Hi, My name is Peter and I had one of my Wordpress websites hacked.
It was suggested to me that it may have come from my own computer.
I followed some advice and cleaned my computer using Emsisoft and Malwarebytes (have logs) and was then told I should scan Rootkit in my computer.
I have no idea about this but checked online and saw something regarding a DDS scan - which I did (results below).
So my questions relate to whether I have problems there.
I also searched and ran a scan from a program called Gmer - and have a file for that - but I really have no idea about what I am doing.
So any help would be greatly appreciated - especially if I have done something wrong with any of your steps - it would be nice to know.
Thanking you in advance,
Peter.
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Run by [removed] at 8:37:58 on 2012-01-25
Microsoft Windows 7 Professional 6.1.7601.1.1252.61.1033.18.1983.329 [GMT 11:00]
.
AV: Emsisoft Anti-Malware *Enabled/Updated* {0ADC9F7D-20C1-240F-01E2-43466EBA893A}
AV: Kaspersky Internet Security *Enabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Kaspersky Internet Security *Enabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Emsisoft Anti-Malware *Enabled/Updated* {B1BD7E99-06FB-2B81-3B52-7834153DC387}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Emsisoft Anti-Malware\a2service.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Windows\system32\IoctlSvc.exe
C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Windows\system32\CNAB3RPK.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\MindMovies\Subliminal\SubVid.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Logitech\Logitech Vid\Vid.exe
C:\Program Files\TechSmith\Jing\Jing.exe
C:\Program Files\Samsung\Samsung PC Studio 7\PCSuite.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\Windows\system32\Macromed\Flash\FlashUtil11e_ActiveX.exe
C:\Windows\system32\msiexec.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://au.yahoo.com/
uInternet Settings,ProxyServer = 192.168.160.1:800
uInternet Settings,ProxyOverride = *.local;
uURLSearchHooks: H - No File
mURLSearchHooks: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
mURLSearchHooks: P2P Energy Toolbar: {2bae58c2-79f9-45d1-a286-81f911301c3a} - c:\program files\p2p_energy\tbP2P_.dll
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: P2P Energy Toolbar: {2bae58c2-79f9-45d1-a286-81f911301c3a} - c:\program files\p2p_energy\tbP2P_.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
BHO: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
TB: Yahoo!7 Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: P2P Energy Toolbar: {2bae58c2-79f9-45d1-a286-81f911301c3a} - c:\program files\p2p_energy\tbP2P_.dll
TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SubVid] "c:\program files\mindmovies\subliminal\SubVid.exe" /startup
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [QQIntl] "c:\program files\tencent\qqintl\bin\QQ.exe" /background
uRun: [Logitech Vid] "c:\program files\logitech\logitech vid\Vid.exe" -bootmode
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
uRun: [Google Update] "c:\users\pete\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [Jing] c:\program files\techsmith\jing\Jing.exe
uRun: [S60 PC Suite Tray] "c:\program files\samsung\samsung pc studio 7\PCSuite.exe" -onlytray
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe"
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [WinampAgent] "c:\program files\winamp\Winampa.exe"
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [SMSTray] c:\program files\samsung\samsung media studio 5\SMSTray.exe
mRun: [PMBVolumeWatcher] c:\program files\sony\pmb\PMBVolumeWatcher.exe
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4.0\OpwareSE4.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [FileZilla Server Interface] "c:\program files\filezilla server\FileZilla Server Interface.exe"
mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking10\ereg\ereg.exe" -r "c:\programdata\nuance\naturallyspeaking10\Ereg.ini
mRun: [DMXLauncher] "c:\program files\roxio\cineplayer\DMXLauncher.exe"
mRun: [Device Detector] DevDetect.exe -autorun
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [emsisoft anti-malware] "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60
dRun: [Samsung.PCSync] "c:\program files\samsung\samsung pc studio 7\PcSync2.exe" /NoDialog
StartupFolder: c:\users\pete\appdata\roaming\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\bluetooth pc dialer\BluetoothPCDialer.exe
StartupFolder: c:\users\pete\appdata\roaming\micros~1\windows\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\users\pete\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\canonl~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\CNAB3LAK.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF2.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2010\ie_banner_deny.htm
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1AA76E1C-5843-493A-A6ED-C240E9BFBC51} : DhcpNameServer = 192.168.1.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll, c:\progra~1\kasper~1\kasper~1\kloehk.dll
SEH: ShellHook Class: {88485281-8b4b-4f8d-9ede-82e29a064277} - c:\progra~1\markany\conten~1\MACSMA~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\pete\appdata\roaming\mozilla\firefox\profiles\dx52rlan.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=2&q=
FF - component: c:\program files\common files\spigot\wtxpcom\components\WidgiToolbarFF.dll
FF - component: c:\program files\mozilla firefox\extensions\[removed]\components\KavLinkFilter.dll
FF - component: c:\programdata\google\toolbar for firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\programdata\google\toolbar for firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.93\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\users\pete\appdata\local\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\users\pete\appdata\local\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
.
============= SERVICES / DRIVERS ===============
.
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
R1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files\emsisoft anti-malware\a2ddax86.sys [2012-1-23 17904]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2009-11-3 21520]
R2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;c:\program files\emsisoft anti-malware\a2service.exe [2012-1-23 3025112]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-4 63928]
R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe [2009-10-20 340520]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\sony\pmb\PMBDeviceInfoProvider.exe [2011-3-15 428384]
R3 a2acc;a2acc;c:\program files\emsisoft anti-malware\a2accx86.sys [2012-1-23 51632]
R3 CompFilter;UVCCompositeFilter;c:\windows\system32\drivers\lvbusflt.sys [2011-8-19 22176]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-22 135664]
S2 RoxLiveShare10;LiveShare P2P Server 10;"c:\program files\common files\roxio shared\10.0\sharedcom\roxliveshare10.exe" –> c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [?]
S2 SessionLauncher;SessionLauncher;c:\users\pete\appdata\local\temp\dx9\sessionlauncher.exe –> c:\users\pete\appdata\local\temp\dx9\SessionLauncher.exe [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-5-22 135664]
S3 HVGDWV;HVGDWV;c:\users\pete\appdata\local\temp\HVGDWV.exe [2012-1-23 441216]
S3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [2011-8-6 275968]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-7 52224]
.
=============== Created Last 30 ================
.
2012-01-24 21:24:38 6557240 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{27ad44d7-8ca3-4f94-a925-667df54814b6}\mpengine.dll
2012-01-23 07:21:00 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-01-22 14:52:49 ——– d—–w- c:\program files\Emsisoft Anti-Malware
2012-01-20 21:28:53 224768 —-a-w- c:\windows\system32\schannel.dll
2012-01-20 21:28:53 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-20 21:28:52 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-20 21:28:52 369352 —-a-w- c:\windows\system32\drivers\cng.sys
2012-01-20 21:28:52 314880 —-a-w- c:\windows\system32\webio.dll
2012-01-20 21:28:52 22528 —-a-w- c:\windows\system32\lsass.exe
2012-01-20 21:28:52 22016 —-a-w- c:\windows\system32\secur32.dll
2012-01-20 21:28:52 15872 —-a-w- c:\windows\system32\sspisrv.dll
2012-01-20 21:28:52 1038848 —-a-w- c:\windows\system32\lsasrv.dll
2012-01-20 21:28:52 100352 —-a-w- c:\windows\system32\sspicli.dll
2012-01-18 13:20:29 ——– d—–w- c:\users\pete\appdata\roaming\com.focusboosterapp.focusbooster.8E5F79C899747AD22E21DB62AA496926DA6BBC64.1
2012-01-18 13:19:09 ——– d—–w- c:\program files\focus booster
2012-01-10 19:03:33 1288472 —-a-w- c:\windows\system32\ntdll.dll
2012-01-10 19:03:32 67072 —-a-w- c:\windows\system32\packager.dll
2012-01-10 19:03:31 514560 —-a-w- c:\windows\system32\qdvd.dll
2012-01-10 19:03:31 1328128 —-a-w- c:\windows\system32\quartz.dll
2012-01-10 13:12:26 ——– d—–w- c:\program files\Massive Passive Video Optimizer
2012-01-08 04:45:49 ——– d—–w- c:\program files\Add-in Express
2012-01-08 03:52:31 ——– d—–w- c:\users\pete\appdata\local\Add-in Express
2012-01-08 03:52:30 ——– d—–w- C:\Add-in Express
2012-01-06 21:34:57 ——– d—–w- c:\program files\DVDFab 8 Qt
2012-01-03 13:10:44 182672 —-a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll
2012-01-03 13:10:44 182672 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll
2011-12-29 21:14:51 626688 —-a-w- c:\program files\mozilla firefox\msvcr80.dll
2011-12-29 21:14:51 548864 —-a-w- c:\program files\mozilla firefox\msvcp80.dll
2011-12-29 21:14:51 479232 —-a-w- c:\program files\mozilla firefox\msvcm80.dll
2011-12-29 21:14:51 43992 —-a-w- c:\program files\mozilla firefox\mozutils.dll
.
==================== Find3M ====================
.
2012-01-23 20:48:44 428088 —-a-w- c:\windows\system32\drivers\sptd.sys
2012-01-08 05:23:56 753 —ha-w- C:\os245324.bin
2011-11-24 04:25:27 2342912 —-a-w- c:\windows\system32\win32k.sys
2011-11-21 10:09:07 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-15 03:29:56 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-11-05 04:26:03 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-03 22:47:42 1798144 —-a-w- c:\windows\system32\jscript9.dll
2011-11-03 22:40:21 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 22:39:47 1127424 —-a-w- c:\windows\system32\wininet.dll
2011-11-03 22:31:57 2382848 —-a-w- c:\windows\system32\mshtml.tlb
.
============= FINISH: 8:43:22.51 ===============
Hi and Welcome!!
My name is
Jeff . I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. Please subscribe to this topic, if you haven't already. The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. IMPORTANT NOTE : Please do not delete anything unless instructed to.DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision .
Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
Stay with this topic until I give you the all clean post. First we need to make all files and folders VISIBLE :
Go to start>control panel>folder options>view Choose to "show hidden files and folders ," Uncheck the "hide protected operating system files" and the "hide extensions for know file types " boxes. Close the window with OK
———-
You said that you ran GMER? Please post the log created.
———-
Are you aware your system is set up to use a proxy server?
Hi Jeff,
Thanks for taking the time to help me out, I really appreciate it.
I have attached both the Malware logs plus the Gmer log as you requested.
And no, I am not aware that my system is set up to use a proxy server - not really sure what that means.
Please let me know if there is anything else you need.
Once again, thanks so much, I do really appreciate your time.
Regards,
Peter.
Hi Peter ( I hope it's ok to call you that),
Download
Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2
**Note: It is important that it is saved directly to your desktop**
——————————————————————–
IMPORTANT -
Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
here
——————————————————————–
Right-Click and Run as Administrator on
ComboFix.exe & follow the prompts.
When finished, it will produce a report for you. Please post the C:\ComboFix.txt for further review.
———-
Hi Jeff,
Thanks so much for all your help. I hope it is not going to be a huge deal for you (or me!)
I have done as you asked and here is the C:\ComboFix.txt
Just one other thing: I have this bluetooth installer I downlaoded about 8 months ago and each time the computer reboots it keeps asking me run it.
I click no but it keeps on popping up again each time I click no asking me to run it. After about 8 or 9 times (sometimes more) it finally stops.
I went to uninstall it from programs in Control Panel but it comes up as installing - not uninstalling.
Just mentioning this as I wonder if it is part of the problem. If so - is there any way I can delete it myself without having to run it?
Just a thought.
Many thanks,
Peter.
Hi Peter,
In your future replies could you please copy/paste the logs into your replies instead of attaching them? It makes them easier for me to read. Thanks.
————
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside ClearJavaCache::
DDS::
uStart Page = hxxp://au.yahoo.com/
uInternet Settings,ProxyServer = 192.168.160.1:800
uInternet Settings,ProxyOverride = *.local;
uURLSearchHooks: H - No File
mURLSearchHooks: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
mURLSearchHooks: P2P Energy Toolbar: {2bae58c2-79f9-45d1-a286-81f911301c3a} - c:\program files\p2p_energy\tbP2P_.dll
BHO: P2P Energy Toolbar: {2bae58c2-79f9-45d1-a286-81f911301c3a} - c:\program files\p2p_energy\tbP2P_.dll
BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
BHO: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
TB: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
TB: P2P Energy Toolbar: {2bae58c2-79f9-45d1-a286-81f911301c3a} - c:\program files\p2p_energy\tbP2P_.dll
TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
StartupFolder: c:\users\pete\appdata\roaming\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\bluetooth pc dialer\BluetoothPCDialer.exe
StartupFolder: c:\users\pete\appdata\roaming\micros~1\windows\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
Firefox::
FF - ProfilePath - c:\users\pete\appdata\roaming\mozilla\firefox\profiles\dx52rlan.default\
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=2&q=
File::
c:\users\pete\appdata\local\temp\HVGDWV.exe
C:\os245324.bin
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
"{ecdee021-0d17-467f-a1ff-c7a115230949}"=-
"{2bae58c2-79f9-45d1-a286-81f911301c3a}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"=-
"{2BAE58C2-79F9-45D1-A286-81F911301C3A}"=-
Driver::
HVGDWV
RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.[external image: Posted Image] Very Important! Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION : Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
ComboFix 12-01-27.04 - pete 28/01/2012 14:49:51.2.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.61.1033.18.1983.903 [GMT 11:00]
Running from: e:\pete files\Desktop\ComboFix.exe
Command switches used :: e:\pete files\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"C:\os245324.bin"
"c:\users\pete\appdata\local\temp\HVGDWV.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\os245324.bin
c:\program files\ask.com\GenericAskToolbar.dll
c:\program files\bluetooth pc dialer\BluetoothPCDialer.exe
c:\program files\free-downloads.net\tbfree.dll
c:\program files\limewire\LimeWire.exe
c:\program files\p2p_energy\tbP2P_.dll
c:\users\pete\appdata\roaming\micros~1\windows\startm~1\programs\startup\blueto~1.lnk
c:\users\pete\appdata\roaming\micros~1\windows\startm~1\programs\startup\limewi~1.lnk
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_HVGDWV
.
.
((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-28 )))))))))))))))))))))))))))))))
.
.
2012-01-28 04:01 . 2012-01-28 04:01 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-01-28 00:59 . 2012-01-28 03:56 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A330C548-E062-410B-BC8F-DDEB87A3EF40}\offreg.dll
2012-01-27 20:59 . 2012-01-06 04:19 6557240 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A330C548-E062-410B-BC8F-DDEB87A3EF40}\mpengine.dll
2012-01-26 08:44 . 2012-01-26 08:44 ——– d—–w- c:\program files\The Focus Master
2012-01-25 00:45 . 2012-01-25 00:46 ——– d—–w- c:\users\pete\AppData\Local\WinZip
2012-01-23 07:21 . 2011-12-10 04:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-01-22 14:52 . 2012-01-28 00:45 ——– d—–w- c:\program files\Emsisoft Anti-Malware
2012-01-20 21:28 . 2011-11-17 05:41 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-20 21:28 . 2011-11-17 05:34 224768 —-a-w- c:\windows\system32\schannel.dll
2012-01-20 21:28 . 2011-11-17 05:41 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-20 21:28 . 2011-11-17 05:39 369352 —-a-w- c:\windows\system32\drivers\cng.sys
2012-01-20 21:28 . 2011-11-17 05:35 314880 —-a-w- c:\windows\system32\webio.dll
2012-01-20 21:28 . 2011-11-17 05:34 15872 —-a-w- c:\windows\system32\sspisrv.dll
2012-01-20 21:28 . 2011-11-17 05:34 100352 —-a-w- c:\windows\system32\sspicli.dll
2012-01-20 21:28 . 2011-11-17 05:34 22016 —-a-w- c:\windows\system32\secur32.dll
2012-01-20 21:28 . 2011-11-17 05:32 1038848 —-a-w- c:\windows\system32\lsasrv.dll
2012-01-20 21:28 . 2011-11-17 05:29 22528 —-a-w- c:\windows\system32\lsass.exe
2012-01-18 13:20 . 2012-01-18 13:20 ——– d—–w- c:\users\pete\AppData\Roaming\com.focusboosterapp.focusbooster.8E5F79C899747AD22E21DB62AA496926DA6BBC64.1
2012-01-18 13:19 . 2012-01-18 13:19 ——– d—–w- c:\program files\focus booster
2012-01-10 19:03 . 2011-11-17 05:38 1288472 —-a-w- c:\windows\system32\ntdll.dll
2012-01-10 19:03 . 2011-11-19 14:01 67072 —-a-w- c:\windows\system32\packager.dll
2012-01-10 19:03 . 2011-10-26 04:32 514560 —-a-w- c:\windows\system32\qdvd.dll
2012-01-10 19:03 . 2011-10-26 04:32 1328128 —-a-w- c:\windows\system32\quartz.dll
2012-01-10 13:12 . 2012-01-10 13:12 ——– d—–w- c:\program files\Massive Passive Video Optimizer
2012-01-08 04:45 . 2012-01-08 04:45 ——– d—–w- c:\program files\Add-in Express
2012-01-08 03:52 . 2012-01-08 04:45 ——– d—–w- c:\users\pete\AppData\Local\Add-in Express
2012-01-08 03:52 . 2012-01-08 03:52 ——– d—–w- C:\Add-in Express
2012-01-06 21:34 . 2012-01-06 21:35 ——– d—–w- c:\program files\DVDFab 8 Qt
2012-01-03 13:10 . 2012-01-03 13:10 182672 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-01-03 13:10 . 2012-01-03 13:10 182672 —-a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-12-29 21:14 . 2011-12-29 21:14 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2011-12-29 21:14 . 2011-12-29 21:14 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2011-12-29 21:14 . 2011-12-29 21:14 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2011-12-29 21:14 . 2011-12-29 21:14 43992 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-23 20:48 . 2010-05-23 05:00 428088 —-a-w- c:\windows\system32\drivers\sptd.sys
2011-12-06 23:08 . 2010-05-04 07:45 236576 ——w- c:\windows\system32\MpSigStub.exe
2011-11-24 04:25 . 2011-12-14 06:45 2342912 —-a-w- c:\windows\system32\win32k.sys
2011-11-21 10:09 . 2011-05-16 07:45 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-05 04:26 . 2011-12-14 06:45 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-03 22:47 . 2011-12-14 12:34 1798144 —-a-w- c:\windows\system32\jscript9.dll
2011-11-03 22:40 . 2011-12-14 12:34 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 22:39 . 2011-12-14 12:34 1127424 —-a-w- c:\windows\system32\wininet.dll
2011-11-03 22:31 . 2011-12-14 12:34 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-11-03 00:33 . 2011-11-03 00:33 53248 —-a-r- c:\users\pete\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-12-29 21:14 . 2011-05-09 21:41 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-28_01.06.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-04 07:56 . 2012-01-28 01:24 74684 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2012-01-28 04:06 40526 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-05-04 07:40 . 2012-01-28 04:06 15994 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-859346850-3658000739-1457241374-1000_UserData.bin
- 2010-05-17 13:37 . 2012-01-28 00:44 3038 c:\windows\System32\wdi\ERCQueuedResolutions.dat
+ 2010-05-17 13:37 . 2012-01-28 04:02 3038 c:\windows\System32\wdi\ERCQueuedResolutions.dat
+ 2012-01-28 01:20 . 2012-01-28 04:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-01-28 00:45 . 2012-01-28 01:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-01-28 01:20 . 2012-01-28 04:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-01-28 00:45 . 2012-01-28 01:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:05 . 2012-01-28 01:09 675992 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2012-01-28 01:25 675992 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2012-01-28 01:25 129926 c:\windows\System32\perfc009.dat
- 2009-07-14 02:05 . 2012-01-28 01:09 129926 c:\windows\System32\perfc009.dat
- 2009-07-14 04:47 . 2012-01-28 00:44 533076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:47 . 2012-01-28 01:18 533076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-09-06 14:02 . 2012-01-28 01:18 14314404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-859346850-3658000739-1457241374-1000-8192.dat
- 2010-09-06 14:02 . 2012-01-28 00:44 14314404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-859346850-3658000739-1457241374-1000-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-21 39408]
"SubVid"="c:\program files\MindMovies\Subliminal\SubVid.exe" [2008-09-16 139264]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-12 17351304]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"QQIntl"="c:\program files\Tencent\QQIntl\Bin\QQ.exe" [2011-06-29 144760]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\Vid.exe" [2010-05-11 6061400]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"Jing"="c:\program files\TechSmith\Jing\Jing.exe" [2010-08-19 3069192]
"S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-05 699392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Device Detector"="DevDetect.exe -autorun" [X]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-08-19 340520]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-19 20480]
"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2002-04-26 12288]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-24 210472]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-12-14 132624]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2011-03-15 650080]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-27 570664]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-12-24 981680]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-23 79136]
"FileZilla Server Interface"="c:\program files\FileZilla Server\FileZilla Server Interface.exe" [2010-07-18 1258496]
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" [2007-04-15 259624]
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe" [2007-08-13 113136]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-26 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]
.
c:\users\pete\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Canon LBP3000 Status Window.lnk - c:\windows\System32\spool\drivers\w32x86\3\CNAB3LAK.EXE [2010-5-26 50848]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-5-26 303104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R0 ircsx;ircsx;c:\windows\System32\drivers\vcfenmy.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 135664]
R2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [x]
R2 SessionLauncher;SessionLauncher;c:\users\pete\AppData\Local\Temp\DX9\SessionLauncher.exe [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 135664]
R3 MSICDSetup;MSICDSetup;D:\CDriver.sys [x]
R3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys [2007-04-27 275968]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-04 1343400]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-11-03 21520]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [2011-03-15 428384]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-03-18 172328]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-18 450848]
S3 CompFilter;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbusflt.sys [2011-08-18 22176]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-05-05 47360]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 20:39]
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 20:39]
.
2012-01-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-859346850-3658000739-1457241374-1000Core.job
- c:\users\pete\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-12 08:47]
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-859346850-3658000739-1457241374-1000UA.job
- c:\users\pete\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-12 08:47]
.
2010-11-21 c:\windows\Tasks\NatSpeak_Optimizer_10_10_8982DE85-7E6B-4462-82C6-B1D0ACECB92.job
- c:\progra~1\Nuance\NATURA~1\Program\schedmgr.exe [2009-03-16 11:17]
.
.
——- Supplementary Scan ——-
.
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\pete\AppData\Roaming\Mozilla\Firefox\Profiles\dx52rlan.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(5396)
c:\program files\Samsung\Samsung PC Studio 7\phonebrowser.dll
c:\program files\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll
c:\program files\Samsung\Samsung PC Studio 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Samsung\Samsung PC Studio 7\Resource\PhoneBrowser_Samsung.ngr
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\CNAB3RPK.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\FileZilla Server\FileZilla Server.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\conhost.exe
c:\windows\System32\spool\drivers\w32x86\3\WrtProc.exe
c:\program files\Common Files\ACD Systems\EN\DevDetect.exe
c:\program files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Completion time: 2012-01-28 15:15:09 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-28 04:15
ComboFix2.txt 2012-01-28 01:15
.
Pre-Run: 54,377,345,024 bytes free
Post-Run: 54,118,379,520 bytes free
.
- - End Of File - - 06EF0ECB88006280163FA6B341452455
Hi,
CAUTION : Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Malwarebytes
I see that you have
Malwarebytes on your system. Please open Malwarebytes, update it and then run a
Quick Scan . Please save the log that is created for your next reply.
———-
ESET Online Scanner I'd like us to scan your machine with ESET Online Scan
Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
Do not use this instance of your browser for anything besides doing this scan When the scan is complete and the results saved, close that instance of your browser Open a new one the usual way and post the results in this topic. Right-click and Run as Administartor on the following link to open ESET OnlineScan in a new window. Click the [external image: Posted Image] button. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop. Double click on the [external image: Posted Image] icon on your desktop. Check [external image: Posted Image] Click the Start button. Accept any security warnings from your browser. Check [external image: Posted Image] Make sure that the option "Remove found threats" is Unchecked Push the Start button. ESET will then download updates for itself, install itself, and begin When the scan completes, push [external image: Posted Image] Push [external image: Posted Image] , and save the file to your desktop using a unique name, such as Push the Back button. Push Finish
http://www.eset.com/onlinescan/
———-
In your next reply please post the new ComboFix log and the logs made by Malwarebytes and ESET online scanner.
Hi Jeff,
As always, thank you for your help.
Here are the 3 logs as requested. Sorry for late reply - the Eset scan took 9 hours.
ComboFix 12-01-28.01 - pete 29/01/2012 4:31.3.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.61.1033.18.1983.770 [GMT 11:00]
Running from: e:\pete files\Desktop\ComboFix.exe
Command switches used :: e:\pete files\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\System32\drivers\vcfenmy.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_ircsx
.
.
((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-28 )))))))))))))))))))))))))))))))
.
.
2012-01-27 20:59 . 2012-01-06 04:19 6557240 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A330C548-E062-410B-BC8F-DDEB87A3EF40}\mpengine.dll
2012-01-26 08:44 . 2012-01-26 08:44 ——– d—–w- c:\program files\The Focus Master
2012-01-25 00:45 . 2012-01-25 00:46 ——– d—–w- c:\users\pete\AppData\Local\WinZip
2012-01-23 07:21 . 2011-12-10 04:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-01-22 14:52 . 2012-01-28 00:45 ——– d—–w- c:\program files\Emsisoft Anti-Malware
2012-01-20 21:28 . 2011-11-17 05:41 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-20 21:28 . 2011-11-17 05:34 224768 —-a-w- c:\windows\system32\schannel.dll
2012-01-20 21:28 . 2011-11-17 05:41 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-20 21:28 . 2011-11-17 05:39 369352 —-a-w- c:\windows\system32\drivers\cng.sys
2012-01-20 21:28 . 2011-11-17 05:35 314880 —-a-w- c:\windows\system32\webio.dll
2012-01-20 21:28 . 2011-11-17 05:34 15872 —-a-w- c:\windows\system32\sspisrv.dll
2012-01-20 21:28 . 2011-11-17 05:34 100352 —-a-w- c:\windows\system32\sspicli.dll
2012-01-20 21:28 . 2011-11-17 05:34 22016 —-a-w- c:\windows\system32\secur32.dll
2012-01-20 21:28 . 2011-11-17 05:32 1038848 —-a-w- c:\windows\system32\lsasrv.dll
2012-01-20 21:28 . 2011-11-17 05:29 22528 —-a-w- c:\windows\system32\lsass.exe
2012-01-18 13:20 . 2012-01-18 13:20 ——– d—–w- c:\users\pete\AppData\Roaming\com.focusboosterapp.focusbooster.8E5F79C899747AD22E21DB62AA496926DA6BBC64.1
2012-01-18 13:19 . 2012-01-18 13:19 ——– d—–w- c:\program files\focus booster
2012-01-10 19:03 . 2011-11-17 05:38 1288472 —-a-w- c:\windows\system32\ntdll.dll
2012-01-10 19:03 . 2011-11-19 14:01 67072 —-a-w- c:\windows\system32\packager.dll
2012-01-10 19:03 . 2011-10-26 04:32 514560 —-a-w- c:\windows\system32\qdvd.dll
2012-01-10 19:03 . 2011-10-26 04:32 1328128 —-a-w- c:\windows\system32\quartz.dll
2012-01-10 13:12 . 2012-01-10 13:12 ——– d—–w- c:\program files\Massive Passive Video Optimizer
2012-01-08 04:45 . 2012-01-08 04:45 ——– d—–w- c:\program files\Add-in Express
2012-01-08 03:52 . 2012-01-08 04:45 ——– d—–w- c:\users\pete\AppData\Local\Add-in Express
2012-01-08 03:52 . 2012-01-08 03:52 ——– d—–w- C:\Add-in Express
2012-01-06 21:34 . 2012-01-06 21:35 ——– d—–w- c:\program files\DVDFab 8 Qt
2012-01-03 13:10 . 2012-01-03 13:10 182672 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-01-03 13:10 . 2012-01-03 13:10 182672 —-a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-12-29 21:14 . 2011-12-29 21:14 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2011-12-29 21:14 . 2011-12-29 21:14 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2011-12-29 21:14 . 2011-12-29 21:14 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2011-12-29 21:14 . 2011-12-29 21:14 43992 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-23 20:48 . 2010-05-23 05:00 428088 —-a-w- c:\windows\system32\drivers\sptd.sys
2011-12-06 23:08 . 2010-05-04 07:45 236576 ——w- c:\windows\system32\MpSigStub.exe
2011-11-24 04:25 . 2011-12-14 06:45 2342912 —-a-w- c:\windows\system32\win32k.sys
2011-11-21 10:09 . 2011-05-16 07:45 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-05 04:26 . 2011-12-14 06:45 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-03 22:47 . 2011-12-14 12:34 1798144 —-a-w- c:\windows\system32\jscript9.dll
2011-11-03 22:40 . 2011-12-14 12:34 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 22:39 . 2011-12-14 12:34 1127424 —-a-w- c:\windows\system32\wininet.dll
2011-11-03 22:31 . 2011-12-14 12:34 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-11-03 00:33 . 2011-11-03 00:33 53248 —-a-r- c:\users\pete\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-12-29 21:14 . 2011-05-09 21:41 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-28_01.06.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-04 07:56 . 2012-01-28 17:20 74716 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2012-01-28 17:46 40574 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-05-04 07:40 . 2012-01-28 17:46 15994 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-859346850-3658000739-1457241374-1000_UserData.bin
+ 2010-05-17 13:37 . 2012-01-28 17:42 3038 c:\windows\System32\wdi\ERCQueuedResolutions.dat
- 2010-05-17 13:37 . 2012-01-28 00:44 3038 c:\windows\System32\wdi\ERCQueuedResolutions.dat
- 2012-01-28 00:45 . 2012-01-28 01:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-01-28 17:17 . 2012-01-28 17:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-01-28 00:45 . 2012-01-28 01:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-01-28 17:17 . 2012-01-28 17:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:05 . 2012-01-28 01:09 675992 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2012-01-28 17:50 675992 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2012-01-28 17:50 129926 c:\windows\System32\perfc009.dat
- 2009-07-14 02:05 . 2012-01-28 01:09 129926 c:\windows\System32\perfc009.dat
- 2009-07-14 04:47 . 2012-01-28 00:44 533076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:47 . 2012-01-28 14:00 533076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-09-06 14:02 . 2012-01-28 14:00 14314404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-859346850-3658000739-1457241374-1000-8192.dat
- 2010-09-06 14:02 . 2012-01-28 00:44 14314404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-859346850-3658000739-1457241374-1000-8192.dat
+ 2011-06-15 22:44 . 2012-01-28 04:37 21173884 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-859346850-3658000739-1457241374-1000-4096.dat
- 2011-06-15 22:44 . 2012-01-22 10:37 21173884 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-859346850-3658000739-1457241374-1000-4096.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-21 39408]
"SubVid"="c:\program files\MindMovies\Subliminal\SubVid.exe" [2008-09-16 139264]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-12 17351304]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"QQIntl"="c:\program files\Tencent\QQIntl\Bin\QQ.exe" [2011-06-29 144760]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\Vid.exe" [2010-05-11 6061400]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"Jing"="c:\program files\TechSmith\Jing\Jing.exe" [2010-08-19 3069192]
"S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-05 699392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Device Detector"="DevDetect.exe -autorun" [X]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-08-19 340520]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-19 20480]
"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2002-04-26 12288]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-24 210472]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-12-14 132624]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2011-03-15 650080]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-27 570664]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-12-24 981680]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-23 79136]
"FileZilla Server Interface"="c:\program files\FileZilla Server\FileZilla Server Interface.exe" [2010-07-18 1258496]
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" [2007-04-15 259624]
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe" [2007-08-13 113136]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-26 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Canon LBP3000 Status Window.lnk - c:\windows\System32\spool\drivers\w32x86\3\CNAB3LAK.EXE [2010-5-26 50848]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-5-26 303104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 135664]
R2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [x]
R2 SessionLauncher;SessionLauncher;c:\users\pete\AppData\Local\Temp\DX9\SessionLauncher.exe [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 135664]
R3 MSICDSetup;MSICDSetup;D:\CDriver.sys [x]
R3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys [2007-04-27 275968]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-04 1343400]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-11-03 21520]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [2011-03-15 428384]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-03-18 172328]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-18 450848]
S3 CompFilter;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbusflt.sys [2011-08-18 22176]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-05-05 47360]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 20:39]
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 20:39]
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-859346850-3658000739-1457241374-1000Core.job
- c:\users\pete\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-12 08:47]
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-859346850-3658000739-1457241374-1000UA.job
- c:\users\pete\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-12 08:47]
.
2010-11-21 c:\windows\Tasks\NatSpeak_Optimizer_10_10_8982DE85-7E6B-4462-82C6-B1D0ACECB92.job
- c:\progra~1\Nuance\NATURA~1\Program\schedmgr.exe [2009-03-16 11:17]
.
.
——- Supplementary Scan ——-
.
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\pete\AppData\Roaming\Mozilla\Firefox\Profiles\dx52rlan.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(816)
c:\program files\Samsung\Samsung PC Studio 7\phonebrowser.dll
c:\program files\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll
c:\program files\Samsung\Samsung PC Studio 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Samsung\Samsung PC Studio 7\Resource\PhoneBrowser_Samsung.ngr
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\taskhost.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\FileZilla Server\FileZilla Server.exe
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\CNAB3RPK.EXE
c:\windows\system32\conhost.exe
c:\windows\System32\spool\drivers\w32x86\3\WrtProc.exe
c:\program files\Common Files\ACD Systems\EN\DevDetect.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\program files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Completion time: 2012-01-29 04:55:01 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-28 17:54
ComboFix2.txt 2012-01-28 04:15
ComboFix3.txt 2012-01-28 01:15
.
Pre-Run: 54,183,546,880 bytes free
Post-Run: 54,139,740,160 bytes free
.
- - End Of File - - E6DB67B5BF08D5BD87CEFDDB2A9E1CBA
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org
Database version: v2012.01.28.04
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
pete :: PETE-PC [administrator]
29/01/2012 4:59:48 AM
mbam-log-2012-01-29 (04-59-48).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 199938
Time elapsed: 5 minute(s), 1 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
C:\DNSTEMP\Dragon Naturally Speaking Preferred 10.1.rar NSIS/TrojanDownloader.Agent.NBN trojan
C:\DNSTEMP\Dragon Naturally Speaking Preferred 10.1\Dragon Naturally Speaking Preferred 10.1\Dragon Naturally Speaking Preferred 10.1.iso NSIS/TrojanDownloader.Agent.NBN trojan
C:\ProgramData\YouTube Downloader\ytd_installer.exe a variant of Win32/Toolbar.Widgi application
C:\Users\All Users\YouTube Downloader\ytd_installer.exe a variant of Win32/Toolbar.Widgi application
C:\Windows\Installer\69d07.msi a variant of Win32/Adware.Toolbar.Dealio application
E:\pete files\Documents\LimeWire\Saved\Dragon Naturally Speaking Preferred 10.1.rar NSIS/TrojanDownloader.Agent.NBN trojan
E:\pete files\Documents\LimeWire\Saved\Dragon Naturally Speaking Preferred 10.1\Dragon Naturally Speaking Preferred 10.1\Dragon Naturally Speaking Preferred 10.1.iso NSIS/TrojanDownloader.Agent.NBN trojan
E:\pete files\Documents\Samsung Mobile\cnet_bluetoothpcdialer_zip.exe a variant of Win32/InstallCore.D application
E:\pete files\Downloads\registrybooster (1).exe Win32/RegistryBooster application
E:\pete files\Downloads\YouTubeDownloaderSetup32.exe a variant of Win32/Toolbar.Widgi application
F:\Dragon Naturally Speaking Preferred 10.1.rar NSIS/TrojanDownloader.Agent.NBN trojan
F:\Dragon Naturally Speaking Preferred 10.1\Dragon Naturally Speaking Preferred 10.1\Dragon Naturally Speaking Preferred 10.1.iso NSIS/TrojanDownloader.Agent.NBN trojan
H:\Business\Bob Proctor\Warrior Forum\Plugins\Mobi Power Suite\Bonuses\kit.zip a variant of Win32/Adware.DisableSpyware application
H:\Downloads\Adobe.CS4.Master.Collection.Keygen.Final.Keygen.rar probably a variant of Win32/Spy.Agent.FFETUNH trojan
H:\Downloads\Dragon Naturally Speaking Preferred 10.1.rar NSIS/TrojanDownloader.Agent.NBN trojan
H:\Downloads\Adobe.CS4.Master.Collection.Keygen.Final.Keygen\Adobe.CS4.Master.Collection.Keygen.Final.Keygen\Adobe.CS4.Master.Collection.Keygen.Final.Keygen.xPRJ-Master-of-Devils_.rar probably a variant of Win32/Spy.Agent.FFETUNH trojan
H:\Downloads\Adobe.CS4.Master.Collection.Keygen.Final.Keygen\Adobe.CS4.Master.Collection.Keygen.Final.Keygen\CS4MCLG.EXE probably a variant of Win32/Spy.Agent.FFETUNH trojan
H:\Downloads\Nero 8\Nero-8.1.1.0b_eng_trial.exe Win32/Toolbar.AskSBar application
H:\Downloads\NUANCE_DRAGON_NATURALLY_SPEAKING_v10.1_PREFERRED-DVTiSO\d-110ndn\d-ndns.iso probably a variant of Win32/Agent.LOMRODF trojan
Hi Peter,
No problems about the response. ESET can take some time to finish.
———–
Download
CKScanner by
askey127 from
Here &
save it to your Desktop .
Right-click and Run as Administrator CKScanner.exe then click Search For Files When the cursor hourglass disappears, click Save List To File A message box will verify the file saved Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
———-
Hi Jeff,
Here is the CKScan:
CKScanner - Additional Security Risks - These are not necessarily bad
c:\program files\adobe\adobe premiere pro cs3\plug-ins\en_us\vstplugins\decrackler1.dll
c:\program files\adobe\adobe premiere pro cs3\plug-ins\en_us\vstplugins\decrackler2.dll
c:\program files\adobe\adobe premiere pro cs3\plug-ins\en_us\vstplugins\decrackler6.dll
c:\program files\adobe\audition 1.5\crack[1].cd-adobe_audition_v1.5_tryout_multilanguage\asn.er.dll
c:\program files\adobe\audition 1.5\crack[1].cd-adobe_audition_v1.5_tryout_multilanguage\fff.nfo
c:\program files\adobe\audition 1.5\crack[1].cd-adobe_audition_v1.5_tryout_multilanguage\file_id.diz
c:\program files\gimp-2.0\share\gimp\2.0\patterns\cracked.pat
c:\program files\rowan software\bob demo\maskmap\crack.x8
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack01.ogg
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack02.ogg
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack03.ogg
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack04.ogg
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack05.ogg
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack06.ogg
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack07.ogg
c:\program files\ubisoft\cyan worlds\myst v end of ages\sfx\thgricecrack08.ogg
c:\program files\xara\webstyle 3.0\wstemplates\backgrounds\exotic\cracket.wix
c:\program files\xara\webstyle 3.0\wstemplates\backgrounds\exotic\cracket.xws
scanner sequence 3.II.11.KLAPQU
—– EOF —–
Hi Peter,
CKScanner has detected illegal software on your system. Besides being illegal, it's the number one way of infecting your system as all cracked/keygen software is infected. This forum, as well as all the other malware removal forums, do not support the use of illegal software except for their removal. If I were to continue helping you with illegal software installed, it could be construed in the eyes of the law as aiding and abetting a crime.
I have worked up a fix for their removal. If you do not agree to this then this thread will be closed and no further help will be offered. Please let me know if you wish to continue.
Hi Jeff,
Certainly go ahead and remove them. I understand, and have no desire to have either of us in trouble for anything illegal.
Most of these were downloaded some time ago at a time when I thought it was okay to do so.
So absolutely, just remove them if that is required.
I noticed some of my bought software (eg:ubisoft myst series) scanned as negative - what is the reason there?
Regards,
Peter.
Hi Jeff,
Just another point.
I had to download updates/upgrades of some original programs from online when I upgraded from XP to Windows 7.
And some of these would not work even with the upgrades so I searched for other online solutions. (this was the case with Adobe Premiere Pro).
Ubisoft (Myst) may have also been the same as those discs are pre Vista/Win 7.
Also, Adobe Audition was only downloaded as a 30 day trial (expired ages ago) and can't work - so I am surprised to see that in there.
I have with Gimp, and Xara , which are free online recommended downloads..
Some of the others like rowan software, I have no idea of those.
So 3 questions arise:
1. Is it safe to reinstall from my any original discs if your fix uninstalls any of these?
2. Could either these upgrades or searches have been possible causes for infection as I am wary of this now?
3. Is there a method to update/upgrade these programs without infection?
I only point this out as I was thinking about it - and all my programs that I run should actually be legal or at least as far as I am aware of.
If not, I need to retrace where I bought the software.
Regards,
Peter.
Hi Peter,
Great questions.
Let's take them as you asked…Like it said not all of them are bad though.
I noticed some of my bought software (eg:ubisoft myst series)
This is fine from what I see and I was not removing it.
Is it safe to reinstall from my any original discs if your fix uninstalls any of these?
Yes that is just fine but I don't foresee this.
Could either these upgrades or searches have been possible causes for infection as I am wary of this now?
Yes it very well could have been a source for your problems, but I can't say 100% for sure. Normal upgrades are fine for your programs from reputable websites.
Is there a method to update/upgrade these programs without infection?
Most programs will come with update programs that you can use that will be just fine to use.
———-
CAUTION : Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
My name is