What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HP Mini Netbook Super Slow [Solved]

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Can you please help. The pc is so slow it take 10 min to boot up and another 10 min to do a search from any browser. In fact, everything takes a long time. I made a hijactthis list for you to take a look at. pls let me know. thanks for your help.



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:15:25 PM, on 3/25/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files\Hewlett-Packard\HP CloudDrive\zumodrive.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\IntelAppStore\bin\serviceManager.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\BSD\AppUpdater\BSDChecker.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [HP Quick Launch] C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ZumoDrive] "C:\Program Files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Intel AppUp(SM) center] "C:\Program Files\Intel\IntelAppStore\bin\serviceManager.lnk"
O4 - HKLM\..\Run: [BSDAppUpdater] C:\Program Files\Common Files\BSD\AppUpdater\BSDChecker.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM, Inc. - C:\SwSetup\QuickWeb\QW.SYS\config\DVMExportService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Wireless Assistant Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HPWMISVC - Unknown owner - C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe
O23 - Service: BitDefender Update Server v2 (Update Server) - BitDefender - C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BitDefender Desktop Update Service (UPDATESRV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe
O23 - Service: Skyhook Wireless XPS Service (xpssvc) - Skyhook Wireless - C:\Program Files\Skyhook Wireless\XPS\xpssvc.exe

–
End of file - 7299 bytes
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

Please download aswMBR to your desktop.

  • Right click and Run as Administrator the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post the logs made by DDS and aswMBR.
Post #3
hi, here is the dds file (i'll continue with the rest of your instructions next) thanks DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by [removed] at 21:29:44 on 2012-03-26 Microsoft Windows 7 Starter 6.1.7601.1.1252.1.1033.18.1012.144 [GMT -4:00] . AV: Bitdefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92} AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Bitdefender Antispyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F} FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\SwSetup\QuickWeb\QW.SYS\config\DVMExportService.exe C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Skyhook Wireless\XPS\xpssvc.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\wmiprvse.exe c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskhost.exe C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Program Files\Hp\HP Software Update\hpwuschd2.exe C:\Program Files\Intel\IntelAppStore\bin\serviceManager.exe C:\Program Files\Hewlett-Packard\HP CloudDrive\zumodrive.exe C:\Windows\system32\conhost.exe C:\Program Files\Common Files\BSD\AppUpdater\BSDChecker.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\IDT\WDM\sttray.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Windows\system32\Macromed\Flash\FlashUtil11g_ActiveX.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ mStart Page = about:blank BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: {7846AE31-BEA2-438A-8F5E-2D899361656C} - No File mRun: [HP Quick Launch] c:\program files\hewlett-packard\hp quick launch\HPMSGSVC.exe mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [] mRun: [ZumoDrive] "c:\program files\hewlett-packard\hp clouddrive\ZumoLauncher.lnk" mRun: [Intel AppUp(SM) center] "c:\program files\intel\intelappstore\bin\serviceManager.lnk" mRun: [BSDAppUpdater] c:\program files\common files\bsd\appupdater\BSDChecker.exe mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2012\bdagent.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [SysTrayApp] c:\program files\idt\wdm\sttray.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [IAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mif5ba~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{FE61774F-44E5-40D0-B0A3-8EB18FE2798A} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{FE61774F-44E5-40D0-B0A3-8EB18FE2798A}\D657368616368616 : DhcpNameServer = 192.168.1.1 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: igfxcui - igfxdev.dll mASetup: {4FB2AA7C-C8E4-BBC8-BB1C-FAAB2EF5914B} - c:\windows\system32\wscript.exe "c:\program files\hewlett-packard\hp media suite\home\PinItem.vbs" . ================= FIREFOX =================== . FF - ProfilePath - c:\users\mom\appdata\roaming\mozilla\firefox\profiles\kxk6khsu.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/ FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\ca\ca internet security suite\ca anti-phishing\toolbar\firefox\components\CAFxToolBar.dll FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\users\mom\appdata\roaming\mozilla\firefox\profiles\kxk6khsu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll . ============= SERVICES / DRIVERS =============== . R0 avc3;avc3;c:\windows\system32\drivers\avc3.sys [2011-11-25 609984] R1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-14 74832] R1 bdfwfpf;bdfwfpf;c:\program files\common files\bitdefender\bitdefender firewall\bdfwfpf.sys [2011-11-14 90704] R1 BDVEDISK;BDVEDISK;c:\windows\system32\drivers\bdvedisk.sys [2010-1-19 85128] R1 DVMIO;DeviceVM IO Service;c:\windows\system32\drivers\dvmio.sys [2009-11-11 18136] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128] R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe [2010-8-12 81920] R3 avchv;avchv Function Driver;c:\windows\system32\drivers\avchv.sys [2011-11-25 240184] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 65024] R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\drivers\RtsPStor.sys [2010-8-12 228896] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-8-12 233472] R3 XPSVCOM;XPSVCOM;c:\windows\system32\drivers\XPSVCOM.sys [2010-3-2 12416] S3 avckf;avckf;c:\windows\system32\drivers\avckf.sys [2011-11-28 447208] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [2012-2-3 63056] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-5-27 52224] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-13 311296] . =============== Created Last 30 ================ . 2012-03-26 21:29:45 6582328 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{77416e63-8ccf-4155-9bf3-1e7cac8de4f8}\mpengine.dll 2012-03-25 20:26:41 ——– d—–w- c:\programdata\{D3B41B92-9BC2-43EB-916A-4FA9E8191837} 2012-03-25 19:40:39 ——– d—–w- c:\users\mom\appdata\roaming\Intel Corporation 2012-03-25 19:28:09 354840 —-a-w- c:\windows\system32\drivers\iaStor.sys 2012-03-25 19:09:56 527872 ——w- c:\windows\system32\stapi32.dll 2012-03-25 19:09:01 61440 —-a-w- c:\windows\system32\aestaren.dll 2012-03-25 19:09:01 380928 —-a-w- c:\windows\system32\aestecap.dll 2012-03-25 19:09:01 140288 —-a-w- c:\windows\system32\aestacap.dll 2012-03-25 19:08:59 536576 —-a-w- c:\windows\system32\idtmini1.exe 2012-03-25 19:08:58 495708 —-a-w- c:\windows\sttray.exe 2012-03-25 19:08:58 3354624 —-a-w- c:\windows\system32\stlang.dll 2012-03-25 19:08:58 12628060 —-a-w- c:\windows\system32\idtcpl.cpl 2012-03-25 19:08:39 175616 —-a-w- c:\windows\system32\staco.dll 2012-03-25 18:12:53 ——– d—–w- C:\HJT 2012-03-25 17:51:46 388096 —-a-r- c:\users\mom\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2012-03-25 17:29:14 ——– d—–w- c:\program files\Trend Micro 2012-03-15 23:30:41 6582328 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2012-03-14 22:41:04 713784 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\{f38233c5-0a71-41f8-a5a9-361687a2f486}\gapaengine.dll 2012-03-14 22:38:41 ——– d—–w- c:\program files\Microsoft Security Client 2012-03-14 21:37:34 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-03-14 21:37:33 3913584 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-14 01:20:53 6552120 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{5b63491c-3068-41c8-9974-29f38f2e8b04}\mpengine.dll 2012-03-14 01:19:51 2343424 —-a-w- c:\windows\system32\win32k.sys 2012-03-14 01:19:45 1077248 —-a-w- c:\windows\system32\DWrite.dll 2012-03-14 01:18:17 8192 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-03-14 01:18:16 129536 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-03-14 01:18:15 58880 —-a-w- c:\windows\system32\rdpwsx.dll 2012-03-14 01:18:12 826880 —-a-w- c:\windows\system32\rdpcore.dll 2012-03-14 01:18:12 24576 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-03-14 01:18:12 183808 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-02-26 23:42:34 ——– d—–w- c:\program files\ooVoo 2012-02-26 04:42:07 2382848 ——w- c:\windows\system32\mshtml.tlb 2012-02-26 04:42:04 141112 —-a-w- c:\program files\internet explorer\sqmapi.dll 2012-02-26 04:41:59 194048 —-a-w- c:\program files\internet explorer\IEShims.dll 2012-02-26 04:41:59 1798656 —-a-w- c:\windows\system32\jscript9.dll 2012-02-26 04:41:51 1127424 —-a-w- c:\windows\system32\wininet.dll 2012-02-26 04:41:44 678912 —-a-w- c:\program files\internet explorer\iedvtool.dll 2012-02-26 04:41:30 1427456 —-a-w- c:\windows\system32\inetcpl.cpl . ==================== Find3M ==================== . 2012-03-25 19:41:10 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-03-01 17:51:58 447208 ——w- c:\windows\system32\drivers\avckf.sys 2012-03-01 17:51:55 609984 ——w- c:\windows\system32\drivers\avc3.sys 2012-02-03 15:51:28 63056 ——w- c:\windows\system32\drivers\bdsandbox.sys 2012-01-31 12:44:05 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-01-04 08:58:41 442880 —-a-w- c:\windows\system32\ntshrui.dll 2012-01-03 16:06:59 221658 —-a-w- c:\programdata\1325606236.bdinstall.bin 2011-12-30 05:27:56 478720 —-a-w- c:\windows\system32\timedate.cpl . ============= FINISH: 21:33:04.83 ===============
Post #5
Hi nikid506,

I would prefer that you copy/paste the logs so that I can read them more easily. :)

Have you had a chance to run aswMBR yet? If so, please post that to your next reply.
Post #6
sorry. i meant to mention that i could run the second report (not sure why) i tried it two and nothing happened. i will try again tonight. for now on i'll copy and paste. thanks!
Post #7
Hi,

Ok…try to run aswMBR in Safe Mode.

Reboot Your System in Safe Mode

How to use the F8 method to Start Your Computer in Safe Mode
  • Restart the computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
  • Use the arrow keys to select the Safe mode with Networking menu item
  • Press Enter.
Attempt to run aswMBR again in Safe Mode and if a log is produced please post that.
Post #8
okay, i finally got it. here it is. thanks! aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-03-27 18:37:29 —————————– 18:37:29.709 OS Version: Windows 6.1.7601 Service Pack 1 18:37:29.709 Number of processors: 2 586 0x1C0A 18:37:29.709 ComputerName: COLE-PC UserName: mom 18:37:31.410 Initialize success 18:38:36.571 AVAST engine defs: 12032702 18:38:39.582 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 18:38:39.582 Disk 0 Vendor: WDC_WD16 01.0 Size: 152627MB BusType: 3 18:38:39.613 Disk 0 MBR read successfully 18:38:39.628 Disk 0 MBR scan 18:38:39.660 Disk 0 unknown MBR code 18:38:39.691 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048 18:38:39.706 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 136683 MB offset 409600 18:38:39.738 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 15641 MB offset 280336384 18:38:39.784 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 102 MB offset 312369152 18:38:39.816 Disk 0 scanning sectors +312579760 18:38:39.925 Disk 0 scanning C:\Windows\system32\drivers 18:39:03.013 Service scanning 18:39:19.814 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32 18:39:42.996 Modules scanning 18:39:51.389 Disk 0 trace - called modules: 18:39:51.420 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys 18:39:51.451 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84b23948] 18:39:51.467 3 CLASSPNP.SYS[86d9f59e] -> nt!IofCallDriver -> [0x8444af08] 18:39:51.482 5 ACPI.sys[864b63d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84419028] 18:39:52.824 AVAST engine scan C:\Windows 18:39:56.786 AVAST engine scan C:\Windows\system32 18:44:36.479 AVAST engine scan C:\Windows\system32\drivers 18:44:58.709 AVAST engine scan C:\Users\mom 18:48:36.080 Disk 0 MBR has been saved successfully to "C:\Users\mom\Downloads\MBR.dat" 18:48:36.111 The log file has been saved successfully to "C:\Users\mom\Downloads\aswMBR.txt" 18:50:35.249 File: C:\Users\mom\AppData\Local\Temp\_av4_\data\aswar0.dll **INFECTED** Win32:Malware-gen 18:50:35.701 File: C:\Users\mom\AppData\Local\Temp\_av4_\data\updldr0.bin **INFECTED** Win32:Malware-gen 18:51:06.917 AVAST engine scan C:\ProgramData 18:53:03.667 Scan finished successfully 19:42:45.441 Disk 0 MBR has been saved successfully to "C:\Users\mom\Desktop\MBR.dat" 19:42:45.472 The log file has been saved successfully to "C:\Users\mom\Desktop\aswMBR.txt"
Post #9
Hi,

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #10
ComboFix 12-03-27.03 - Cole 03/27/2012 20:33:04.1.2 - x86 NETWORK Microsoft Windows 7 Starter 6.1.7601.1.1252.1.1033.18.1012.595 [GMT -4:00] Running from: c:\users\[removed]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0B58Q0KJ\ComboFix.exe AV: Bitdefender Antivirus *Disabled/Outdated* {50909708-FF80-02AF-F814-B28405891E92} AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} FW: Bitdefender Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9} SP: Bitdefender Antispyware *Disabled/Outdated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Dad\AppData\Local\exf.exe . . ((((((((((((((((((((((((( Files Created from 2012-02-28 to 2012-03-28 ))))))))))))))))))))))))))))))) . . 2012-03-28 00:47 . 2012-03-28 00:47 ——– d—–w- c:\users\mom\AppData\Local\temp 2012-03-28 00:47 . 2012-03-28 00:47 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-03-28 00:47 . 2012-03-28 00:47 ——– d—–w- c:\users\Dad\AppData\Local\temp 2012-03-28 00:47 . 2012-03-28 00:50 ——– d—–w- c:\users\Cole\AppData\Local\temp 2012-03-27 23:48 . 2012-03-28 00:20 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{77416E63-8CCF-4155-9BF3-1E7CAC8DE4F8}\offreg.dll 2012-03-26 21:29 . 2012-03-14 02:15 6582328 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{77416E63-8CCF-4155-9BF3-1E7CAC8DE4F8}\mpengine.dll 2012-03-25 21:36 . 2012-03-25 21:36 ——– d—–w- c:\users\Dad\AppData\Roaming\Intel Corporation 2012-03-25 20:26 . 2012-03-25 20:26 ——– d—–w- c:\programdata\{D3B41B92-9BC2-43EB-916A-4FA9E8191837} 2012-03-25 19:40 . 2012-03-25 19:40 ——– d—–w- c:\users\mom\AppData\Roaming\Intel Corporation 2012-03-25 19:28 . 2010-11-06 03:39 354840 —-a-w- c:\windows\system32\drivers\iaStor.sys 2012-03-25 19:27 . 2012-03-25 19:27 ——– d—–w- c:\users\mom\AppData\Roaming\InstallShield 2012-03-25 19:09 . 2010-03-24 06:53 527872 ——w- c:\windows\system32\stapi32.dll 2012-03-25 19:09 . 2010-01-27 10:28 140288 —-a-w- c:\windows\system32\aestacap.dll 2012-03-25 19:09 . 2009-10-10 08:45 380928 —-a-w- c:\windows\system32\aestecap.dll 2012-03-25 19:09 . 2009-03-03 09:57 61440 —-a-w- c:\windows\system32\aestaren.dll 2012-03-25 19:08 . 2010-03-24 06:53 536576 —-a-w- c:\windows\system32\idtmini1.exe 2012-03-25 19:08 . 2010-03-24 06:53 495708 —-a-w- c:\windows\sttray.exe 2012-03-25 19:08 . 2010-03-24 06:53 3354624 —-a-w- c:\windows\system32\stlang.dll 2012-03-25 19:08 . 2010-03-24 06:53 12628060 —-a-w- c:\windows\system32\idtcpl.cpl 2012-03-25 19:08 . 2010-03-24 02:53 175616 —-a-w- c:\windows\system32\staco.dll 2012-03-25 18:12 . 2012-03-25 18:13 ——– d—–w- C:\HJT 2012-03-25 17:51 . 2012-03-25 17:51 388096 —-a-r- c:\users\mom\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-03-25 17:29 . 2012-03-25 17:29 388096 —-a-r- c:\users\Dad\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-03-25 17:29 . 2012-03-25 17:29 ——– d—–w- c:\program files\Trend Micro 2012-03-15 23:30 . 2012-03-14 02:15 6582328 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-03-14 22:41 . 2012-03-14 22:40 713784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F38233C5-0A71-41F8-A5A9-361687A2F486}\gapaengine.dll 2012-03-14 22:38 . 2012-03-14 22:39 ——– d—–w- c:\program files\Microsoft Security Client 2012-03-14 21:37 . 2011-11-19 14:50 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-03-14 21:37 . 2011-11-19 14:50 3913584 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-14 01:20 . 2012-02-08 06:03 6552120 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B63491C-3068-41C8-9974-29F38F2E8B04}\mpengine.dll 2012-03-14 01:19 . 2012-02-03 03:54 2343424 —-a-w- c:\windows\system32\win32k.sys 2012-03-14 01:19 . 2012-02-10 05:38 1077248 —-a-w- c:\windows\system32\DWrite.dll 2012-03-14 01:18 . 2012-01-25 05:27 8192 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-03-14 01:18 . 2012-01-25 05:32 129536 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-03-14 01:18 . 2012-01-25 05:32 58880 —-a-w- c:\windows\system32\rdpwsx.dll 2012-03-14 01:18 . 2012-02-17 05:34 826880 —-a-w- c:\windows\system32\rdpcore.dll 2012-03-14 01:18 . 2012-02-17 04:14 183808 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-03-14 01:18 . 2012-02-17 04:13 24576 —-a-w- c:\windows\system32\drivers\tdtcp.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-25 19:41 . 2011-05-27 12:20 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-03-01 17:51 . 2011-11-28 22:34 447208 ——w- c:\windows\system32\drivers\avckf.sys 2012-03-01 17:51 . 2011-11-25 18:56 609984 ——w- c:\windows\system32\drivers\avc3.sys 2012-02-03 15:51 . 2012-02-03 15:51 63056 ——w- c:\windows\system32\drivers\bdsandbox.sys 2012-01-31 12:44 . 2010-12-26 16:57 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-01-04 08:58 . 2012-02-21 00:41 442880 —-a-w- c:\windows\system32\ntshrui.dll 2012-01-03 16:06 . 2012-01-03 16:06 221658 —-a-w- c:\programdata\1325606236.bdinstall.bin 2011-12-30 05:27 . 2012-02-21 00:41 478720 —-a-w- c:\windows\system32\timedate.cpl 2011-04-14 16:26 . 2011-04-29 21:26 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-09-29 02:44 1400712 ——w- c:\program files\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter] @="{D25B32FE-CB96-491A-98FF-AD59DA382D69}" [HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter] @="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}" [HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter] @="{B3C78E40-6B64-47C3-AE34-60B770881EB8}" [HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter] @="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}" [HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter] @="{855156F0-2A0F-11DE-8C30-0800200C9A66}" [HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ooVoo.exe"="c:\program files\ooVoo\oovoo.exe" [2012-02-08 22465104] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-04-09 601144] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "ZumoDrive"="c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" [2010-06-26 2038] "Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-03-02 1260] "BSDAppUpdater"="c:\program files\Common Files\BSD\AppUpdater\BSDChecker.exe" [2010-11-24 1660232] "BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-03-01 1183080] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-03-24 495708] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-23 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-23 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-23 150552] "IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [2012-03-01 609984] R1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-15 90704] R1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [2010-01-19 85128] R1 DVMIO;DeviceVM IO Service;c:\windows\system32\DRIVERS\dvmio.sys [2009-11-11 18136] R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe [2009-03-03 81920] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\QuickWeb\QW.SYS\config\DVMExportService.exe [2010-04-13 338168] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560] R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-04-05 103992] R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896] R2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-04-09 26168] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336] R2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-02-03 50128] R2 xpssvc;Skyhook Wireless XPS Service;c:\program files\Skyhook Wireless\XPS\xpssvc.exe [2010-04-13 699720] R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [2012-03-01 447208] R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [2012-02-03 63056] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392] R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944] R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2010-04-20 228896] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-15 307544] R3 XPSVCOM;XPSVCOM;c:\windows\system32\DRIVERS\XPSVCOM.sys [2010-03-03 12416] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-15 74832] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [2011-11-25 240184] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-11-28 233472] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4FB2AA7C-C8E4-BBC8-BB1C-FAAB2EF5914B}] 2009-07-14 01:14 141824 —-a-w- c:\windows\System32\wscript.exe . Contents of the 'Scheduled Tasks' folder . 2012-03-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1000Core.job - c:\users\Cole\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-12 04:07] . 2012-03-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1000UA.job - c:\users\Cole\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-12 04:07] . 2012-03-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1001Core.job - c:\users\Dad\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 17:41] . 2012-03-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1001UA.job - c:\users\Dad\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 17:41] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.cnn.com/ mStart Page = about:blank uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Cole\AppData\Roaming\Mozilla\Firefox\Profiles\1bwt27pj.default\ FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{7846ae31-bea2-438a-8f5e-2d899361656c} - (no file) AddRemove-{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226} - c:\program files\InstallShield Installation Information\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}\setup.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-03-27 20:54:29 ComboFix-quarantined-files.txt 2012-03-28 00:54 . Pre-Run: 91,608,281,088 bytes free Post-Run: 91,691,536,384 bytes free . - - End Of File - - AD5317073C6130C2053579A531365774
Post #11
Hi nikid506,

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
    ClearJavaCache::

DDS::
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: {7846AE31-BEA2-438A-8F5E-2D899361656C} - No File

Firefox::
FF - ProfilePath - c:\users\mom\appdata\roaming\mozilla\firefox\profiles\kxk6khsu.default\
FF - component: c:\program files\ca\ca internet security suite\ca anti-phishing\toolbar\firefox\components\CAFxToolBar.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #12
so i got this right. save the file in notepad and drag it to the combox box on your post (the blinking one) and let it go. what should i expect while it's running? does it look like it's running in a browser? thanks
Post #13
Hi, Ok…After you have created the CFScript.txt with the fix that I provided. Drag and drop that file onto the ComboFix icon on your Desktop. It will start to run automatically.
Post #14
okay, you mean the last report i ran and posted, correct. apologizes I did something else and waited about an hour. i will do this tonight. thanks!
Post #15
Yes…you are going to create the file in Notepad…name it CFScript.txt being sure to follow the instructions above and save it to your Desktop. Once it has been saved just drag the file onto the ComboFix icon on your Desktop and drop it there. The program will start automatically. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI