCP server 192.168.100.1 (The DHCP Server sent a DHCPNACK message). 8/3/2011 10:03:49 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Users\Bishop\AppData\Local\Microsoft\Windows\UsrClass.dat' was corrupted and it has been recovered. Some data might have been lost. . ==== End Of File =========================== aswMBR version 0.9.8.978 Copyright© 2011 AVAST Software Run date: 2011-08-04 23:03:15 —————————– 23:03:15.901 OS Version: Windows 6.0.6002 Service Pack 2 23:03:15.901 Number of processors: 4 586 0xF07 23:03:15.901 ComputerName: BISHOP-PC UserName: Bishop 23:03:17.710 Initialize success 23:12:59.111 AVAST engine defs: 11080401 23:13:26.108 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 23:13:26.108 Disk 0 Vendor: ST350041 CC46 Size: 476940MB BusType: 3 23:13:26.124 Disk 0 MBR read successfully 23:13:26.124 Disk 0 MBR scan 23:13:26.124 Disk 0 unknown MBR code 23:13:26.124 Disk 0 scanning sectors +976768065 23:13:26.202 Disk 0 scanning C:\Windows\system32\drivers 23:13:36.404 Service scanning 23:13:37.106 Service KL1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5 23:13:37.106 Service kl2 C:\Windows\system32\DRIVERS\kl2.sys **LOCKED** 5 23:13:37.106 Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5 23:13:37.122 Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5 23:13:37.762 Modules scanning 23:13:42.098 Disk 0 trace - called modules: 23:13:42.114 ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys hal.dll 23:13:42.114 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x884e4400] 23:13:42.130 3 CLASSPNP.SYS[8c1668b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86db5030] 23:13:43.955 AVAST engine scan C:\Windows 23:13:46.217 AVAST engine scan C:\Windows\system32 23:15:36.680 AVAST engine scan C:\Windows\system32\drivers 23:15:47.522 AVAST engine scan C:\Users\Bishop 23:16:43.355 AVAST engine scan C:\ProgramData 23:19:53.347 Scan finished successfully 23:20:58.159 Disk 0 MBR has been saved successfully to "C:\Users\Bishop\Desktop\MBR.dat" 23:20:58.174 The log file has been saved successfully to "C:\Users\Bishop\Desktop\aswMBR.txt"
Post #6
Hi nonag

I still don’t see the problem except that the DCHP client service tried to renew its IP address and failed but this is not my area unless it is malware-related.

Let’s try another scan but you MUST disable TeaTimer and Windows Defender as well as your Kaspersky Security.

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

    [external image: Posted Image]


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [external image: Posted Image]


    Click on Yes, to continue scanning for malware.
Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Satchfan
Post #7
Hello nonag It has been several days since I posted instructions to help with your computer problem. Please let me know if you are having problems and still need help. Thanks Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI