What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Something's wrong..

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello all,
Curious if someone might be able to take a look at this. I've received your excellent help in the past with my home computer (which is still running fantastically btw, thank you so much). Now this is my computer at work which is having some issues the last few days. Frustrating to say the least as I can't get any work done :(

I left my computer on overnight last Thursday night while a project was finishing up rendering. Came in Friday morning to a computer that was completely frozen. Since that happened, I've since been experiencing VERY long boot up times, frequent memory errors, crazy long start-up times for any applications, constant application crashes, and overall crappy (non-existent) performance. I don't think I really had any problems like this since last Friday morning. Any help or suggestions would be much appreciated!

HJT Log:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:24:45 AM, on 10/4/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\xampplite\apache\bin\httpd.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
C:\xampplite\apache\bin\httpd.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Autodesk\3ds Max Design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe
C:\xampplite\mysql\bin\mysqld.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
C:\Program Files\Dell SAS RAID Storage Manager\Framework\VivaldiFramework.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Dell SAS RAID Storage Manager\JRE\bin\javaw.exe
C:\Program Files\Dell SAS RAID Storage Manager\MegaMonitor\mrmonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\NETGEAR\WG111T\wlan111t.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Autodesk\3ds Max Design 2012\3dsmax.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Documents and Settings\Andy\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andy\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andy\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andy\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andy\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andy\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0081207
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0081207
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://partnerpage.google.com/smallbiz.del…amp;ibd=0081207
F2 - REG:system.ini: UserInit=Userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WinZip Courier BHO - {A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} - C:\PROGRA~1\WINZIP~1\wzwmcie.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Popup] "C:\Program Files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [HPWQTOOLBOX] C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe "-i"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Andy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0FCB27D0-3397-498B-ACA6-E881421153AD} (HelpLauncher.ProjectDoxHelp) - https://plansonline.ggp.com/Plans/Resources…elpLauncher.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.4.8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1229092540562
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampplite\apache\bin\httpd.exe
O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Autodesk Content Service - Unknown owner - C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MRMonitor (MegaMonitorSrv) - Unknown owner - C:\Program Files\Dell SAS RAID Storage Manager\MegaMonitor\mrmonitor.exe
O23 - Service: mental ray 3.9 Satellite for Autodesk 3ds Max Design 2012 32-bit - English 32-bit (mi-raysat_3dsmax2012_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max Design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe
O23 - Service: SSMFramework (MSMFramework) - Unknown owner - C:\Program Files\Dell SAS RAID Storage Manager\Framework\VivaldiFramework.exe
O23 - Service: MySQL - MySQL AB - C:\xampplite\mysql\bin\mysqld.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDF Suite (pdfprint) - Wrocklage Intermedia GmbH - C:\Program Files\Wrocklage\pdfprint.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: SonicWALL Global VPN Client Service (SWGVCSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe

–
End of file - 12193 bytes
Post #2
Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT

Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
Post #3
Hello, Thanks you so much for the help. Sorry for the little delay, was out of town for the weekend. Below are the log's you requested. I"m hoping the Avast one is complete as is just sort of stopped without something saying "scan complete" or anything like that, but it gave me the option to save the log file… Thank you again :)


———- dds.txt ——–


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 9:03:01 on 2011-10-10
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1378 [GMT -4:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\xampplite\apache\bin\httpd.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
C:\xampplite\apache\bin\httpd.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Autodesk\3ds Max Design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe
C:\xampplite\mysql\bin\mysqld.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Dell SAS RAID Storage Manager\Framework\VivaldiFramework.exe
C:\Program Files\Dell SAS RAID Storage Manager\MegaMonitor\mrmonitor.exe
C:\Program Files\Dell SAS RAID Storage Manager\JRE\bin\javaw.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111T\wlan111t.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us-smb
uDefault_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client;=dell-usuk&channel;=us-smb&ibd;=0081207
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us-smb
mSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client;=dell-usuk&channel;=us-smb&ibd;=0081207
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
mWinlogon: Userinit=Userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: WinZip Courier BHO: {a8fb70fa-0fdf-4601-9dc4-bfa1b357204f} - c:\progra~1\winzip~1\wzwmcie.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\andy\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [Popup] "c:\program files\dell sas raid storage manager\megapopup\Popup.exe"
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [HPWQTOOLBOX] c:\program files\hewlett-packard\hp deskjet 9800 series\toolbox\HPWQTBX.exe "-i"
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoca~1.lnk - c:\program files\common files\autodesk shared\acstart17.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111t\wlan111t.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {0FCB27D0-3397-498B-ACA6-E881421153AD} - hxxps://plansonline.ggp.com/Plans/Resources/Help/en/HelpLauncher.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229092540562
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{175C2E08-AC7C-4EC7-AF15-EA68A9E815C8} : DhcpNameServer = 192.168.1.1
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
AppInit_DLLs: c:\progra~1\google\google~3\GOEC62~1.DLL
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
mASetup: Nitro PDF Professional - cscript //B "c:\program files\nitro pdf\professional\RemoveOldAddins.vbs"
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\andy\application data\mozilla\firefox\profiles\0ztaw4bn.default\
FF - plugin: c:\documents and settings\andy\local settings\application data\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\winzip courier\npwzwmc.dll
.
============= SERVICES / DRIVERS ===============
.
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\drivers\SWIPsec.sys [2010-2-2 87064]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-25 14336]
R2 Apache2.2;Apache2.2;c:\xampplite\apache\bin\httpd.exe [2011-5-5 29416]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 Autodesk Content Service;Autodesk Content Service;c:\program files\autodesk\content service\Connect.Service.ContentService.exe [2011-2-2 18656]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 mi-raysat_3dsmax2012_32;mental ray 3.9 Satellite for Autodesk 3ds Max Design 2012 32-bit - English 32-bit;c:\program files\autodesk\3ds max design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe [2011-2-23 86016]
R2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\sonicwall\sonicwall global vpn client\SWGVCSvc.exe [2009-3-6 227352]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2008-12-11 17149]
S0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys –> c:\windows\system32\drivers\nielprt.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-6 135664]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-12-7 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-6 135664]
S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys –> c:\windows\system32\drivers\nielgfx.sys [?]
S3 pdfprint;PDF Suite;c:\program files\wrocklage\pdfprint.exe [2010-4-13 50808]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys –> c:\windows\system32\drivers\wg111v2.sys [?]
S3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\drivers\SWVNIC.sys [2009-3-4 21016]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== File Associations ===============
.
.scr=AutoCADScriptFile
.
=============== Created Last 30 ================
.
2011-10-10 12:51:15 56200 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{80704254-8e23-489e-a289-4b98defc180f}\offreg.dll
2011-10-04 06:11:10 7269712 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{80704254-8e23-489e-a289-4b98defc180f}\mpengine.dll
2011-10-03 18:03:50 ——– d—–w- c:\windows\system32\wbem\repository\FS
2011-10-03 18:03:50 ——– d—–w- c:\windows\system32\wbem\Repository
2011-10-03 17:55:34 ——– d—–w- c:\program files\Free RAR Extract Frog
2011-09-17 21:51:39 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-09-17 21:51:37 89048 —-a-w- c:\program files\mozilla firefox\libEGL.dll
2011-09-17 21:51:37 785368 —-a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-09-17 21:51:37 478168 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-09-17 21:51:37 1846232 —-a-w- c:\program files\mozilla firefox\mozjs.dll
2011-09-17 21:51:37 15832 —-a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-09-17 21:51:36 2106216 —-a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-09-17 21:51:36 1998168 —-a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-09-16 15:05:04 ——– d—–w- C:\Riverview Examples
.
==================== Find3M ====================
.
2011-09-09 09:12:13 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-07-19 15:13:14 398760 —-a-r- c:\windows\system32\cpnprt2.cid
2011-07-15 13:29:31 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-13 21:52:54 71072 —-a-w- c:\windows\CouponPrinter.ocx
.
============= FINISH: 9:05:10.50 ===============


————– attach.txt —————

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 12/11/2008 11:11:32 AM
System Uptime: 10/10/2011 8:50:14 AM (1 hours ago)
.
Motherboard: Dell Inc. | | 0RW199
Processor: Intel® Xeon® CPU E5430 @ 2.66GHz | CPU | 2660/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 156.064 GiB free.
D: is CDROM (UDF)
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: SonicWALL Virtual NIC
Device ID: ROOT\SWVNIC\0000
Manufacturer: SonicWALL
Name: SonicWALL Virtual NIC
PNP Device ID: ROOT\SWVNIC\0000
Service: SWVNIC
.
==== System Restore Points ===================
.
RP681: 7/8/2011 6:25:39 PM - Software Distribution Service 3.0
RP682: 7/11/2011 12:24:33 PM - System Checkpoint
RP683: 7/12/2011 2:07:09 AM - Software Distribution Service 3.0
RP684: 7/13/2011 2:19:59 AM - System Checkpoint
RP685: 7/14/2011 2:50:58 AM - System Checkpoint
RP686: 7/15/2011 2:13:05 AM - Software Distribution Service 3.0
RP687: 7/16/2011 2:51:09 AM - System Checkpoint
RP688: 7/17/2011 3:03:08 AM - System Checkpoint
RP689: 7/18/2011 4:51:09 AM - System Checkpoint
RP690: 7/19/2011 2:08:52 AM - Software Distribution Service 3.0
RP691: 7/20/2011 3:58:55 AM - System Checkpoint
RP692: 7/21/2011 5:58:53 AM - System Checkpoint
RP693: 7/22/2011 2:09:20 AM - Software Distribution Service 3.0
RP694: 7/22/2011 5:22:18 PM - Software Distribution Service 3.0
RP695: 7/25/2011 11:46:11 AM - System Checkpoint
RP696: 7/26/2011 2:07:12 AM - Software Distribution Service 3.0
RP697: 7/27/2011 3:32:39 AM - System Checkpoint
RP698: 7/28/2011 3:44:38 AM - System Checkpoint
RP699: 7/29/2011 2:06:56 AM - Software Distribution Service 3.0
RP700: 7/30/2011 3:32:37 AM - System Checkpoint
RP701: 7/31/2011 3:44:36 AM - System Checkpoint
RP702: 8/1/2011 5:44:37 AM - System Checkpoint
RP703: 8/2/2011 2:07:03 AM - Software Distribution Service 3.0
RP704: 8/3/2011 2:40:36 AM - System Checkpoint
RP705: 8/4/2011 4:54:06 AM - System Checkpoint
RP706: 8/5/2011 2:01:19 AM - Software Distribution Service 3.0
RP707: 8/8/2011 10:36:18 AM - System Checkpoint
RP708: 8/9/2011 2:14:03 AM - Software Distribution Service 3.0
RP709: 8/10/2011 5:56:52 PM - System Checkpoint
RP710: 8/11/2011 6:27:50 PM - System Checkpoint
RP711: 8/12/2011 2:00:16 AM - Software Distribution Service 3.0
RP712: 8/12/2011 1:59:06 PM - Software Distribution Service 3.0
RP713: 8/15/2011 5:29:27 PM - System Checkpoint
RP714: 8/16/2011 2:25:59 AM - Software Distribution Service 3.0
RP715: 8/17/2011 2:26:14 AM - Software Distribution Service 3.0
RP716: 8/18/2011 3:04:37 AM - System Checkpoint
RP717: 8/19/2011 2:25:57 AM - Software Distribution Service 3.0
RP718: 8/22/2011 12:43:47 PM - System Checkpoint
RP719: 8/23/2011 12:58:43 PM - System Checkpoint
RP720: 8/24/2011 1:31:14 AM - Software Distribution Service 3.0
RP721: 8/25/2011 2:28:17 AM - System Checkpoint
RP722: 8/26/2011 2:05:00 AM - Software Distribution Service 3.0
RP723: 8/26/2011 5:33:08 PM - Software Distribution Service 3.0
RP724: 8/29/2011 11:47:24 AM - System Checkpoint
RP725: 8/30/2011 1:38:07 AM - Software Distribution Service 3.0
RP726: 8/31/2011 2:48:39 AM - System Checkpoint
RP727: 9/1/2011 4:59:32 AM - System Checkpoint
RP728: 9/2/2011 6:47:34 AM - System Checkpoint
RP729: 9/3/2011 1:37:34 AM - Software Distribution Service 3.0
RP730: 9/4/2011 2:45:15 AM - System Checkpoint
RP731: 9/5/2011 2:46:04 AM - System Checkpoint
RP732: 9/6/2011 2:57:15 AM - System Checkpoint
RP733: 9/6/2011 3:50:04 PM - Removed 3ds max 7
RP734: 9/6/2011 4:20:28 PM - Installed DirectX
RP735: 9/7/2011 2:11:58 AM - Software Distribution Service 3.0
RP736: 9/8/2011 3:15:05 AM - System Checkpoint
RP737: 9/9/2011 2:26:14 AM - Software Distribution Service 3.0
RP738: 9/10/2011 3:14:36 AM - System Checkpoint
RP739: 9/11/2011 5:02:32 AM - System Checkpoint
RP740: 9/12/2011 5:14:33 AM - System Checkpoint
RP741: 9/12/2011 10:32:32 AM - Removed WinZip 15.5
RP742: 9/13/2011 12:38:56 PM - System Checkpoint
RP743: 9/14/2011 2:09:37 AM - Software Distribution Service 3.0
RP744: 9/15/2011 2:58:09 AM - System Checkpoint
RP745: 9/16/2011 2:10:11 AM - Software Distribution Service 3.0
RP746: 9/17/2011 6:37:44 PM - System Checkpoint
RP747: 9/19/2011 8:26:52 AM - System Checkpoint
RP748: 9/20/2011 2:01:15 AM - Software Distribution Service 3.0
RP749: 9/21/2011 2:12:13 AM - System Checkpoint
RP750: 9/22/2011 3:41:34 AM - System Checkpoint
RP751: 9/23/2011 2:12:15 AM - Software Distribution Service 3.0
RP752: 9/24/2011 2:50:02 AM - System Checkpoint
RP753: 9/25/2011 4:34:47 AM - System Checkpoint
RP754: 9/26/2011 6:34:44 AM - System Checkpoint
RP755: 9/27/2011 2:22:02 AM - Software Distribution Service 3.0
RP756: 9/28/2011 2:33:38 AM - System Checkpoint
RP757: 9/29/2011 2:59:05 AM - System Checkpoint
RP758: 9/30/2011 2:25:17 AM - Software Distribution Service 3.0
RP759: 9/30/2011 9:15:04 AM - Installed Microsoft Fix it 50569
RP760: 9/30/2011 10:44:50 AM - Installed Microsoft Fix it 50569
RP761: 9/30/2011 5:59:41 PM - Software Distribution Service 3.0
RP762: 10/3/2011 1:34:25 PM - Restore Operation
RP763: 10/3/2011 1:52:41 PM - Restore Operation
RP764: 10/4/2011 2:10:56 AM - Software Distribution Service 3.0
RP765: 10/5/2011 3:28:15 AM - System Checkpoint
RP766: 10/6/2011 5:27:01 AM - System Checkpoint
RP767: 10/6/2011 5:30:54 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
µTorrent
7-Zip 9.20
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0
Adobe Reader 9.1
Akamai NetSession Interface
Aloaha Suite SDK
AutoCAD 2012 - English
AutoCAD 2012 Language Pack - English
AutoCAD Architecture 2012 - English
AutoCAD Architecture 2012 Language Pack - English
Autodesk 3ds Max Design 2012 32-bit - English
Autodesk Architectural Desktop 2007
Autodesk Backburner 2012.0.0
Autodesk Content Service
Autodesk DWF Viewer
Autodesk FBX Plug-in 2012.0 - 3ds Max Design 2012
Autodesk Inventor Fusion 2012
Autodesk Inventor Fusion 2012 Language Pack
Autodesk Material Library 2012
Autodesk Material Library Base Resolution Image Library 2012
Autodesk Material Library Low Resolution Image Library 2012
Autodesk Material Library Medium Resolution Image Library 2012
Autodesk Revit Architecture 2012
Autodesk Revit MEP 2012
Autodesk Revit Structure 2012
Autodesk Showcase 2012 32-bit - English
Autodesk SketchBook Designer 2012 - English
AviSynth 2.5
Basalite Online
Belden Online
Blender (remove only)
Broadcom ASF Management Applications
Broadcom Management Programs
Browser Address Error Redirector
Composite 2012
Core FTP LE 2.1
Coupon Printer for Windows
CutePDF Writer 2.7
Dell ETS Factory Installation
Dell SAS RAID Storage Manager
Dell SAS RAID Storage Manager v2.16-00
Dropbox
DVDStyler v1.7.4-1
DWG TrueView 2011
Easy DVD Creator 2.3.0
FARO LS 1.1.406.58
FBX Converter 2006.11.2
FileZilla Client 3.4.0
FontCreator 5.6
Forest Pack Lite 3.2.4
Fotosizer 1.31
Free RAR Extract Frog 1.00
Free WMA to MP3 Converter 1.16
Google Chrome
Google Desktop
Google Earth
Google SketchUp
Google SketchUp 8
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)
Hotfix for Windows Media Format SDK (KB942423)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB953955)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Deskjet 9800
HP Deskjet 9800 Series
ImgBurn
Inkscape 0.48.0
Intel® Matrix Storage Manager
Java Auto Updater
Java™ 6 Update 22
Java™ 6 Update 7
K-Lite Codec Pack 5.1.0 (Basic)
Lights and Plants Sample 1.0
Macromedia Flash MX 2004
Malwarebytes' Anti-Malware
MDO Desktop
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2008 x86 ATL Runtime 9.0.30729
Microsoft Visual C++ 2008 x86 CRT Runtime 9.0.30729
Microsoft Visual C++ 2008 x86 MFC Runtime 9.0.30729
Microsoft Visual C++ 2008 x86 OpenMP Runtime 9.0.30729
Microsoft Visual Studio Tools for Applications 2.0 - ENU
Microsoft Visual Studio Tools for Applications 2.0 Runtime
Mozilla Firefox 6.0.2 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB927977)
NETGEAR WG111T 108Mbps Wireless USB2.0 Adapter
Nitro PDF Professional
Notepad++
NVIDIA Drivers
Oce 9400-II
PDF to HTML
PDFIn PDF to DWG Converter
Podium
PowerDVD
Python 2.6.4
RAD Video Tools
Recuva (remove only)
Revit Architecture 2012
Revit Architecture 2012 Language Pack - English
Revit MEP 2012
Revit MEP 2012 Language Pack - English
Revit Structure 2012
Revit Structure 2012 Language Pack - English
Roxio Activation Module
Roxio Creator Audio
Roxio Creator BDAV Plugin
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Drag-to-Disc
Roxio Express Labeler 3
Roxio Update Manager
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553074)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft Office Excel 2007 (KB2553073)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2183461)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360131)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Slow Motion
Sonic CinePlayer Decoder Pack
SonicWALL Global VPN Client
SpyHunter
SUPERAntiSpyware
SWF Decompiler Premium [removed]
Texporter v3.5.18.7_x86
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Outlook 2007 (KB2583910)
Update for Outlook 2007 Junk Email Filter (KB2553110)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB898461)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
Update for Windows XP (KB980182)
V-Ray for SketchUp
VGEdit
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177
Vue 8 Infinite PLE 32bit
Vue 8 xStream PLE 32bit
W6400PG Printer Driver Extra Kit
WebFldrs XP
Windows Defender
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Live installer
Windows Live Messenger
Windows Media 8 Encoding Utility
Windows Media Encoder 9 Series
Windows Presentation Foundation
Windows Search 4.0
WinZip Courier
XML Paper Specification Shared Components Pack 1.0
Yahoo! Messenger
.
==== Event Viewer Messages From Past Week ========
.
10/4/2011 11:14:52 AM, error: Service Control Manager [7022] - The Autodesk Content Service service hung on starting.
10/3/2011 6:09:05 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
10/3/2011 2:11:21 PM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
10/3/2011 2:09:16 PM, error: Service Control Manager [7022] - The Windows Search service hung on starting.
10/3/2011 2:08:46 PM, error: Service Control Manager [7022] - The SonicWALL Global VPN Client Service service hung on starting.
10/3/2011 2:06:53 PM, error: WinDefend [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.113.359.0 Loading engine version: 1.1.7604.0
10/3/2011 1:34:04 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Search service to connect.
10/3/2011 1:34:04 PM, error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/3/2011 1:34:04 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
.
==== End Of File ===========================



————- aswMBR.txt ——————–

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-10-10 09:07:44
—————————–
09:07:44.690 OS Version: Windows 5.1.2600 Service Pack 3
09:07:44.690 Number of processors: 4 586 0x1706
09:07:44.690 ComputerName: MODEL UserName: Andy
09:07:45.909 Initialize success
09:20:20.175 AVAST engine defs: 11101000
09:23:08.690 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\SYMMPI1Port1Path0Target0Lun0
09:23:08.690 Disk 0 Vendor: ATA_____ A5BA Size: 238418MB BusType: 1
09:23:08.690 Device \Driver\SYMMPI -> DriverStartIo SCSIPORT.SYS b9d9740e
09:23:10.706 Disk 0 MBR read successfully
09:23:10.706 Disk 0 MBR scan
09:23:10.768 Disk 0 Windows VISTA default MBR code
09:23:10.784 Disk 0 scanning sectors +488263545
09:23:10.878 Disk 0 scanning C:\WINDOWS\system32\drivers
09:23:41.128 Service scanning
09:23:45.112 Modules scanning
09:24:13.940 Disk 0 trace - called modules:
09:24:13.971 ntkrnlpa.exe CLASSPNP.SYS disk.sys SCSIPORT.SYS hal.dll symmpi.sys
09:24:13.971 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8938a030]
09:24:14.003 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\Scsi\SYMMPI1Port1Path0Target0Lun0[0x89de6250]
09:24:21.815 AVAST engine scan C:\WINDOWS
09:25:17.550 AVAST engine scan C:\WINDOWS\system32
09:32:34.050 AVAST engine scan C:\WINDOWS\system32\drivers
09:32:58.237 AVAST engine scan C:\Documents and Settings\Andy
10:06:49.971 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Andy\Desktop\WTT Logs\MBR.dat"
10:06:50.065 The log file has been saved successfully to "C:\Documents and Settings\Andy\Desktop\WTT Logs\aswMBR.txt"
Post #4
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
Thank you again for your help.. I attempted to do as instructed. Combofix downloaded and started to run. Windows recovery downloaded and installed by combofix. Combofix ran up to about "stage 23" maybe a bit further, but that's the last stage I noticed. Then WHAM! blue screen.. "A problem has been detected and windows has been shut down to prevent damage to your computer… etc." restart the system and it took a while to get up and going then a message "windows has recovered from a serious error… etc" Did not try to re-run combofix per the instructions.
Post #6
Hi,

Please boot into safe mode and try it from safe mode


To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account
Post #7
Seemed to work much better in safe mode, although it took a month of Sundays to finish. Log below.


ComboFix 11-10-10.02 - Andy 10/10/2011 17:54:14.2.4 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1698 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\spool\prtprocs\w32x86\9X00S.DLL
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_USNJSVC
——-\Service_usnjsvc
.
.
((((((((((((((((((((((((( Files Created from 2011-09-10 to 2011-10-10 )))))))))))))))))))))))))))))))
.
.
2011-10-10 22:19 . 2011-10-10 22:19 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{E73F5032-E1A1-46C5-84E5-B2560994C277}\offreg.dll
2011-10-10 13:12 . 2011-09-21 13:00 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{E73F5032-E1A1-46C5-84E5-B2560994C277}\mpengine.dll
2011-10-04 18:28 . 2011-10-04 18:28 ——– d—–w- c:\program files\7-Zip
2011-10-03 18:03 . 2011-10-03 18:03 ——– d—–w- c:\windows\system32\wbem\Repository
2011-10-03 17:55 . 2011-10-03 17:55 ——– d—–w- c:\program files\Free RAR Extract Frog
2011-09-17 21:51 . 2011-09-03 06:01 134104 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-09-17 21:51 . 2011-09-03 06:01 89048 —-a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-09-17 21:51 . 2011-09-03 06:01 785368 —-a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-09-17 21:51 . 2011-09-03 06:01 478168 —-a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-09-17 21:51 . 2011-09-03 06:01 1846232 —-a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-09-17 21:51 . 2011-09-03 06:01 15832 —-a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-09-17 21:51 . 2011-09-02 23:26 2106216 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-09-17 21:51 . 2011-09-02 23:26 1998168 —-a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-09-16 15:05 . 2011-09-16 15:06 ——– d—–w- C:\Riverview Examples
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-06 22:07 . 2011-09-06 20:26 416 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2011-09-21 13:00 . 2009-03-26 13:31 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-09-09 09:12 . 2008-04-25 16:16 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-06 22:31 . 2011-09-06 22:31 348256 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\Structure2012\9.0\1033\ResourceCache.dll
2011-09-06 21:54 . 2011-09-06 21:54 348256 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\MEP2012\9.0\1033\ResourceCache.dll
2011-09-06 20:56 . 2011-09-06 20:56 348256 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\Architecture2012\9.0\1033\ResourceCache.dll
2011-07-19 15:13 . 2011-07-19 15:13 398760 —-a-r- c:\windows\system32\cpnprt2.cid
2011-07-15 13:29 . 2008-04-25 16:16 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-13 21:52 . 2011-02-14 22:05 71072 —-a-w- c:\windows\CouponPrinter.ocx
2011-09-03 06:01 . 2011-09-17 21:51 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Andy\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Andy\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Andy\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Andy\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-07 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-10-03 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-09-19 1015808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-15 8523776]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"Popup"="c:\program files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exe" [2007-07-20 77922]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-24 30192]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"HPWQTOOLBOX"="c:\program files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe" [2005-06-01 335872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-11 113664]
AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart17.exe [2006-3-5 11000]
NETGEAR WG111T Smart Wizard.lnk - c:\program files\NETGEAR\WG111T\wlan111t.exe [2008-12-11 884840]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell SAS RAID Storage Manager\\MegaPopup\\popup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Deskjet 9800 Series\\Toolbox\\HPWQTBX.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVC.exe"=
"c:\\Program Files\\Wrocklage\\creator.exe"=
"c:\\Program Files\\Common Files\\aloaha\\CertInstaller.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Documents and Settings\\Andy\\My Documents\\Downloads\\utorrent.exe"=
"c:\\Program Files\\Google\\Google SketchUp 8\\SketchUp.exe"=
"c:\\Documents and Settings\\Andy\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\CoreFTP\\coreftp.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Autodesk\\3ds Max Design 2012\\mentalimages\\satellite\\raysat_3dsmax2012_32server.exe"=
"c:\\Program Files\\Autodesk\\3ds Max Design 2012\\mentalimages\\satellite\\raysat_3dsmax2012_32.exe"=
"c:\\Program Files\\Autodesk\\3ds Max Design 2012\\3dsmax.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\drivers\SWIPsec.sys [2/2/2010 10:00 AM 87064]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/25/2008 12:16 PM 14336]
R2 Apache2.2;Apache2.2;c:\xampplite\apache\bin\httpd.exe [5/5/2011 10:12 AM 29416]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [6/20/2007 4:30 PM 79168]
R2 Autodesk Content Service;Autodesk Content Service;c:\program files\Autodesk\Content Service\Connect.Service.ContentService.exe [2/2/2011 2:08 PM 18656]
R2 mi-raysat_3dsmax2012_32;mental ray 3.9 Satellite for Autodesk 3ds Max Design 2012 32-bit - English 32-bit;c:\program files\Autodesk\3ds Max Design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe [2/23/2011 7:59 AM 86016]
R2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [3/6/2009 12:57 AM 227352]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [12/11/2008 4:36 PM 17149]
S0 nielprt;Nielsen Patch Service;c:\windows\system32\DRIVERS\nielprt.sys –> c:\windows\system32\DRIVERS\nielprt.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/6/2010 1:15 PM 135664]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [12/7/2008 4:26 AM 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/6/2010 1:15 PM 135664]
S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys –> c:\windows\system32\drivers\nielgfx.sys [?]
S3 pdfprint;PDF Suite;c:\program files\Wrocklage\pdfprint.exe [4/13/2010 5:28 PM 50808]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys –> c:\windows\system32\DRIVERS\wg111v2.sys [?]
S3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\drivers\SWVNIC.sys [3/4/2009 7:03 PM 21016]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-07 13:55]
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 17:14]
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 17:14]
.
2011-10-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1682135861-2545026859-4075531753-1005Core.job
- c:\documents and settings\Andy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-28 14:45]
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1682135861-2545026859-4075531753-1005UA.job
- c:\documents and settings\Andy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-28 14:45]
.
2011-10-10 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0081207
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
DPF: {0FCB27D0-3397-498B-ACA6-E881421153AD} - hxxps://plansonline.ggp.com/Plans/Resources/Help/en/HelpLauncher.cab
FF - ProfilePath - c:\documents and settings\Andy\Application Data\Mozilla\Firefox\Profiles\0ztaw4bn.default\
.
.
——- File Associations ——-
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
HKLM_ActiveSetup-Nitro PDF Professional - //B
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-10 18:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1416)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3948)
c:\windows\system32\WININET.dll
c:\windows\system32\AcSignIcon.dll
c:\documents and settings\Andy\Application Data\Dropbox\bin\DropboxExt.14.dll
c:\program files\Autodesk\Inventor Fusion 2012\AcSignCore16.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\xampplite\mysql\bin\mysqld.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Dell SAS RAID Storage Manager\Framework\VivaldiFramework.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Dell SAS RAID Storage Manager\JRE\bin\javaw.exe
c:\program files\Dell SAS RAID Storage Manager\MegaMonitor\mrmonitor.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Completion time: 2011-10-10 18:30:43 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-10 22:30
.
Pre-Run: 170,731,810,816 bytes free
Post-Run: 170,471,280,640 bytes free
.
- - End Of File - - 54D146FE1704567F21359B76A9C22CBF
Post #8
Hi,

Please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Post #9
Well, looks like malwarebytes didn't come up with anything at all.
Eset grabbed a few things… Log's below.

MBytes Log
—————————————————————————–

Internet Explorer 8.0.6001.18702

10/11/2011 6:30:22 PM
mbam-log-2011-10-11 (18-30-22).txt

Scan type: Quick scan
Objects scanned: 225457
Time elapsed: 4 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Eset log
—————————————————


C:\Documents and Settings\All Users\Desktop\Andy's carp**\Computer Store\desk-mess.zip PHP/Kryptik.AB trojan deleted - quarantined
C:\Documents and Settings\Andy\Application Data\Sun\Java\Deployment\cache\6.0\3\79b0fdc3-62f90b92 multiple threats deleted - quarantined
C:\Documents and Settings\Andy\Application Data\Sun\Java\Deployment\cache\6.0\38\164fdd66-46cec370 multiple threats deleted - quarantined
C:\Documents and Settings\Andy\Application Data\Sun\Java\Deployment\cache\6.0\4\8f85c44-64549406 multiple threats deleted - quarantined
C:\Documents and Settings\Andy\Application Data\Sun\Java\Deployment\cache\6.0\55\5faf9cf7-5befaf37 a variant of Java/TrojanDownloader.OpenStream.NBV trojan deleted - quarantined
C:\Documents and Settings\Andy\Application Data\Sun\Java\Deployment\cache\6.0\61\204ab4bd-50ad4d2d multiple threats deleted - quarantined
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP763\A0097750.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP768\A0099795.exe Win32/OpenCandy application deleted - quarantined
Post #10
Hi,

Please do the following

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 7 and save it to your desktop.
  • Scroll down to where it says JDK 7 (JDK or JRE)
  • Click the Download JDK button tunderneath
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "Oracle Binary Code License Agreement for Java SE ". Click on Continue. The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7-windows-i586.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT


Please post a fresh DDS Log and advise how the computer is running now and if there are any outstanding issues.
Post #11
Hello, sorry for the delay. got kind of wrapped up :/ Attached are fresh dds logs after adobe and java updates. System seems to be going alright so far.. boots up faster than it was and I haven't had AutoCAD or 3DS Max crash on me in a couple days… Which is a good thing! Thanks so much for your help.. . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.0.0 Run by [removed] at 11:37:57 on 2011-10-14 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1054 [GMT -4:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\System32\svchost.exe -k Akamai C:\xampplite\apache\bin\httpd.exe C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe C:\xampplite\apache\bin\httpd.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Autodesk\3ds Max Design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe C:\xampplite\mysql\bin\mysqld.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe C:\Program Files\Dell SAS RAID Storage Manager\Framework\VivaldiFramework.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Dell SAS RAID Storage Manager\JRE\bin\javaw.exe C:\Program Files\Dell SAS RAID Storage Manager\MegaMonitor\mrmonitor.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files\Hewlett-Packard\HP Deskjet 9800 Series\Toolbox\HPWQTBX.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NETGEAR\WG111T\wlan111t.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Java\jre7\bin\jqs.exe C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Common Files\Autodesk Shared\WSCommCntr3\lib\WSCommCntr3.exe C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE C:\WINDOWS\system32\rundll32.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ mSearch Bar = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0081207 uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: WinZip Courier BHO: {a8fb70fa-0fdf-4601-9dc4-bfa1b357204f} - c:\progra~1\winzip~1\wzwmcie.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe" mRun: [Popup] "c:\program files\dell sas raid storage manager\megapopup\Popup.exe" mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe" mRun: [HPWQTOOLBOX] c:\program files\hewlett-packard\hp deskjet 9800 series\toolbox\HPWQTBX.exe "-i" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoca~1.lnk - c:\program files\common files\autodesk shared\acstart17.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111t\wlan111t.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {0FCB27D0-3397-498B-ACA6-E881421153AD} - hxxps://plansonline.ggp.com/Plans/Resources/Help/en/HelpLauncher.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229092540562 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{175C2E08-AC7C-4EC7-AF15-EA68A9E815C8} : DhcpNameServer = 192.168.1.1 Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\andy\application data\mozilla\firefox\profiles\0ztaw4bn.default\ . ============= SERVICES / DRIVERS =============== . R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656] R1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\drivers\SWIPsec.sys [2010-2-2 87064] R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-25 14336] R2 Apache2.2;Apache2.2;c:\xampplite\apache\bin\httpd.exe [2011-5-5 29416] R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168] R2 Autodesk Content Service;Autodesk Content Service;c:\program files\autodesk\content service\Connect.Service.ContentService.exe [2011-2-2 18656] R2 mi-raysat_3dsmax2012_32;mental ray 3.9 Satellite for Autodesk 3ds Max Design 2012 32-bit - English 32-bit;c:\program files\autodesk\3ds max design 2012\mentalimages\satellite\raysat_3dsmax2012_32server.exe [2011-2-23 86016] R2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\sonicwall\sonicwall global vpn client\SWGVCSvc.exe [2009-3-6 227352] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2008-12-11 17149] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys –> c:\windows\system32\drivers\nielprt.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-6 135664] S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-12-7 30192] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-6 135664] S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys –> c:\windows\system32\drivers\nielgfx.sys [?] S3 pdfprint;PDF Suite;c:\program files\wrocklage\pdfprint.exe [2010-4-13 50808] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys –> c:\windows\system32\drivers\wg111v2.sys [?] S3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\drivers\SWVNIC.sys [2009-3-4 21016] . =============== File Associations =============== . .scr=AutoCADScriptFile . =============== Created Last 30 ================ . 2011-10-14 15:35:55 ——– d—–w- c:\documents and settings\andy\local settings\application data\Sun 2011-10-14 15:28:00 611224 —-a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll 2011-10-14 15:28:00 128000 —-a-w- c:\windows\system32\javacpl.cpl 2011-10-14 15:22:11 56200 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{bb3732df-e34b-4204-82e2-3bed2214945c}\offreg.dll 2011-10-13 20:29:50 ——– d—–w- c:\program files\Citrix 2011-10-13 20:29:13 ——– d—–w- c:\documents and settings\andy\local settings\application data\Citrix 2011-10-13 20:29:11 110456 —-a-w- c:\documents and settings\andy\g2ax_customer_downloadhelper_win32_x86.exe 2011-10-12 13:19:43 ——– d—–w- c:\program files\ESET 2011-10-12 05:33:37 7269712 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{bb3732df-e34b-4204-82e2-3bed2214945c}\mpengine.dll 2011-10-10 19:16:23 ——– d-sha-r- C:\cmdcons 2011-10-10 19:07:33 98816 —-a-w- c:\windows\sed.exe 2011-10-10 19:07:33 518144 —-a-w- c:\windows\SWREG.exe 2011-10-10 19:07:33 256000 —-a-w- c:\windows\PEV.exe 2011-10-10 19:07:33 208896 —-a-w- c:\windows\MBR.exe 2011-10-03 18:03:50 ——– d—–w- c:\windows\system32\wbem\repository\FS 2011-10-03 18:03:50 ——– d—–w- c:\windows\system32\wbem\Repository 2011-10-03 17:55:34 ——– d—–w- c:\program files\Free RAR Extract Frog 2011-09-17 21:51:39 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-09-17 21:51:37 89048 —-a-w- c:\program files\mozilla firefox\libEGL.dll 2011-09-17 21:51:37 785368 —-a-w- c:\program files\mozilla firefox\mozsqlite3.dll 2011-09-17 21:51:37 478168 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll 2011-09-17 21:51:37 1846232 —-a-w- c:\program files\mozilla firefox\mozjs.dll 2011-09-17 21:51:37 15832 —-a-w- c:\program files\mozilla firefox\mozalloc.dll 2011-09-17 21:51:36 2106216 —-a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll 2011-09-17 21:51:36 1998168 —-a-w- c:\program files\mozilla firefox\d3dx9_43.dll 2011-09-16 15:05:04 ——– d—–w- C:\Riverview Examples . ==================== Find3M ==================== . 2011-10-14 15:27:23 544656 —-a-w- c:\windows\system32\deployJava1.dll 2011-09-09 09:12:13 599040 —-a-w- c:\windows\system32\crypt32.dll 2011-08-31 21:00:50 22216 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-07-19 15:13:14 398760 —-a-r- c:\windows\system32\cpnprt2.cid . ============= FINISH: 11:40:43.59 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 12/11/2008 11:11:32 AM System Uptime: 10/14/2011 11:21:22 AM (0 hours ago) . Motherboard: Dell Inc. | | 0RW199 Processor: Intel® Xeon® CPU E5430 @ 2.66GHz | CPU | 2660/1333mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 233 GiB total, 157.674 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: SonicWALL Virtual NIC Device ID: ROOT\SWVNIC\0000 Manufacturer: SonicWALL Name: SonicWALL Virtual NIC PNP Device ID: ROOT\SWVNIC\0000 Service: SWVNIC . ==== System Restore Points =================== . RP688: 7/17/2011 3:03:08 AM - System Checkpoint RP689: 7/18/2011 4:51:09 AM - System Checkpoint RP690: 7/19/2011 2:08:52 AM - Software Distribution Service 3.0 RP691: 7/20/2011 3:58:55 AM - System Checkpoint RP692: 7/21/2011 5:58:53 AM - System Checkpoint RP693: 7/22/2011 2:09:20 AM - Software Distribution Service 3.0 RP694: 7/22/2011 5:22:18 PM - Software Distribution Service 3.0 RP695: 7/25/2011 11:46:11 AM - System Checkpoint RP696: 7/26/2011 2:07:12 AM - Software Distribution Service 3.0 RP697: 7/27/2011 3:32:39 AM - System Checkpoint RP698: 7/28/2011 3:44:38 AM - System Checkpoint RP699: 7/29/2011 2:06:56 AM - Software Distribution Service 3.0 RP700: 7/30/2011 3:32:37 AM - System Checkpoint RP701: 7/31/2011 3:44:36 AM - System Checkpoint RP702: 8/1/2011 5:44:37 AM - System Checkpoint RP703: 8/2/2011 2:07:03 AM - Software Distribution Service 3.0 RP704: 8/3/2011 2:40:36 AM - System Checkpoint RP705: 8/4/2011 4:54:06 AM - System Checkpoint RP706: 8/5/2011 2:01:19 AM - Software Distribution Service 3.0 RP707: 8/8/2011 10:36:18 AM - System Checkpoint RP708: 8/9/2011 2:14:03 AM - Software Distribution Service 3.0 RP709: 8/10/2011 5:56:52 PM - System Checkpoint RP710: 8/11/2011 6:27:50 PM - System Checkpoint RP711: 8/12/2011 2:00:16 AM - Software Distribution Service 3.0 RP712: 8/12/2011 1:59:06 PM - Software Distribution Service 3.0 RP713: 8/15/2011 5:29:27 PM - System Checkpoint RP714: 8/16/2011 2:25:59 AM - Software Distribution Service 3.0 RP715: 8/17/2011 2:26:14 AM - Software Distribution Service 3.0 RP716: 8/18/2011 3:04:37 AM - System Checkpoint RP717: 8/19/2011 2:25:57 AM - Software Distribution Service 3.0 RP718: 8/22/2011 12:43:47 PM - System Checkpoint RP719: 8/23/2011 12:58:43 PM - System Checkpoint RP720: 8/24/2011 1:31:14 AM - Software Distribution Service 3.0 RP721: 8/25/2011 2:28:17 AM - System Checkpoint RP722: 8/26/2011 2:05:00 AM - Software Distribution Service 3.0 RP723: 8/26/2011 5:33:08 PM - Software Distribution Service 3.0 RP724: 8/29/2011 11:47:24 AM - System Checkpoint RP725: 8/30/2011 1:38:07 AM - Software Distribution Service 3.0 RP726: 8/31/2011 2:48:39 AM - System Checkpoint RP727: 9/1/2011 4:59:32 AM - System Checkpoint RP728: 9/2/2011 6:47:34 AM - System Checkpoint RP729: 9/3/2011 1:37:34 AM - Software Distribution Service 3.0 RP730: 9/4/2011 2:45:15 AM - System Checkpoint RP731: 9/5/2011 2:46:04 AM - System Checkpoint RP732: 9/6/2011 2:57:15 AM - System Checkpoint RP733: 9/6/2011 3:50:04 PM - Removed 3ds max 7 RP734: 9/6/2011 4:20:28 PM - Installed DirectX RP735: 9/7/2011 2:11:58 AM - Software Distribution Service 3.0 RP736: 9/8/2011 3:15:05 AM - System Checkpoint RP737: 9/9/2011 2:26:14 AM - Software Distribution Service 3.0 RP738: 9/10/2011 3:14:36 AM - System Checkpoint RP739: 9/11/2011 5:02:32 AM - System Checkpoint RP740: 9/12/2011 5:14:33 AM - System Checkpoint RP741: 9/12/2011 10:32:32 AM - Removed WinZip 15.5 RP742: 9/13/2011 12:38:56 PM - System Checkpoint RP743: 9/14/2011 2:09:37 AM - Software Distribution Service 3.0 RP744: 9/15/2011 2:58:09 AM - System Checkpoint RP745: 9/16/2011 2:10:11 AM - Software Distribution Service 3.0 RP746: 9/17/2011 6:37:44 PM - System Checkpoint RP747: 9/19/2011 8:26:52 AM - System Checkpoint RP748: 9/20/2011 2:01:15 AM - Software Distribution Service 3.0 RP749: 9/21/2011 2:12:13 AM - System Checkpoint RP750: 9/22/2011 3:41:34 AM - System Checkpoint RP751: 9/23/2011 2:12:15 AM - Software Distribution Service 3.0 RP752: 9/24/2011 2:50:02 AM - System Checkpoint RP753: 9/25/2011 4:34:47 AM - System Checkpoint RP754: 9/26/2011 6:34:44 AM - System Checkpoint RP755: 9/27/2011 2:22:02 AM - Software Distribution Service 3.0 RP756: 9/28/2011 2:33:38 AM - System Checkpoint RP757: 9/29/2011 2:59:05 AM - System Checkpoint RP758: 9/30/2011 2:25:17 AM - Software Distribution Service 3.0 RP759: 9/30/2011 9:15:04 AM - Installed Microsoft Fix it 50569 RP760: 9/30/2011 10:44:50 AM - Installed Microsoft Fix it 50569 RP761: 9/30/2011 5:59:41 PM - Software Distribution Service 3.0 RP762: 10/3/2011 1:34:25 PM - Restore Operation RP763: 10/3/2011 1:52:41 PM - Restore Operation RP764: 10/4/2011 2:10:56 AM - Software Distribution Service 3.0 RP765: 10/5/2011 3:28:15 AM - System Checkpoint RP766: 10/6/2011 5:27:01 AM - System Checkpoint RP767: 10/6/2011 5:30:54 PM - Software Distribution Service 3.0 RP768: 10/10/2011 9:12:30 AM - Software Distribution Service 3.0 RP769: 10/11/2011 1:07:46 PM - System Checkpoint RP770: 10/12/2011 1:33:27 AM - Software Distribution Service 3.0 RP771: 10/13/2011 3:26:30 AM - System Checkpoint RP772: 10/14/2011 5:13:25 AM - System Checkpoint RP773: 10/14/2011 10:57:11 AM - Removed Adobe Reader 9.1. RP774: 10/14/2011 11:12:49 AM - Removed Java™ 6 Update 7 RP775: 10/14/2011 11:14:30 AM - Removed Java™ 6 Update 22 RP776: 10/14/2011 11:27:01 AM - Installed Java™ 7 . ==== Installed Programs ====================== . µTorrent 7-Zip 9.20 Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Photoshop 7.0 Adobe Reader X (10.1.1) Akamai NetSession Interface Aloaha Suite SDK AutoCAD 2012 - English AutoCAD 2012 - English SP1 AutoCAD 2012 Language Pack - English AutoCAD Architecture 2012 - English AutoCAD Architecture 2012 Language Pack - English Autodesk 3ds Max Design 2012 32-bit - English Autodesk Architectural Desktop 2007 Autodesk Backburner 2012.0.0 Autodesk Content Service Autodesk DWF Viewer Autodesk FBX Plug-in 2012.0 - 3ds Max Design 2012 Autodesk Inventor Fusion 2012 Autodesk Inventor Fusion 2012 Language Pack Autodesk Material Library 2012 Autodesk Material Library Base Resolution Image Library 2012 Autodesk Material Library Low Resolution Image Library 2012 Autodesk Material Library Medium Resolution Image Library 2012 Autodesk Revit Architecture 2012 Autodesk Revit MEP 2012 Autodesk Revit Structure 2012 Autodesk Showcase 2012 32-bit - English Autodesk SketchBook Designer 2012 - English AviSynth 2.5 Basalite Online Belden Online Blender (remove only) Broadcom ASF Management Applications Broadcom Management Programs Browser Address Error Redirector Composite 2012 Core FTP LE 2.1 Coupon Printer for Windows CutePDF Writer 2.7 Dell ETS Factory Installation Dell SAS RAID Storage Manager Dell SAS RAID Storage Manager v2.16-00 Dropbox DVDStyler v1.7.4-1 DWG TrueView 2011 Easy DVD Creator 2.3.0 ESET Online Scanner v3 FARO LS 1.1.406.58 FBX Converter 2006.11.2 FileZilla Client 3.4.0 FontCreator 5.6 Forest Pack Lite 3.2.4 Fotosizer 1.31 Free RAR Extract Frog 1.00 Free WMA to MP3 Converter 1.16 Google Chrome Google Desktop Google Earth Google SketchUp Google SketchUp 8 Google Toolbar for Internet Explorer Google Update Helper Google Updater Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540) Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) Hotfix for Windows Media Format SDK (KB942423) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB915800-v4) Hotfix for Windows XP (KB942288-v3) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB953955) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP Deskjet 9800 HP Deskjet 9800 Series ImgBurn Inkscape 0.48.0 Intel® Matrix Storage Manager Java Auto Updater Java™ 7 K-Lite Codec Pack 5.1.0 (Basic) Lights and Plants Sample 1.0 Macromedia Flash MX 2004 Malwarebytes' Anti-Malware version 1.51.2.1300 MDO Desktop Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2416447) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Excel MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Small Business 2007 Microsoft Office Word MUI (English) 2007 Microsoft Software Update for Web Folders (English) 12 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2008 x86 ATL Runtime 9.0.30729 Microsoft Visual C++ 2008 x86 CRT Runtime 9.0.30729 Microsoft Visual C++ 2008 x86 MFC Runtime 9.0.30729 Microsoft Visual C++ 2008 x86 OpenMP Runtime 9.0.30729 Microsoft Visual Studio Tools for Applications 2.0 - ENU Microsoft Visual Studio Tools for Applications 2.0 Runtime Mozilla Firefox 6.0.2 (x86 en-US) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 6.0 Parser (KB927977) NETGEAR WG111T 108Mbps Wireless USB2.0 Adapter Nitro PDF Professional Notepad++ NVIDIA Drivers Oce 9400-II PDF to HTML PDFIn PDF to DWG Converter Podium PowerDVD Python 2.6.4 RAD Video Tools Recuva (remove only) Revit Architecture 2012 Revit Architecture 2012 Language Pack - English Revit MEP 2012 Revit MEP 2012 Language Pack - English Revit Structure 2012 Revit Structure 2012 Language Pack - English Roxio Activation Module Roxio Creator Audio Roxio Creator BDAV Plugin Roxio Creator Copy Roxio Creator Data Roxio Creator DE Roxio Creator Tools Roxio Drag-to-Disc Roxio Express Labeler 3 Roxio Update Manager Security Update for 2007 Microsoft Office System (KB2288621) Security Update for 2007 Microsoft Office System (KB2288931) Security Update for 2007 Microsoft Office System (KB2345043) Security Update for 2007 Microsoft Office System (KB2553074) Security Update for 2007 Microsoft Office System (KB2553089) Security Update for 2007 Microsoft Office System (KB2553090) Security Update for 2007 Microsoft Office System (KB2584063) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft Office Excel 2007 (KB2553073) Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office PowerPoint 2007 (KB2535818) Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623) Security Update for Microsoft Office Publisher 2007 (KB2284697) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB2344993) Security Update for Windows Internet Explorer 8 (KB2360131) Security Update for Windows Internet Explorer 8 (KB2416400) Security Update for Windows Internet Explorer 8 (KB2482017) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2530548) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2559049) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Encoder (KB2447961) Security Update for Windows Media Encoder (KB954156) Security Update for Windows Media Encoder (KB979332) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player (KB979402) Security Update for Windows Search 4 - KB963093 Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2183461) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2296199) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360131) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2436673) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479628) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485376) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2491683) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969897) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972260) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974455) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB976325) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981349) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982381) Security Update for Windows XP (KB982665) Security Update for Windows XP (KB982802) Slow Motion Sonic CinePlayer Decoder Pack SonicWALL Global VPN Client SpyHunter SUPERAntiSpyware SWF Decompiler Premium [removed] Texporter v3.5.18.7_x86 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Microsoft Office 2007 System (KB2539530) Update for Microsoft Office Outlook 2007 (KB2583910) Update for Outlook 2007 Junk Email Filter (KB2553110) Update for Windows Internet Explorer 8 (KB2447568) Update for Windows Internet Explorer 8 (KB976662) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2541763) Update for Windows XP (KB2616676-v2) Update for Windows XP (KB898461) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951618-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Update for Windows XP (KB976749) Update for Windows XP (KB978207) Update for Windows XP (KB980182) V-Ray for SketchUp VGEdit Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 Vue 8 Infinite PLE 32bit Vue 8 xStream PLE 32bit W6400PG Printer Driver Extra Kit WebFldrs XP Windows Defender Windows Genuine Advantage Notifications (KB905474) Windows Internet Explorer 8 Windows Live installer Windows Live Messenger Windows Media 8 Encoding Utility Windows Media Encoder 9 Series Windows Presentation Foundation Windows Search 4.0 WinZip Courier XML Paper Specification Shared Components Pack 1.0 Yahoo! Messenger . ==== Event Viewer Messages From Past Week ======== . 10/10/2011 8:53:35 AM, error: Service Control Manager [7022] - The Autodesk Content Service service hung on starting. 10/10/2011 5:51:55 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL SWIPsec Tcpip 10/10/2011 5:51:55 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 10/10/2011 5:51:55 PM, error: Service Control Manager [7001] - The MySQL service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 10/10/2011 5:51:55 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 10/10/2011 5:51:55 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 10/10/2011 5:51:55 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 10/10/2011 5:51:55 PM, error: Service Control Manager [7001] - The Apache2.2 service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 10/10/2011 5:51:41 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 10/10/2011 5:51:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 10/10/2011 3:49:07 PM, error: System Error [1003] - Error code 000000ca, parameter1 00000004, parameter2 858911d8, parameter3 00000000, parameter4 00000000. 10/10/2011 3:32:47 PM, error: Service Control Manager [7034] - The SSMFramework service terminated unexpectedly. It has done this 1 time(s). 10/10/2011 3:32:47 PM, error: Service Control Manager [7034] - The MRMonitor service terminated unexpectedly. It has done this 1 time(s). 10/10/2011 3:32:46 PM, error: Service Control Manager [7034] - The mental ray 3.9 Satellite for Autodesk 3ds Max Design 2012 32-bit - English 32-bit service terminated unexpectedly. It has done this 1 time(s). . ==== End Of File ===========================
Post #12
Hi,

We just have some housekeeping to do now,

Please do the following:


You can delete the DDS and aswMBR logs and programs from your desktop.


NEXT

Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


If there are any logs/tools remaining on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    It's normal after running TFC cleaner that the PC will be slower to boot the first time.

  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #13
Thanks much, will do all of this cleanup in a matter of minutes! quick question.. any thing you would recommend regarding virus protection? I've used Norton in the past but it really seemed to bog things down. Have tried a couple free things for a while like AVG and such… Any recommendation as to what is better than others as far as being light weight, but effective (and cost effective as well)? Thanks again!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI