What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HP Mini Netbook Super Slow [Solved]

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
nevermind i see it now. i'm running it now. i hope i closed my antivirus and spyware software down in time. the machine is so messed up that it sometimes tells me my antivirus software is not running and then sometimes it is. does that make any sense?
Post #18
i think this is it. ComboFix 12-03-29.02 - mom 03/29/2012 18:18:33.2.2 - x86 Microsoft Windows 7 Starter 6.1.7601.1.1252.1.1033.18.1012.299 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\mom\Desktop\CFScript.txt AV: Bitdefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92} AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9} SP: Bitdefender Antispyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\ask.com\GenericAskToolbar.dll . . ((((((((((((((((((((((((( Files Created from 2012-02-28 to 2012-03-29 ))))))))))))))))))))))))))))))) . . 2012-03-29 22:44 . 2012-03-29 22:44 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-03-29 22:44 . 2012-03-29 22:44 ——– d—–w- c:\users\Dad\AppData\Local\temp 2012-03-29 22:44 . 2012-03-29 22:44 ——– d—–w- c:\users\Cole\AppData\Local\temp 2012-03-29 22:09 . 2012-03-29 22:09 29904 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E65E013F-7F60-42C3-87C3-6D28429E342A}\MpKsl5869415f.sys 2012-03-28 23:45 . 2012-03-14 02:15 6582328 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E65E013F-7F60-42C3-87C3-6D28429E342A}\mpengine.dll 2012-03-28 00:54 . 2012-03-29 22:45 ——– d—–w- c:\users\mom\AppData\Local\temp 2012-03-25 21:36 . 2012-03-25 21:36 ——– d—–w- c:\users\Dad\AppData\Roaming\Intel Corporation 2012-03-25 20:26 . 2012-03-25 20:26 ——– d—–w- c:\programdata\{D3B41B92-9BC2-43EB-916A-4FA9E8191837} 2012-03-25 19:40 . 2012-03-25 19:40 ——– d—–w- c:\users\mom\AppData\Roaming\Intel Corporation 2012-03-25 19:28 . 2010-11-06 03:39 354840 —-a-w- c:\windows\system32\drivers\iaStor.sys 2012-03-25 19:27 . 2012-03-25 19:27 ——– d—–w- c:\users\mom\AppData\Roaming\InstallShield 2012-03-25 19:09 . 2010-03-24 06:53 527872 ——w- c:\windows\system32\stapi32.dll 2012-03-25 19:09 . 2010-01-27 10:28 140288 —-a-w- c:\windows\system32\aestacap.dll 2012-03-25 19:09 . 2009-10-10 08:45 380928 —-a-w- c:\windows\system32\aestecap.dll 2012-03-25 19:09 . 2009-03-03 09:57 61440 —-a-w- c:\windows\system32\aestaren.dll 2012-03-25 19:08 . 2010-03-24 06:53 536576 —-a-w- c:\windows\system32\idtmini1.exe 2012-03-25 19:08 . 2010-03-24 06:53 495708 —-a-w- c:\windows\sttray.exe 2012-03-25 19:08 . 2010-03-24 06:53 3354624 —-a-w- c:\windows\system32\stlang.dll 2012-03-25 19:08 . 2010-03-24 06:53 12628060 —-a-w- c:\windows\system32\idtcpl.cpl 2012-03-25 19:08 . 2010-03-24 02:53 175616 —-a-w- c:\windows\system32\staco.dll 2012-03-25 18:12 . 2012-03-25 18:13 ——– d—–w- C:\HJT 2012-03-25 17:51 . 2012-03-25 17:51 388096 —-a-r- c:\users\mom\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-03-25 17:29 . 2012-03-25 17:29 388096 —-a-r- c:\users\Dad\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-03-25 17:29 . 2012-03-25 17:29 ——– d—–w- c:\program files\Trend Micro 2012-03-15 23:30 . 2012-03-14 02:15 6582328 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-03-14 22:41 . 2012-03-14 22:40 713784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F38233C5-0A71-41F8-A5A9-361687A2F486}\gapaengine.dll 2012-03-14 22:38 . 2012-03-14 22:39 ——– d—–w- c:\program files\Microsoft Security Client 2012-03-14 21:37 . 2011-11-19 14:50 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-03-14 21:37 . 2011-11-19 14:50 3913584 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-14 01:20 . 2012-02-08 06:03 6552120 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B63491C-3068-41C8-9974-29F38F2E8B04}\mpengine.dll 2012-03-14 01:19 . 2012-02-03 03:54 2343424 —-a-w- c:\windows\system32\win32k.sys 2012-03-14 01:19 . 2012-02-10 05:38 1077248 —-a-w- c:\windows\system32\DWrite.dll 2012-03-14 01:18 . 2012-01-25 05:27 8192 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-03-14 01:18 . 2012-01-25 05:32 129536 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-03-14 01:18 . 2012-01-25 05:32 58880 —-a-w- c:\windows\system32\rdpwsx.dll 2012-03-14 01:18 . 2012-02-17 05:34 826880 —-a-w- c:\windows\system32\rdpcore.dll 2012-03-14 01:18 . 2012-02-17 04:14 183808 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-03-14 01:18 . 2012-02-17 04:13 24576 —-a-w- c:\windows\system32\drivers\tdtcp.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-25 19:41 . 2011-05-27 12:20 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-03-01 17:51 . 2011-11-28 22:34 447208 ——w- c:\windows\system32\drivers\avckf.sys 2012-03-01 17:51 . 2011-11-25 18:56 609984 ——w- c:\windows\system32\drivers\avc3.sys 2012-02-03 15:51 . 2012-02-03 15:51 63056 ——w- c:\windows\system32\drivers\bdsandbox.sys 2012-01-31 12:44 . 2010-12-26 16:57 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-01-04 08:58 . 2012-02-21 00:41 442880 —-a-w- c:\windows\system32\ntshrui.dll 2012-01-03 16:06 . 2012-01-03 16:06 221658 —-a-w- c:\programdata\1325606236.bdinstall.bin 2011-04-14 16:26 . 2011-04-29 21:26 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter] @="{D25B32FE-CB96-491A-98FF-AD59DA382D69}" [HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter] @="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}" [HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter] @="{B3C78E40-6B64-47C3-AE34-60B770881EB8}" [HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter] @="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}" [HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter] @="{855156F0-2A0F-11DE-8C30-0800200C9A66}" [HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}] 2010-03-28 22:22 718848 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-04-09 601144] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "ZumoDrive"="c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" [2010-06-26 2038] "Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-03-02 1260] "BSDAppUpdater"="c:\program files\Common Files\BSD\AppUpdater\BSDChecker.exe" [2010-11-24 1660232] "BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-03-01 1183080] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-03-24 495708] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-23 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-23 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-23 150552] "IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [2012-03-01 447208] R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [2012-02-03 63056] R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-15 307544] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [2012-03-01 609984] S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-15 74832] S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-15 90704] S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [2010-01-19 85128] S1 DVMIO;DeviceVM IO Service;c:\windows\system32\DRIVERS\dvmio.sys [2009-11-11 18136] S1 MpKsl5869415f;MpKsl5869415f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E65E013F-7F60-42C3-87C3-6D28429E342A}\MpKsl5869415f.sys [2012-03-29 29904] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe [2009-03-03 81920] S2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\QuickWeb\QW.SYS\config\DVMExportService.exe [2010-04-13 338168] S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560] S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-04-05 103992] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896] S2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-04-09 26168] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336] S2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-02-03 50128] S2 xpssvc;Skyhook Wireless XPS Service;c:\program files\Skyhook Wireless\XPS\xpssvc.exe [2010-04-13 699720] S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [2011-11-25 240184] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392] S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2010-04-20 228896] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-11-28 233472] S3 XPSVCOM;XPSVCOM;c:\windows\system32\DRIVERS\XPSVCOM.sys [2010-03-03 12416] . . — Other Services/Drivers In Memory — . *NewlyCreated* - MPKSL5869415F . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4FB2AA7C-C8E4-BBC8-BB1C-FAAB2EF5914B}] 2009-07-14 01:14 141824 —-a-w- c:\windows\System32\wscript.exe . Contents of the 'Scheduled Tasks' folder . 2012-03-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1000Core.job - c:\users\Cole\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-12 04:07] . 2012-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1000UA.job - c:\users\Cole\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-12 04:07] . 2012-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1001Core.job - c:\users\Dad\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 17:41] . 2012-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-588976369-4276230154-4151312913-1001UA.job - c:\users\Dad\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 17:41] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ mStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\mom\AppData\Roaming\Mozilla\Firefox\Profiles\kxk6khsu.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/ FF - prefs.js: network.proxy.type - 0 . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-588976369-4276230154-4151312913-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-588976369-4276230154-4151312913-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— . - - - - - - - > 'Explorer.exe'(5140) c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll c:\program files\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFTaskbar.dll . Completion time: 2012-03-29 18:53:10 ComboFix-quarantined-files.txt 2012-03-29 22:53 ComboFix2.txt 2012-03-28 00:54 . Pre-Run: 92,069,097,472 bytes free Post-Run: 92,034,609,152 bytes free . - - End Of File - - ACDBEDD9D4D39302AF95A7444957CF0D
Post #19
Hi,

Please download Malwarebytes' Anti-Malware to your desktop.

  • Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.


The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
———-

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

  • Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
———-

In your next reply please post the logs made by Malwarebytes and ESET online scanner.
Post #20
jeff, my email says you posted something at 8 pm, however, the forum doesn't have new posts. I don't want to miss something. the last thing i posted was the log from the combofix and notepad script.
Post #21
Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.03.29.09

Windows 7 Service Pack 1 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
mom :: COLE-PC [administrator]

Protection: Disabled

3/29/2012 11:28:33 PM
mbam-log-2012-03-29 (23-28-33).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 230261
Time elapsed: 5 minute(s), 11 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65bcd620-07dd-012f-819f-073cf1b8f7c6} (Adware.GamePlayLab) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
Post #24
here are the results. one infected file C:\Users\Dad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZWOY3FH1\1[1].htm JS/TrojanDownloader.FraudLoad.NAP trojan
Post #25
Hi,

Let's remove that shall we…

Go to Start >> in the Start Search bar type Run. When Run populates above select it and then copy/paste the following into the Run text bar.

cmd del "C:\Users\Dad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZWOY3FH1\1[1].htm" /f /q

Press Enter and then close the command prompt window.
———-

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 9.5.0 MUI first. Be sure to move any PDF documents to another folder first though.
———-

Please download JavaRa to your desktop and unzip it to its own
folder
  • Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
    click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
    Java Runtime Environment (JRE) version for your computer using the Offline version of either x86 (32bit operating system) or x64 (64bit operating system).
———-

Next run a new scan with DDS and post both of the new logs created into your next reply and let me know how your system is running.
Post #26
jeff, sorry, but the first part of your last message is confusing me. when i hit run and i copy the url you gave me a command prompt comes up, but nothing happens. am i suppose to a copy the url after c:\windows\system32> after the command prompt comes up? thanks
Post #27
Try this instead…

Go to Start >> Run >> type CMD and when it populates above right-click and select Run as Administrator.

When the command prompt opens copy/paste the following into the window and then press Enter.

del "C:\Users\Dad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZWOY3FH1\1[1].htm" /f /q

Close the Command Prompt window.
—————-

Now continue following the instructions that I provided for your updates and new DDS logs.
Post #29
in response to the second part of your last reply. what updates and DDS logs are you referring to? Maybe you can provide me just the post # if that's easier. ty

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI