Spyware / Malware / Virus Removal
Infected? [Solved]
91 min read
sinnead
Problem. I tried running OTC run fix and the computer froze again and had to do a hard shut down. Tried getting to "safe mode with networking". As it was starting after a reboot I'd move to "safe mode with networking", click enter and the computer would start running some code on the screen, and I'd be taken back to the same screen with the listing including "safe mode with networking". Tried 3 times, but still keep being taken back to that screen.
So what's the next step? Will OTC run fix work in simple safe mode, or do I need safe mode with networking?
Satchfan
It's fine in safe mode but before trying the fix again, I'd like you to do this:
Set the ArcSoft Connect Daemon (ACService.exe) service to Manual.
Set the ArcSoft Connect Daemon (ACService.exe) service to Manual.
- 1. Click Start > Run, type services.msc, and then click OK
2. In the list of services, click ArcSoft Connect Daemon
3. Change the โStartup Typeโ to Manual. To do this:
a. Right-click ArcSoft Connect Daemon, then click Properties
b. In the ArcSoft Connect Daemon Properties dialog box, click the โGeneral tabโ, and then click Manual in the Startup type list
c. Click Apply, and then click OK - reboot the computer.
sinnead
Okay, problem. I cannot even get to either safe mode, or safe mode with networking. I just keep getting booted back to the introductory blue screen, then taken to the choice page again(for safe mode, normal, etc). It won't stop doing this until I choose normal. I tried shutting down antivirus, etc. and the computer STILL freezes when I try to do the run fix.
Satchfan
Did you set the ArcSoft Connect Daemon service to Manual before trying the OTL "fix"?
If not, please do so and run the fix in normal mode.
Restore Safe Mode
Let's see if we can restore safe mode and then look again at why this has happened
Satchfan
If not, please do so and run the fix in normal mode.
Restore Safe Mode
Let's see if we can restore safe mode and then look again at why this has happened
- download SafeBoot.zip to your Desktop
- click on SafeBoot.zip to open the Zip file
- extract SafeBoot.reg also to your Desktop
- double-click on the icon
- you will receive a prompt similar to: "Do you wish to merge the information into the registry?": answer Yes and wait for a message to appear similar to Merged Successfully.
- reboot your machine
Satchfan
sinnead
Okay, I have no idea what's going on here. First, yes- I put Arcsoft to manual. Made no difference. I downloaded safeboot, followed the directions. Wound up with FOUR icons on my desktop. Clicked one and got the message "successfully integrated with register". Tried booting into safe mode again with same results as before.
sinnead
Just had a thought- could the fact I use chrome as a default browser cause the problems I'm having? One other thing I've been noticing. Over half the time when I come onto the computer it will say "one program running". But when I open my user account, there is nothing.
Satchfan
No. I don't like Chrome and it causes many problems but your symptoms aren't consistent with Chrome's failings.could the fact I use chrome as a default browser cause the problems I'm having?
Let's try a heavier scan.
Download and run ComboFix
Download ComboFix from the following location:
Link
* IMPORTANT !!! Save ComboFix.exe to your Desktop
- Disable your AntiVirus and AntiSpyware applications, as they may otherwise interfere with our tools. See here for programs that need to be disabled and instruction on how to disable them.
- Remember to re-enable them when we're done.
- Double click on ComboFix.exe & follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.
Click to load external image (Posted Image)
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click to load external image (Posted Image)
Click on Yes, to continue scanning for malware.
When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt
Satchfan
sinnead
Downloaded combofix. Shut down firewall and antivirus according to instructions. Ran combofix. When I left at 9am this morning it had finished and was preparing the log. I got back just now(2pm), and it STILL said preparing log. While I'm not absolutely certain, I don't think preparing a log should take 5 hours. So I closed it down. I checked and no log anywhere. I can see combofix in C:, but no combofix.txt. I even opened combofix just to be sure and not there either.
Satchfan
I'd like you to try a different type of scan so that we can look at this from another angle.
Run DDS
Please download DDS by sUBs from one of the following links and save it to your desktop.
Run DDS
Please download DDS by sUBs from one of the following links and save it to your desktop.
DDS.pif
DDS.com
- disable any script blocking protection (How to Disable your Security Programs)
- double click DDS icon to run the tool (may take up to 3 minutes to run)
- when done, DDS.txt will open.
- after a few moments, attach.txt will open in a second window.
- save both reports to your desktop.
- Post the contents of the DDS.txt and Attach.txt reports in your next reply
sinnead
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.17.2
Run by [removed] at 18:47:52 on 2013-05-04
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1470.866 [GMT -6:00]
.
AV: Bitdefender Antivirus Free Edition *Disabled/Updated* {9488E0FA-F058-4673-850E-E755F112BABC}
FW: *Enabled*
FW: AVG Firewall *Disabled*
.
============== Running Processes ================
.
C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
C:\WINDOWS\Explorer.EXE
c:\program files\google\update\1.3.21.135\googlecrashhandler.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
c:\documents and settings\cliff\local settings\application data\google\update\1.3.21.135\googlecrashhandler.exe
C:\Program Files\Microsoft Office\Office12\onenotem.EXE
C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Javaโข Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Javaโข Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://www.shockwave.com/content/bejeweled2/sis/popcaploader_v10.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
TCP: NameServer = 64.59.135.135 64.59.128.121
TCP: Interfaces\{22C0B27B-0C75-4F33-8875-CAC5AA0C595B} : DHCPNameServer = [removed] [removed]
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - c:\program files\quicktax 2009\ic2009pp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
============= SERVICES / DRIVERS ===============
.
R0 avc3;avc3;c:\windows\system32\drivers\avc3.sys [2013-4-27 622616]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-4-4 33112]
R1 gzflt;gzflt;c:\windows\system32\drivers\gzflt.sys [2013-4-27 162976]
R2 gzserv;Bitdefender Antivirus Free Edition;c:\program files\bitdefender\antivirus free edition\gzserv.exe [2013-4-27 27136]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-9-19 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-10-27 701512]
R2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files\common files\avg secure search\vtoolbarupdater\14.2.0\ToolbarUpdater.exe [2013-4-5 968880]
R3 avckf;avckf;c:\windows\system32\drivers\avckf.sys [2013-4-27 447208]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-10-27 22856]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-10-26 1691480]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2013-4-6 79360]
S3 ksaud;Creative USB Audio Driver;c:\windows\system32\drivers\ksaud.sys [2013-4-6 1210624]
S3 ksaudfl;ksaudfl;c:\windows\system32\drivers\ksaudfl.sys [2013-4-6 2016640]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2011-6-13 267568]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2013-3-28 13024]
.
=============== Created Last 30 ================
.
2013-05-04 15:39:18 โโโ d-sha-r- C:\cmdcons
2013-05-04 15:34:38 98816 โ-a-w- c:\windows\sed.exe
2013-05-04 15:34:38 256000 โ-a-w- c:\windows\PEV.exe
2013-05-04 15:34:38 208896 โ-a-w- c:\windows\MBR.exe
2013-05-04 15:34:24 โโโ dโโw- C:\ComboFix
2013-04-27 16:35:30 241992 โ-a-w- c:\windows\system32\drivers\avchv.sys
2013-04-27 16:28:14 622616 โ-a-w- c:\windows\system32\drivers\avc3.sys
2013-04-27 16:28:14 447208 โ-a-w- c:\windows\system32\drivers\avckf.sys
2013-04-27 16:25:30 โโโ dโโw- c:\documents and settings\sherry\application data\QuickScan
2013-04-27 16:25:07 โโโ dโโw- c:\program files\Bitdefender
2013-04-27 16:25:04 343456 โ-a-w- c:\windows\system32\drivers\trufos.sys
2013-04-27 16:25:01 162976 โ-a-w- c:\windows\system32\drivers\gzflt.sys
2013-04-24 00:53:10 โโโ dโโw- C:\_OTL
2013-04-16 06:22:37 388096 โ-a-r- c:\documents and settings\sherry\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2013-04-16 06:22:36 โโโ dโโw- c:\program files\Trend Micro
2013-04-06 23:12:10 โโโ dโโw- c:\program files\DriverUpdate
2013-04-06 22:36:45 90112 โโw- c:\windows\Updreg.EXE
2013-04-06 22:35:58 25600 โ-a-r- c:\windows\system32\KSRun.dll
2013-04-06 22:35:58 196608 โ-a-r- c:\windows\system32\KsDvInst.dll
2013-04-06 22:35:57 2016640 โ-a-r- c:\windows\system32\drivers\ksaudfl.sys
2013-04-06 22:35:56 1210624 โ-a-r- c:\windows\system32\drivers\ksaud.sys
2013-04-06 22:34:02 271360 โ-a-r- c:\windows\system32\KSXPPI32.dll
2013-04-06 22:33:33 8520 โ-a-r- c:\windows\system32\DeviceDefaultsXP.reg
2013-04-06 22:33:33 26768 โ-a-r- c:\windows\ksaudENG.reg
2013-04-06 22:33:33 2630 โ-a-r- c:\windows\MixerName.reg
2013-04-06 22:33:33 15724 โ-a-r- c:\windows\system32\MixerDefaultXP.reg
2013-04-06 22:33:17 7062 โ-a-w- c:\windows\system32\audiopid.vxd
2013-04-06 22:32:58 647872 โโw- c:\windows\system32\Mscomct2.ocx
2013-04-06 22:32:57 53248 โโw- c:\windows\Ctregrun.exe
2013-04-06 22:32:14 445016 โ-a-w- c:\windows\system32\wrap_oal.dll
2013-04-06 22:32:14 109144 โ-a-w- c:\windows\system32\OpenAL32.dll
2013-04-06 22:32:02 โโโ dโโw- c:\program files\common files\Creative Labs Shared
2013-04-06 22:30:03 โโโ dโโw- c:\program files\Creative
2013-04-06 22:28:36 69715 โ-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll
2013-04-06 22:28:36 5632 โ-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe
2013-04-06 22:28:36 266240 โ-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll
2013-04-06 22:28:36 192512 โ-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll
2013-04-06 22:28:35 729088 โ-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll
2013-04-06 22:28:33 311428 โ-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll
2013-04-06 22:28:33 188548 โ-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll
2013-04-06 22:27:09 60032 -cโa-w- c:\windows\system32\dllcache\usbaudio.sys
2013-04-06 22:27:09 60032 โ-a-w- c:\windows\system32\drivers\USBAUDIO.sys
.
==================== Find3M ====================
.
2013-04-27 15:35:23 13024 โ-a-w- c:\windows\system32\drivers\SWDUMon.sys
2013-04-05 16:01:27 33112 โ-a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-04-04 20:50:32 22856 โ-a-w- c:\windows\system32\drivers\mbam.sys
2013-03-28 22:23:37 0 โ-a-w- c:\windows\system32\TempWmicBatchFile.bat
2013-03-26 13:13:07 94112 โ-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-26 13:13:02 143872 โ-a-w- c:\windows\system32\javacpl.cpl
2013-03-26 13:13:01 861088 โ-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-26 13:13:01 782240 โ-a-w- c:\windows\system32\deployJava1.dll
2013-03-13 01:07:32 73432 โ-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-13 01:07:32 693976 โ-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-08 08:36:22 293376 โ-a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:28:24 2193408 โ-a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50:28 2070016 โ-a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-02 02:06:31 916480 โ-a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06:30 43520 โ-a-w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06:30 1469440 โโw- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25:02 1867264 โ-a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08:47 385024 โ-a-w- c:\windows\system32\html.iec
2013-02-27 07:56:51 2067456 โ-a-w- c:\windows\system32\mstscax.dll
2013-02-12 00:32:23 12928 โ-a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-12 00:32:23 12928 โโw- c:\windows\system32\drivers\usb8023x.sys
.
============= FINISH: 18:48:55.60 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 26/10/2010 7:28:25 PM
System Uptime: 04/05/2013 1:54:41 PM (5 hours ago)
.
Motherboard: Intel Corporation | | D101GGC
Processor: Intelยฎ Celeronยฎ CPU 3.06GHz | Socket 775 | 3066/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 146.995 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM Bus Controller
Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_D6008086&REV_82\3&61AAA01&0&A0
Manufacturer:
Name: SM Bus Controller
PNP Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_D6008086&REV_82\3&61AAA01&0&A0
Service:
.
==== System Restore Points ===================
.
RP847: 21/04/2013 4:23:36 AM - Installed HiJackThis
RP848: 22/04/2013 6:27:35 AM - System Checkpoint
RP849: 22/04/2013 8:00:19 PM - OTL Restore Point - 22/04/2013 8:00:14 PM
RP850: 23/04/2013 8:05:21 PM - System Checkpoint
RP851: 24/04/2013 10:00:50 PM - System Checkpoint
RP852: 25/04/2013 10:33:49 PM - System Checkpoint
RP853: 27/04/2013 12:53:33 AM - System Checkpoint
RP854: 27/04/2013 8:17:53 AM - Removed AVG 2013
RP855: 27/04/2013 8:19:56 AM - Removed AVG 2013
RP856: 29/04/2013 12:02:52 AM - System Checkpoint
RP857: 30/04/2013 12:56:15 AM - System Checkpoint
RP858: 01/05/2013 1:13:40 AM - System Checkpoint
RP859: 02/05/2013 1:27:39 AM - System Checkpoint
RP860: 03/05/2013 9:39:24 AM - System Checkpoint
RP861: 04/05/2013 3:32:51 PM - System Checkpoint
.
==== Installed Programs ======================
.
2007 Microsoft Office Suite Service Pack 3 (SP3)
32 Bit HP CIO Components Installer
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.6)
Adobe Shockwave Player 11.5
AIO_Scan
Alchemy
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft Video Downloader
ATI Display Driver
Bitdefender Antivirus Free Edition
Bonjour
Bubble Town
BufferChm
Chuzzle Deluxe
Copy
Coupon Printer for Windows
Creative System Information
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DeviceManagementQFolder
DJ_AIO_03_F4200_Software_Min
DJ_AIO_Software
DJ_AIO_Software_min
DriverUpdate
Dropbox
eSupportQFolder
GIMP 2.6.11
Google Apps
Google Chrome
Google Earth
Google Update Helper
Google Updater
Hardwood Euchre
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB2779562)
HP Customer Participation Program 9.0
HP Deskjet All-In-One Software 9.0
HP Deskjet F4200 All-In-One Driver 11.0 03
HP Imaging Device Functions 9.0
HP Photo Creations
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Product Assistant
HP Product Detection
HP Solution Center 9.0
HP Update
HPDiagnosticAlert
HPProductAssistant
HPSSupply
iMesh
ImgBurn
IrfanView (remove only)
iTunes
Java 7 Update 17
Java Auto Updater
Javaโข 6 Update 31
JavaFX 2.1.1
MahJong Suite 2012 v9.0
Malwarebytes Anti-Malware version 1.75.0.1300
MarketResearch
Microsoft .NET Framework 1.0 Hotfix (KB2572066)
Microsoft .NET Framework 1.0 Hotfix (KB2604042)
Microsoft .NET Framework 1.0 Hotfix (KB2656378)
Microsoft .NET Framework 1.0 Security Update (KB2698035)
Microsoft .NET Framework 1.0 Security Update (KB2742607)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Fix it Center
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Web Publishing Wizard 1.52
MobileMe Control Panel
MSN
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nikon Message Center
Nikon Transfer
PopCap Browser Plugin
Pretty Good Solitaire version 12.4.0
PSSWCORE
QuickTax 2009
QuickTime
Realtek High Definition Audio Driver
RoE Power Tools
Scan
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB2761465)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2799329)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2753842)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2761226)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2778344)
Security Update for Windows XP (KB2779030)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2799494)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB923789)
Skypeโข 6.3
SolutionCenter
Sound Blaster X-Fi Go! Pro
Status
Styler
The Print Shop 22
Toolbox
TrayApp
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit Edition
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
VideoToolkit01
WebFldrs XP
WebReg
Windows PowerShellโข 1.0
Windows XP Service Pack 3
.
==== Event Viewer Messages From Past Week ========
.
27/04/2013 9:31:54 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
27/04/2013 9:13:27 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm
27/04/2013 8:41:07 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The MBAMScheduler service terminated unexpectedly. It has done this 1 time(s).
27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The Creative Audio Service service terminated unexpectedly. It has done this 1 time(s).
27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The ArcSoft Connect Daemon service terminated unexpectedly. It has done this 1 time(s).
27/04/2013 8:41:01 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
27/04/2013 8:41:00 AM, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).
27/04/2013 8:38:12 AM, error: System Error [1003] - Error code 100000cf, parameter1 bf031198, parameter2 00000008, parameter3 bf031198, parameter4 00000000.
27/04/2013 10:28:31 AM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.
.
==== End Of File ===========================
Satchfan
There are no signs of malware in that log.
Can you check and see if ComboFix created a log when you ran it.
It would be found at c:\combofix.txt
===================================================
Iโd like you to check your system files:
===================================================
Please run Malwarebytes and SecurityCheck as instructed in this previous post.
In the next post, please supply the ComboFix log, if found, the result of sfc scannow, Mbam.txt and Checkup.txt.
Thanks
Satchfan
Can you check and see if ComboFix created a log when you ran it.
It would be found at c:\combofix.txt
===================================================
Iโd like you to check your system files:
- click on Start, type command prompt
- right click on Command Prompt at the top of the window and select Run as Administrator
- in the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter.
- open a Command Prompt (it doesnโt have to be as Administrator)
- type (or copy and paste) findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt and press Enter
- type (or copy and paste) notepad sfcdetails.txt and press Enter.
===================================================
Please run Malwarebytes and SecurityCheck as instructed in this previous post.
In the next post, please supply the ComboFix log, if found, the result of sfc scannow, Mbam.txt and Checkup.txt.
Thanks
Satchfan
sinnead
Computer dummy here. I clicked start, but have no idea WHERE to type command prompt. Opened run and typed command prompt and opened it, but it was asking for the original cd to be inserted? Tried right clicking at the top of the window, but it did nothing. Typed sfc /scannow anyway, and that's when it asked for the cd.
sinnead
In the interim, here are both mbam, and combofix(had to use search function, but found it!)
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.05.05.05
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Sherry :: DA658A6C7 [administrator]
05/05/2013 12:24:44 PM
mbam-log-2013-05-05 (12-24-44).txt
Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 384951
Time elapsed: 1 hour(s), 48 minute(s), 42 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
ComboFix 13-05-04.01 - Sherry 04/05/2013 9:43:11.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1470.885 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\My Documents\Downloads\combofix.exe
AV: Bitdefender Antivirus Free Edition *Disabled/Updated* {9488E0FA-F058-4673-850E-E755F112BABC}
FW: *Enabled* {9488E0FA-F058-4673-850E-E755F112BABC}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Documents and Settings\All Users\Application Data\1367079887.bdinstall.bin
C:\Documents and Settings\All Users\Application Data\TEMP
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\Cache\1eeece3971bfd15f.fb
C:\WINDOWS\system32\Cache\26b2515a62af3429.fb
C:\WINDOWS\system32\Cache\26c630d098e22dd5.fb
C:\WINDOWS\system32\Cache\272512937d9e61a4.fb
C:\WINDOWS\system32\Cache\287204568329e189.fb
C:\WINDOWS\system32\Cache\28bc8f716fd76a47.fb
C:\WINDOWS\system32\Cache\2c53092c95605355.fb
C:\WINDOWS\system32\Cache\311c38d3977da3b5.fb
C:\WINDOWS\system32\Cache\31a0997e9a5b5eb3.fb
C:\WINDOWS\system32\Cache\32c84fe32bb74d60.fb
C:\WINDOWS\system32\Cache\3917078cb68ec657.fb
C:\WINDOWS\system32\Cache\41d7108c3d15c194.fb
C:\WINDOWS\system32\Cache\590ba23ce359fd0c.fb
C:\WINDOWS\system32\Cache\610289e025a3ee9a.fb
C:\WINDOWS\system32\Cache\651c5d3cdbfb8bd1.fb
C:\WINDOWS\system32\Cache\6c59ac5e7e7a3ad0.fb
C:\WINDOWS\system32\Cache\6d03dad1035885d3.fb
C:\WINDOWS\system32\Cache\95f567698be8a182.fb
C:\WINDOWS\system32\Cache\a8556537add6dfc5.fb
C:\WINDOWS\system32\Cache\ad10a52aff5e038d.fb
C:\WINDOWS\system32\Cache\ad117f6527af6f19.fb
C:\WINDOWS\system32\Cache\b0e1fee05a927328.fb
C:\WINDOWS\system32\Cache\c1fa887b03019701.fb
C:\WINDOWS\system32\Cache\c4d28dca2e7648be.fb
C:\WINDOWS\system32\Cache\c528a63c693e3f08.fb
C:\WINDOWS\system32\Cache\d201ef9910cd39de.fb
C:\WINDOWS\system32\Cache\d2e94710a5708128.fb
C:\WINDOWS\system32\Cache\d79b9dfe81484ec4.fb
C:\WINDOWS\system32\Cache\e0de16f883bea794.fb
C:\WINDOWS\system32\Cache\e6bff179d9aee27e.fb
C:\WINDOWS\system32\Cache\f20c7b2cdec6a609.fb
C:\WINDOWS\system32\Cache\f998975c9cc711ee.fb
C:\WINDOWS\system32\URTTemp
C:\WINDOWS\system32\URTTemp\regtlib.exe
((((((((((((((((((((((((( Files Created from 2013-04-04 to 2013-05-04 )))))))))))))))))))))))))))))))
2013-04-30 23:50:54 . 2013-04-30 23:50:54 โโโ dโโw- C:\WINDOWS\system32\config\systemprofile\Application Data\QuickScan
2013-04-27 16:35:30 . 2013-04-27 16:35:30 241992 โ-a-w- C:\WINDOWS\system32\drivers\avchv.sys
2013-04-27 16:34:46 . 2013-04-27 16:34:46 โโโ dโโw- C:\Documents and Settings\LocalService\Application Data\QuickScan
2013-04-27 16:28:14 . 2012-10-10 20:00:04 622616 โ-a-w- C:\WINDOWS\system32\drivers\avc3.sys
2013-04-27 16:28:14 . 2012-02-17 21:45:12 447208 โ-a-w- C:\WINDOWS\system32\drivers\avckf.sys
2013-04-27 16:25:30 . 2013-04-27 16:25:30 โโโ dโโw- C:\Documents and Settings\Sherry\Application Data\QuickScan
2013-04-27 16:25:07 . 2013-04-27 16:28:26 โโโ dโโw- C:\Program Files\Bitdefender
2013-04-27 16:25:04 . 2012-10-31 18:13:10 343456 โ-a-w- C:\WINDOWS\system32\drivers\trufos.sys
2013-04-27 16:25:01 . 2012-10-04 19:30:05 162976 โ-a-w- C:\WINDOWS\system32\drivers\gzflt.sys
2013-04-24 00:53:10 . 2013-04-24 00:53:10 โโโ dโโw- C:\_OTL
2013-04-16 06:22:37 . 2013-04-16 06:22:37 388096 โ-a-r- C:\Documents and Settings\Sherry\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-04-16 06:22:36 . 2013-04-16 06:22:36 โโโ dโโw- C:\Program Files\Trend Micro
2013-04-09 00:34:08 . 2013-04-09 00:34:08 โโโ dโโw- C:\Program Files\Common Files\Skype
2013-04-06 23:12:10 . 2013-04-06 23:12:10 โโโ dโโw- C:\Program Files\DriverUpdate
2013-04-06 22:41:40 . 2013-04-06 22:41:58 โโโ dโโw- C:\Documents and Settings\All Users\Application Data\Creative
2013-04-06 22:36:45 . 2000-05-11 07:00:00 90112 โโw- C:\WINDOWS\Updreg.EXE
2013-04-06 22:35:58 . 2010-08-03 04:22:37 25600 โ-a-r- C:\WINDOWS\system32\KSRun.dll
2013-04-06 22:35:58 . 2009-11-11 05:42:34 196608 โ-a-r- C:\WINDOWS\system32\KsDvInst.dll
2013-04-06 22:35:57 . 2010-07-24 06:54:26 2016640 โ-a-r- C:\WINDOWS\system32\drivers\ksaudfl.sys
2013-04-06 22:35:56 . 2010-08-05 08:34:34 1210624 โ-a-r- C:\WINDOWS\system32\drivers\ksaud.sys
2013-04-06 22:34:02 . 2010-07-28 03:33:32 271360 โ-a-r- C:\WINDOWS\system32\KSXPPI32.dll
2013-04-06 22:33:33 . 2010-07-24 06:30:18 8520 โ-a-r- C:\WINDOWS\system32\DeviceDefaultsXP.reg
2013-04-06 22:33:33 . 2010-07-24 06:30:18 15724 โ-a-r- C:\WINDOWS\system32\MixerDefaultXP.reg
2013-04-06 22:33:33 . 2009-05-26 07:59:08 26768 โ-a-r- C:\WINDOWS\ksaudENG.reg
2013-04-06 22:33:33 . 2007-07-05 02:27:14 2630 โ-a-r- C:\WINDOWS\MixerName.reg
2013-04-06 22:33:17 . 2003-06-13 05:25:40 7062 โ-a-w- C:\WINDOWS\system32\audiopid.vxd
2013-04-06 22:32:58 . 2000-05-22 08:58:00 647872 โโw- C:\WINDOWS\system32\Mscomct2.ocx
2013-04-06 22:32:57 . 2006-10-06 06:17:34 53248 โโw- C:\WINDOWS\Ctregrun.exe
2013-04-06 22:32:14 . 2013-04-06 22:32:14 445016 โ-a-w- C:\WINDOWS\system32\wrap_oal.dll
2013-04-06 22:32:14 . 2013-04-06 22:32:14 109144 โ-a-w- C:\WINDOWS\system32\OpenAL32.dll
2013-04-06 22:32:02 . 2013-04-06 22:32:02 โโโ dโโw- C:\Program Files\Common Files\Creative Labs Shared
2013-04-06 22:30:03 . 2013-04-06 22:36:45 โโโ dโโw- C:\Program Files\Creative
2013-04-06 22:28:36 . 2003-11-11 00:13:28 69715 โ-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2013-04-06 22:28:36 . 2003-11-11 00:12:42 266240 โ-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2013-04-06 22:28:36 . 2003-11-11 00:12:12 192512 โ-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2013-04-06 22:28:36 . 2003-11-11 00:11:58 5632 โ-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2013-04-06 22:28:35 . 2003-11-11 00:14:46 729088 โ-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2013-04-06 22:28:33 . 2013-04-06 22:28:33 311428 โ-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2013-04-06 22:28:33 . 2013-04-06 22:28:33 188548 โ-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2013-04-06 22:27:09 . 2008-04-13 18:45:12 60032 -cโa-w- C:\WINDOWS\system32\dllcache\usbaudio.sys
2013-04-06 22:27:09 . 2008-04-13 18:45:12 60032 โ-a-w- C:\WINDOWS\system32\drivers\USBAUDIO.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2013-04-27 15:35:23 . 2013-03-28 22:17:50 13024 โ-a-w- C:\WINDOWS\system32\drivers\SWDUMon.sys
2013-04-05 16:01:27 . 2013-04-04 14:39:11 33112 โ-a-w- C:\WINDOWS\system32\drivers\avgtpx86.sys
2013-04-04 20:50:32 . 2010-10-27 11:21:04 22856 โ-a-w- C:\WINDOWS\system32\drivers\mbam.sys
2013-03-28 22:23:37 . 2013-03-28 22:23:37 0 โ-a-w- C:\WINDOWS\system32\TempWmicBatchFile.bat
2013-03-26 13:13:07 . 2013-03-26 13:13:29 94112 โ-a-w- C:\WINDOWS\system32\WindowsAccessBridge.dll
2013-03-26 13:13:02 . 2012-03-24 20:23:39 143872 โ-a-w- C:\WINDOWS\system32\javacpl.cpl
2013-03-26 13:13:01 . 2012-07-15 13:39:56 861088 โ-a-w- C:\WINDOWS\system32\npDeployJava1.dll
2013-03-26 13:13:01 . 2010-11-05 03:22:53 782240 โ-a-w- C:\WINDOWS\system32\deployJava1.dll
2013-03-13 01:07:32 . 2012-04-08 14:12:52 693976 โ-a-w- C:\WINDOWS\system32\FlashPlayerApp.exe
2013-03-13 01:07:32 . 2011-06-13 00:36:04 73432 โ-a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-03-08 08:36:22 . 2006-03-15 12:00:00 293376 โ-a-w- C:\WINDOWS\system32\winsrv.dll
2013-03-07 01:28:24 . 2006-03-15 12:00:00 2193408 โ-a-w- C:\WINDOWS\system32\ntoskrnl.exe
2013-03-07 00:50:28 . 2004-08-03 22:59:00 2070016 โ-a-w- C:\WINDOWS\system32\ntkrnlpa.exe
2013-03-02 02:06:31 . 2006-03-15 12:00:00 916480 โ-a-w- C:\WINDOWS\system32\wininet.dll
2013-03-02 02:06:30 . 2006-03-15 12:00:00 43520 โ-a-w- C:\WINDOWS\system32\licmgr10.dll
2013-03-02 02:06:30 . 2006-03-15 12:00:00 1469440 โโw- C:\WINDOWS\system32\inetcpl.cpl
2013-03-02 01:25:02 . 2006-03-15 12:00:00 1867264 โ-a-w- C:\WINDOWS\system32\win32k.sys
2013-03-02 01:08:47 . 2006-03-15 12:00:00 385024 โ-a-w- C:\WINDOWS\system32\html.iec
2013-02-27 07:56:51 . 2010-10-26 22:23:11 2067456 โ-a-w- C:\WINDOWS\system32\mstscax.dll
2013-02-12 00:32:23 . 2008-04-13 18:56:49 12928 โโw- C:\WINDOWS\system32\drivers\usb8023x.sys
2013-02-12 00:32:23 . 2006-03-15 12:00:00 12928 โ-a-w- C:\WINDOWS\system32\drivers\usb8023.sys
sinnead
As I'd mentioned, right clicking on command prompt brought up "move, size minimize, maximize, close, edits, default, properties" but that's it. I decided to try running it anyway while waiting and it asked for the cd which I put in. It ran right up until the end and told me I had the wrong cd and needed cd2 which I put in, only to be told the same thing- need cd2.
This kept popping up over and over and it refused to continue running. I've checked for a log just in case, but it says "FINDSTR: Cannot open C:\WINDOWS\logs\cbs\cbs.log
Satchfan
Thanks for the Malwarebytes log.
My apologies: I gave you the wrong instructions for your operating system. Let's try again.
There are still some remnants of AVG on your computer so if you didnโt do so before, please download and run AVG Removal Tool from here.
I am also waiting for the SecurityCheck log.
Let me know how things are running now.
Satchfan
My apologies: I gave you the wrong instructions for your operating system. Let's try again.
- click on Start > Run
- type cmd and press Enter
- in the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter
- if there is a problem, the program may ask you for your Windows XP installation CD - please insert it at the prompt. If it doesn't ask you for the CD this means that it wasn't necessary to replace any files.
There are still some remnants of AVG on your computer so if you didnโt do so before, please download and run AVG Removal Tool from here.
I am also waiting for the SecurityCheck log.
Let me know how things are running now.
Satchfan
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI