This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected? [Solved]

91 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Problem. I tried running OTC run fix and the computer froze again and had to do a hard shut down. Tried getting to "safe mode with networking". As it was starting after a reboot I'd move to "safe mode with networking", click enter and the computer would start running some code on the screen, and I'd be taken back to the same screen with the listing including "safe mode with networking". Tried 3 times, but still keep being taken back to that screen. So what's the next step? Will OTC run fix work in simple safe mode, or do I need safe mode with networking?
It's fine in safe mode but before trying the fix again, I'd like you to do this:

Set the ArcSoft Connect Daemon (ACService.exe) service to Manual.
  • 1. Click Start > Run, type services.msc, and then click OK
    2. In the list of services, click ArcSoft Connect Daemon
    3. Change the โ€œStartup Typeโ€ to Manual. To do this:


    a. Right-click ArcSoft Connect Daemon, then click Properties
    b. In the ArcSoft Connect Daemon Properties dialog box, click the โ€œGeneral tabโ€, and then click Manual in the Startup type list
    c. Click Apply, and then click OK

  • reboot the computer.
Now try to run the OTL fix.
Okay, problem. I cannot even get to either safe mode, or safe mode with networking. I just keep getting booted back to the introductory blue screen, then taken to the choice page again(for safe mode, normal, etc). It won't stop doing this until I choose normal. I tried shutting down antivirus, etc. and the computer STILL freezes when I try to do the run fix.
Did you set the ArcSoft Connect Daemon service to Manual before trying the OTL "fix"?

If not, please do so and run the fix in normal mode.

Restore Safe Mode

Let's see if we can restore safe mode and then look again at why this has happened
  • download SafeBoot.zip to your Desktop
  • click on SafeBoot.zip to open the Zip file
  • extract SafeBoot.reg also to your Desktop
  • double-click on the icon
  • you will receive a prompt similar to: "Do you wish to merge the information into the registry?": answer Yes and wait for a message to appear similar to Merged Successfully.
  • reboot your machine
Please let me know what happens.

Satchfan
Okay, I have no idea what's going on here. First, yes- I put Arcsoft to manual. Made no difference. I downloaded safeboot, followed the directions. Wound up with FOUR icons on my desktop. Clicked one and got the message "successfully integrated with register". Tried booting into safe mode again with same results as before.
Just had a thought- could the fact I use chrome as a default browser cause the problems I'm having? One other thing I've been noticing. Over half the time when I come onto the computer it will say "one program running". But when I open my user account, there is nothing.

could the fact I use chrome as a default browser cause the problems I'm having?

No. I don't like Chrome and it causes many problems but your symptoms aren't consistent with Chrome's failings. ;)

Let's try a heavier scan.

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, as they may otherwise interfere with our tools. See here for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

    ๐Ÿ–ผClick to load external image (Posted Image)


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    ๐Ÿ–ผClick to load external image (Posted Image)


    Click on Yes, to continue scanning for malware.
Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Satchfan
Downloaded combofix. Shut down firewall and antivirus according to instructions. Ran combofix. When I left at 9am this morning it had finished and was preparing the log. I got back just now(2pm), and it STILL said preparing log. While I'm not absolutely certain, I don't think preparing a log should take 5 hours. So I closed it down. I checked and no log anywhere. I can see combofix in C:, but no combofix.txt. I even opened combofix just to be sure and not there either.
I'd like you to try a different type of scan so that we can look at this from another angle.

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.pif
DDS.com

  • disable any script blocking protection (How to Disable your Security Programs)
  • double click DDS icon to run the tool (may take up to 3 minutes to run)
  • when done, DDS.txt will open.
  • after a few moments, attach.txt will open in a second window.
  • save both reports to your desktop.
  • Post the contents of the DDS.txt and Attach.txt reports in your next reply
Satchfan
DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.17.2 Run by [removed] at 18:47:52 on 2013-05-04 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1470.866 [GMT -6:00] . AV: Bitdefender Antivirus Free Edition *Disabled/Updated* {9488E0FA-F058-4673-850E-E755F112BABC} FW: *Enabled* FW: AVG Firewall *Disabled* . ============== Running Processes ================ . C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Creative\Shared Files\CTAudSvc.exe C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe C:\WINDOWS\Explorer.EXE c:\program files\google\update\1.3.21.135\googlecrashhandler.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre7\bin\jqs.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe c:\documents and settings\cliff\local settings\application data\google\update\1.3.21.135\googlecrashhandler.exe C:\Program Files\Microsoft Office\Office12\onenotem.EXE C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch C:\WINDOWS\system32\svchost.exe -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Javaโ„ข Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: Javaโ„ข Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDrives = dword:0 mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://www.shockwave.com/content/bejeweled2/sis/popcaploader_v10.cab DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab TCP: NameServer = 64.59.135.135 64.59.128.121 TCP: Interfaces\{22C0B27B-0C75-4F33-8875-CAC5AA0C595B} : DHCPNameServer = [removed] [removed] Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - c:\program files\quicktax 2009\ic2009pp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Notify: AtiExtEvent - Ati2evxx.dll SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ============= SERVICES / DRIVERS =============== . R0 avc3;avc3;c:\windows\system32\drivers\avc3.sys [2013-4-27 622616] R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-4-4 33112] R1 gzflt;gzflt;c:\windows\system32\drivers\gzflt.sys [2013-4-27 162976] R2 gzserv;Bitdefender Antivirus Free Edition;c:\program files\bitdefender\antivirus free edition\gzserv.exe [2013-4-27 27136] R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-9-19 418376] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-10-27 701512] R2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files\common files\avg secure search\vtoolbarupdater\14.2.0\ToolbarUpdater.exe [2013-4-5 968880] R3 avckf;avckf;c:\windows\system32\drivers\avckf.sys [2013-4-27 447208] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-10-27 22856] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-10-26 1691480] S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2013-4-6 79360] S3 ksaud;Creative USB Audio Driver;c:\windows\system32\drivers\ksaud.sys [2013-4-6 1210624] S3 ksaudfl;ksaudfl;c:\windows\system32\drivers\ksaudfl.sys [2013-4-6 2016640] S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2011-6-13 267568] S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2013-3-28 13024] . =============== Created Last 30 ================ . 2013-05-04 15:39:18 โ€”โ€”โ€“ d-sha-r- C:\cmdcons 2013-05-04 15:34:38 98816 โ€”-a-w- c:\windows\sed.exe 2013-05-04 15:34:38 256000 โ€”-a-w- c:\windows\PEV.exe 2013-05-04 15:34:38 208896 โ€”-a-w- c:\windows\MBR.exe 2013-05-04 15:34:24 โ€”โ€”โ€“ dโ€”โ€“w- C:\ComboFix 2013-04-27 16:35:30 241992 โ€”-a-w- c:\windows\system32\drivers\avchv.sys 2013-04-27 16:28:14 622616 โ€”-a-w- c:\windows\system32\drivers\avc3.sys 2013-04-27 16:28:14 447208 โ€”-a-w- c:\windows\system32\drivers\avckf.sys 2013-04-27 16:25:30 โ€”โ€”โ€“ dโ€”โ€“w- c:\documents and settings\sherry\application data\QuickScan 2013-04-27 16:25:07 โ€”โ€”โ€“ dโ€”โ€“w- c:\program files\Bitdefender 2013-04-27 16:25:04 343456 โ€”-a-w- c:\windows\system32\drivers\trufos.sys 2013-04-27 16:25:01 162976 โ€”-a-w- c:\windows\system32\drivers\gzflt.sys 2013-04-24 00:53:10 โ€”โ€”โ€“ dโ€”โ€“w- C:\_OTL 2013-04-16 06:22:37 388096 โ€”-a-r- c:\documents and settings\sherry\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2013-04-16 06:22:36 โ€”โ€”โ€“ dโ€”โ€“w- c:\program files\Trend Micro 2013-04-06 23:12:10 โ€”โ€”โ€“ dโ€”โ€“w- c:\program files\DriverUpdate 2013-04-06 22:36:45 90112 โ€”โ€”w- c:\windows\Updreg.EXE 2013-04-06 22:35:58 25600 โ€”-a-r- c:\windows\system32\KSRun.dll 2013-04-06 22:35:58 196608 โ€”-a-r- c:\windows\system32\KsDvInst.dll 2013-04-06 22:35:57 2016640 โ€”-a-r- c:\windows\system32\drivers\ksaudfl.sys 2013-04-06 22:35:56 1210624 โ€”-a-r- c:\windows\system32\drivers\ksaud.sys 2013-04-06 22:34:02 271360 โ€”-a-r- c:\windows\system32\KSXPPI32.dll 2013-04-06 22:33:33 8520 โ€”-a-r- c:\windows\system32\DeviceDefaultsXP.reg 2013-04-06 22:33:33 26768 โ€”-a-r- c:\windows\ksaudENG.reg 2013-04-06 22:33:33 2630 โ€”-a-r- c:\windows\MixerName.reg 2013-04-06 22:33:33 15724 โ€”-a-r- c:\windows\system32\MixerDefaultXP.reg 2013-04-06 22:33:17 7062 โ€”-a-w- c:\windows\system32\audiopid.vxd 2013-04-06 22:32:58 647872 โ€”โ€”w- c:\windows\system32\Mscomct2.ocx 2013-04-06 22:32:57 53248 โ€”โ€”w- c:\windows\Ctregrun.exe 2013-04-06 22:32:14 445016 โ€”-a-w- c:\windows\system32\wrap_oal.dll 2013-04-06 22:32:14 109144 โ€”-a-w- c:\windows\system32\OpenAL32.dll 2013-04-06 22:32:02 โ€”โ€”โ€“ dโ€”โ€“w- c:\program files\common files\Creative Labs Shared 2013-04-06 22:30:03 โ€”โ€”โ€“ dโ€”โ€“w- c:\program files\Creative 2013-04-06 22:28:36 69715 โ€”-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll 2013-04-06 22:28:36 5632 โ€”-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe 2013-04-06 22:28:36 266240 โ€”-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll 2013-04-06 22:28:36 192512 โ€”-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll 2013-04-06 22:28:35 729088 โ€”-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll 2013-04-06 22:28:33 311428 โ€”-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll 2013-04-06 22:28:33 188548 โ€”-a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll 2013-04-06 22:27:09 60032 -cโ€“a-w- c:\windows\system32\dllcache\usbaudio.sys 2013-04-06 22:27:09 60032 โ€”-a-w- c:\windows\system32\drivers\USBAUDIO.sys . ==================== Find3M ==================== . 2013-04-27 15:35:23 13024 โ€”-a-w- c:\windows\system32\drivers\SWDUMon.sys 2013-04-05 16:01:27 33112 โ€”-a-w- c:\windows\system32\drivers\avgtpx86.sys 2013-04-04 20:50:32 22856 โ€”-a-w- c:\windows\system32\drivers\mbam.sys 2013-03-28 22:23:37 0 โ€”-a-w- c:\windows\system32\TempWmicBatchFile.bat 2013-03-26 13:13:07 94112 โ€”-a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-03-26 13:13:02 143872 โ€”-a-w- c:\windows\system32\javacpl.cpl 2013-03-26 13:13:01 861088 โ€”-a-w- c:\windows\system32\npDeployJava1.dll 2013-03-26 13:13:01 782240 โ€”-a-w- c:\windows\system32\deployJava1.dll 2013-03-13 01:07:32 73432 โ€”-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-13 01:07:32 693976 โ€”-a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-08 08:36:22 293376 โ€”-a-w- c:\windows\system32\winsrv.dll 2013-03-07 01:28:24 2193408 โ€”-a-w- c:\windows\system32\ntoskrnl.exe 2013-03-07 00:50:28 2070016 โ€”-a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-02 02:06:31 916480 โ€”-a-w- c:\windows\system32\wininet.dll 2013-03-02 02:06:30 43520 โ€”-a-w- c:\windows\system32\licmgr10.dll 2013-03-02 02:06:30 1469440 โ€”โ€”w- c:\windows\system32\inetcpl.cpl 2013-03-02 01:25:02 1867264 โ€”-a-w- c:\windows\system32\win32k.sys 2013-03-02 01:08:47 385024 โ€”-a-w- c:\windows\system32\html.iec 2013-02-27 07:56:51 2067456 โ€”-a-w- c:\windows\system32\mstscax.dll 2013-02-12 00:32:23 12928 โ€”-a-w- c:\windows\system32\drivers\usb8023.sys 2013-02-12 00:32:23 12928 โ€”โ€”w- c:\windows\system32\drivers\usb8023x.sys . ============= FINISH: 18:48:55.60 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 26/10/2010 7:28:25 PM System Uptime: 04/05/2013 1:54:41 PM (5 hours ago) . Motherboard: Intel Corporation | | D101GGC Processor: Intelยฎ Celeronยฎ CPU 3.06GHz | Socket 775 | 3066/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 233 GiB total, 146.995 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: SM Bus Controller Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_D6008086&REV_82\3&61AAA01&0&A0 Manufacturer: Name: SM Bus Controller PNP Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_D6008086&REV_82\3&61AAA01&0&A0 Service: . ==== System Restore Points =================== . RP847: 21/04/2013 4:23:36 AM - Installed HiJackThis RP848: 22/04/2013 6:27:35 AM - System Checkpoint RP849: 22/04/2013 8:00:19 PM - OTL Restore Point - 22/04/2013 8:00:14 PM RP850: 23/04/2013 8:05:21 PM - System Checkpoint RP851: 24/04/2013 10:00:50 PM - System Checkpoint RP852: 25/04/2013 10:33:49 PM - System Checkpoint RP853: 27/04/2013 12:53:33 AM - System Checkpoint RP854: 27/04/2013 8:17:53 AM - Removed AVG 2013 RP855: 27/04/2013 8:19:56 AM - Removed AVG 2013 RP856: 29/04/2013 12:02:52 AM - System Checkpoint RP857: 30/04/2013 12:56:15 AM - System Checkpoint RP858: 01/05/2013 1:13:40 AM - System Checkpoint RP859: 02/05/2013 1:27:39 AM - System Checkpoint RP860: 03/05/2013 9:39:24 AM - System Checkpoint RP861: 04/05/2013 3:32:51 PM - System Checkpoint . ==== Installed Programs ====================== . 2007 Microsoft Office Suite Service Pack 3 (SP3) 32 Bit HP CIO Components Installer Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader X (10.1.6) Adobe Shockwave Player 11.5 AIO_Scan Alchemy Apple Application Support Apple Mobile Device Support Apple Software Update ArcSoft Video Downloader ATI Display Driver Bitdefender Antivirus Free Edition Bonjour Bubble Town BufferChm Chuzzle Deluxe Copy Coupon Printer for Windows Creative System Information CustomerResearchQFolder Destination Component DeviceDiscovery DeviceManagementQFolder DJ_AIO_03_F4200_Software_Min DJ_AIO_Software DJ_AIO_Software_min DriverUpdate Dropbox eSupportQFolder GIMP 2.6.11 Google Apps Google Chrome Google Earth Google Update Helper Google Updater Hardwood Euchre HiJackThis Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB2756822) Hotfix for Windows XP (KB2779562) HP Customer Participation Program 9.0 HP Deskjet All-In-One Software 9.0 HP Deskjet F4200 All-In-One Driver 11.0 03 HP Imaging Device Functions 9.0 HP Photo Creations HP Photosmart Essential 2.01 HP Photosmart Essential2.01 HP Product Assistant HP Product Detection HP Solution Center 9.0 HP Update HPDiagnosticAlert HPProductAssistant HPSSupply iMesh ImgBurn IrfanView (remove only) iTunes Java 7 Update 17 Java Auto Updater Javaโ„ข 6 Update 31 JavaFX 2.1.1 MahJong Suite 2012 v9.0 Malwarebytes Anti-Malware version 1.75.0.1300 MarketResearch Microsoft .NET Framework 1.0 Hotfix (KB2572066) Microsoft .NET Framework 1.0 Hotfix (KB2604042) Microsoft .NET Framework 1.0 Hotfix (KB2656378) Microsoft .NET Framework 1.0 Security Update (KB2698035) Microsoft .NET Framework 1.0 Security Update (KB2742607) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2698023) Microsoft .NET Framework 1.1 Security Update (KB2742597) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Fix it Center Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Web Publishing Wizard 1.52 MobileMe Control Panel MSN MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nikon Message Center Nikon Transfer PopCap Browser Plugin Pretty Good Solitaire version 12.4.0 PSSWCORE QuickTax 2009 QuickTime Realtek High Definition Audio Driver RoE Power Tools Scan Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Security Update for Microsoft Windows (KB2564958) Security Update for Windows Internet Explorer 8 (KB2360131) Security Update for Windows Internet Explorer 8 (KB2416400) Security Update for Windows Internet Explorer 8 (KB2482017) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2530548) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2559049) Security Update for Windows Internet Explorer 8 (KB2586448) Security Update for Windows Internet Explorer 8 (KB2618444) Security Update for Windows Internet Explorer 8 (KB2647516) Security Update for Windows Internet Explorer 8 (KB2675157) Security Update for Windows Internet Explorer 8 (KB2699988) Security Update for Windows Internet Explorer 8 (KB2722913) Security Update for Windows Internet Explorer 8 (KB2744842) Security Update for Windows Internet Explorer 8 (KB2761465) Security Update for Windows Internet Explorer 8 (KB2792100) Security Update for Windows Internet Explorer 8 (KB2797052) Security Update for Windows Internet Explorer 8 (KB2799329) Security Update for Windows Internet Explorer 8 (KB2809289) Security Update for Windows Internet Explorer 8 (KB2817183) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2621440) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2633171) Security Update for Windows XP (KB2639417) Security Update for Windows XP (KB2641653) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2647518) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2655992) Security Update for Windows XP (KB2659262) Security Update for Windows XP (KB2660465) Security Update for Windows XP (KB2661637) Security Update for Windows XP (KB2676562) Security Update for Windows XP (KB2685939) Security Update for Windows XP (KB2686509) Security Update for Windows XP (KB2691442) Security Update for Windows XP (KB2695962) Security Update for Windows XP (KB2698365) Security Update for Windows XP (KB2705219) Security Update for Windows XP (KB2707511) Security Update for Windows XP (KB2709162) Security Update for Windows XP (KB2712808) Security Update for Windows XP (KB2718523) Security Update for Windows XP (KB2719985) Security Update for Windows XP (KB2723135) Security Update for Windows XP (KB2724197) Security Update for Windows XP (KB2727528) Security Update for Windows XP (KB2731847) Security Update for Windows XP (KB2753842-v2) Security Update for Windows XP (KB2753842) Security Update for Windows XP (KB2757638) Security Update for Windows XP (KB2758857) Security Update for Windows XP (KB2761226) Security Update for Windows XP (KB2770660) Security Update for Windows XP (KB2778344) Security Update for Windows XP (KB2779030) Security Update for Windows XP (KB2780091) Security Update for Windows XP (KB2799494) Security Update for Windows XP (KB2802968) Security Update for Windows XP (KB2807986) Security Update for Windows XP (KB2808735) Security Update for Windows XP (KB2813170) Security Update for Windows XP (KB2813345) Security Update for Windows XP (KB2820917) Security Update for Windows XP (KB923789) Skypeโ„ข 6.3 SolutionCenter Sound Blaster X-Fi Go! Pro Status Styler The Print Shop 22 Toolbox TrayApp UnloadSupport Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit Edition Update for Windows Internet Explorer 8 (KB976662) Update for Windows XP (KB2607712) Update for Windows XP (KB2616676) Update for Windows XP (KB2641690) Update for Windows XP (KB2661254-v2) Update for Windows XP (KB2718704) Update for Windows XP (KB2736233) Update for Windows XP (KB2749655) VideoToolkit01 WebFldrs XP WebReg Windows PowerShellโ„ข 1.0 Windows XP Service Pack 3 . ==== Event Viewer Messages From Past Week ======== . 27/04/2013 9:31:54 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 27/04/2013 9:13:27 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm 27/04/2013 8:41:07 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s). 27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s). 27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The MBAMScheduler service terminated unexpectedly. It has done this 1 time(s). 27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The Creative Audio Service service terminated unexpectedly. It has done this 1 time(s). 27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s). 27/04/2013 8:41:01 AM, error: Service Control Manager [7034] - The ArcSoft Connect Daemon service terminated unexpectedly. It has done this 1 time(s). 27/04/2013 8:41:01 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 27/04/2013 8:41:00 AM, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s). 27/04/2013 8:38:12 AM, error: System Error [1003] - Error code 100000cf, parameter1 bf031198, parameter2 00000008, parameter3 bf031198, parameter4 00000000. 27/04/2013 10:28:31 AM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied. . ==== End Of File ===========================
There are no signs of malware in that log.

Can you check and see if ComboFix created a log when you ran it.

It would be found at c:\combofix.txt

===================================================

Iโ€™d like you to check your system files:
  • click on Start, type command prompt
  • right click on Command Prompt at the top of the window and select Run as Administrator
  • in the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter.
Windows XP does not tell you if there were any problems. To find the SFC results, do the following:
  • open a Command Prompt (it doesnโ€™t have to be as Administrator)
  • type (or copy and paste) findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt and press Enter
  • type (or copy and paste) notepad sfcdetails.txt and press Enter.
Let's see what it finds.

===================================================

Please run Malwarebytes and SecurityCheck as instructed in this previous post.

In the next post, please supply the ComboFix log, if found, the result of sfc scannow, Mbam.txt and Checkup.txt.

Thanks

Satchfan
Computer dummy here. I clicked start, but have no idea WHERE to type command prompt. Opened run and typed command prompt and opened it, but it was asking for the original cd to be inserted? Tried right clicking at the top of the window, but it did nothing. Typed sfc /scannow anyway, and that's when it asked for the cd.
In the interim, here are both mbam, and combofix(had to use search function, but found it!) Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.05.05.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Sherry :: DA658A6C7 [administrator] 05/05/2013 12:24:44 PM mbam-log-2013-05-05 (12-24-44).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 384951 Time elapsed: 1 hour(s), 48 minute(s), 42 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ComboFix 13-05-04.01 - Sherry 04/05/2013 9:43:11.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1470.885 [GMT -6:00] Running from: C:\Documents and Settings\[removed]\My Documents\Downloads\combofix.exe AV: Bitdefender Antivirus Free Edition *Disabled/Updated* {9488E0FA-F058-4673-850E-E755F112BABC} FW: *Enabled* {9488E0FA-F058-4673-850E-E755F112BABC} FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66} ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\All Users\Application Data\1367079887.bdinstall.bin C:\Documents and Settings\All Users\Application Data\TEMP C:\WINDOWS\system32\Cache C:\WINDOWS\system32\Cache\1eeece3971bfd15f.fb C:\WINDOWS\system32\Cache\26b2515a62af3429.fb C:\WINDOWS\system32\Cache\26c630d098e22dd5.fb C:\WINDOWS\system32\Cache\272512937d9e61a4.fb C:\WINDOWS\system32\Cache\287204568329e189.fb C:\WINDOWS\system32\Cache\28bc8f716fd76a47.fb C:\WINDOWS\system32\Cache\2c53092c95605355.fb C:\WINDOWS\system32\Cache\311c38d3977da3b5.fb C:\WINDOWS\system32\Cache\31a0997e9a5b5eb3.fb C:\WINDOWS\system32\Cache\32c84fe32bb74d60.fb C:\WINDOWS\system32\Cache\3917078cb68ec657.fb C:\WINDOWS\system32\Cache\41d7108c3d15c194.fb C:\WINDOWS\system32\Cache\590ba23ce359fd0c.fb C:\WINDOWS\system32\Cache\610289e025a3ee9a.fb C:\WINDOWS\system32\Cache\651c5d3cdbfb8bd1.fb C:\WINDOWS\system32\Cache\6c59ac5e7e7a3ad0.fb C:\WINDOWS\system32\Cache\6d03dad1035885d3.fb C:\WINDOWS\system32\Cache\95f567698be8a182.fb C:\WINDOWS\system32\Cache\a8556537add6dfc5.fb C:\WINDOWS\system32\Cache\ad10a52aff5e038d.fb C:\WINDOWS\system32\Cache\ad117f6527af6f19.fb C:\WINDOWS\system32\Cache\b0e1fee05a927328.fb C:\WINDOWS\system32\Cache\c1fa887b03019701.fb C:\WINDOWS\system32\Cache\c4d28dca2e7648be.fb C:\WINDOWS\system32\Cache\c528a63c693e3f08.fb C:\WINDOWS\system32\Cache\d201ef9910cd39de.fb C:\WINDOWS\system32\Cache\d2e94710a5708128.fb C:\WINDOWS\system32\Cache\d79b9dfe81484ec4.fb C:\WINDOWS\system32\Cache\e0de16f883bea794.fb C:\WINDOWS\system32\Cache\e6bff179d9aee27e.fb C:\WINDOWS\system32\Cache\f20c7b2cdec6a609.fb C:\WINDOWS\system32\Cache\f998975c9cc711ee.fb C:\WINDOWS\system32\URTTemp C:\WINDOWS\system32\URTTemp\regtlib.exe ((((((((((((((((((((((((( Files Created from 2013-04-04 to 2013-05-04 ))))))))))))))))))))))))))))))) 2013-04-30 23:50:54 . 2013-04-30 23:50:54 โ€”โ€”โ€“ dโ€”โ€“w- C:\WINDOWS\system32\config\systemprofile\Application Data\QuickScan 2013-04-27 16:35:30 . 2013-04-27 16:35:30 241992 โ€”-a-w- C:\WINDOWS\system32\drivers\avchv.sys 2013-04-27 16:34:46 . 2013-04-27 16:34:46 โ€”โ€”โ€“ dโ€”โ€“w- C:\Documents and Settings\LocalService\Application Data\QuickScan 2013-04-27 16:28:14 . 2012-10-10 20:00:04 622616 โ€”-a-w- C:\WINDOWS\system32\drivers\avc3.sys 2013-04-27 16:28:14 . 2012-02-17 21:45:12 447208 โ€”-a-w- C:\WINDOWS\system32\drivers\avckf.sys 2013-04-27 16:25:30 . 2013-04-27 16:25:30 โ€”โ€”โ€“ dโ€”โ€“w- C:\Documents and Settings\Sherry\Application Data\QuickScan 2013-04-27 16:25:07 . 2013-04-27 16:28:26 โ€”โ€”โ€“ dโ€”โ€“w- C:\Program Files\Bitdefender 2013-04-27 16:25:04 . 2012-10-31 18:13:10 343456 โ€”-a-w- C:\WINDOWS\system32\drivers\trufos.sys 2013-04-27 16:25:01 . 2012-10-04 19:30:05 162976 โ€”-a-w- C:\WINDOWS\system32\drivers\gzflt.sys 2013-04-24 00:53:10 . 2013-04-24 00:53:10 โ€”โ€”โ€“ dโ€”โ€“w- C:\_OTL 2013-04-16 06:22:37 . 2013-04-16 06:22:37 388096 โ€”-a-r- C:\Documents and Settings\Sherry\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2013-04-16 06:22:36 . 2013-04-16 06:22:36 โ€”โ€”โ€“ dโ€”โ€“w- C:\Program Files\Trend Micro 2013-04-09 00:34:08 . 2013-04-09 00:34:08 โ€”โ€”โ€“ dโ€”โ€“w- C:\Program Files\Common Files\Skype 2013-04-06 23:12:10 . 2013-04-06 23:12:10 โ€”โ€”โ€“ dโ€”โ€“w- C:\Program Files\DriverUpdate 2013-04-06 22:41:40 . 2013-04-06 22:41:58 โ€”โ€”โ€“ dโ€”โ€“w- C:\Documents and Settings\All Users\Application Data\Creative 2013-04-06 22:36:45 . 2000-05-11 07:00:00 90112 โ€”โ€”w- C:\WINDOWS\Updreg.EXE 2013-04-06 22:35:58 . 2010-08-03 04:22:37 25600 โ€”-a-r- C:\WINDOWS\system32\KSRun.dll 2013-04-06 22:35:58 . 2009-11-11 05:42:34 196608 โ€”-a-r- C:\WINDOWS\system32\KsDvInst.dll 2013-04-06 22:35:57 . 2010-07-24 06:54:26 2016640 โ€”-a-r- C:\WINDOWS\system32\drivers\ksaudfl.sys 2013-04-06 22:35:56 . 2010-08-05 08:34:34 1210624 โ€”-a-r- C:\WINDOWS\system32\drivers\ksaud.sys 2013-04-06 22:34:02 . 2010-07-28 03:33:32 271360 โ€”-a-r- C:\WINDOWS\system32\KSXPPI32.dll 2013-04-06 22:33:33 . 2010-07-24 06:30:18 8520 โ€”-a-r- C:\WINDOWS\system32\DeviceDefaultsXP.reg 2013-04-06 22:33:33 . 2010-07-24 06:30:18 15724 โ€”-a-r- C:\WINDOWS\system32\MixerDefaultXP.reg 2013-04-06 22:33:33 . 2009-05-26 07:59:08 26768 โ€”-a-r- C:\WINDOWS\ksaudENG.reg 2013-04-06 22:33:33 . 2007-07-05 02:27:14 2630 โ€”-a-r- C:\WINDOWS\MixerName.reg 2013-04-06 22:33:17 . 2003-06-13 05:25:40 7062 โ€”-a-w- C:\WINDOWS\system32\audiopid.vxd 2013-04-06 22:32:58 . 2000-05-22 08:58:00 647872 โ€”โ€”w- C:\WINDOWS\system32\Mscomct2.ocx 2013-04-06 22:32:57 . 2006-10-06 06:17:34 53248 โ€”โ€”w- C:\WINDOWS\Ctregrun.exe 2013-04-06 22:32:14 . 2013-04-06 22:32:14 445016 โ€”-a-w- C:\WINDOWS\system32\wrap_oal.dll 2013-04-06 22:32:14 . 2013-04-06 22:32:14 109144 โ€”-a-w- C:\WINDOWS\system32\OpenAL32.dll 2013-04-06 22:32:02 . 2013-04-06 22:32:02 โ€”โ€”โ€“ dโ€”โ€“w- C:\Program Files\Common Files\Creative Labs Shared 2013-04-06 22:30:03 . 2013-04-06 22:36:45 โ€”โ€”โ€“ dโ€”โ€“w- C:\Program Files\Creative 2013-04-06 22:28:36 . 2003-11-11 00:13:28 69715 โ€”-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll 2013-04-06 22:28:36 . 2003-11-11 00:12:42 266240 โ€”-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll 2013-04-06 22:28:36 . 2003-11-11 00:12:12 192512 โ€”-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll 2013-04-06 22:28:36 . 2003-11-11 00:11:58 5632 โ€”-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe 2013-04-06 22:28:35 . 2003-11-11 00:14:46 729088 โ€”-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll 2013-04-06 22:28:33 . 2013-04-06 22:28:33 311428 โ€”-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll 2013-04-06 22:28:33 . 2013-04-06 22:28:33 188548 โ€”-a-w- C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll 2013-04-06 22:27:09 . 2008-04-13 18:45:12 60032 -cโ€“a-w- C:\WINDOWS\system32\dllcache\usbaudio.sys 2013-04-06 22:27:09 . 2008-04-13 18:45:12 60032 โ€”-a-w- C:\WINDOWS\system32\drivers\USBAUDIO.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2013-04-27 15:35:23 . 2013-03-28 22:17:50 13024 โ€”-a-w- C:\WINDOWS\system32\drivers\SWDUMon.sys 2013-04-05 16:01:27 . 2013-04-04 14:39:11 33112 โ€”-a-w- C:\WINDOWS\system32\drivers\avgtpx86.sys 2013-04-04 20:50:32 . 2010-10-27 11:21:04 22856 โ€”-a-w- C:\WINDOWS\system32\drivers\mbam.sys 2013-03-28 22:23:37 . 2013-03-28 22:23:37 0 โ€”-a-w- C:\WINDOWS\system32\TempWmicBatchFile.bat 2013-03-26 13:13:07 . 2013-03-26 13:13:29 94112 โ€”-a-w- C:\WINDOWS\system32\WindowsAccessBridge.dll 2013-03-26 13:13:02 . 2012-03-24 20:23:39 143872 โ€”-a-w- C:\WINDOWS\system32\javacpl.cpl 2013-03-26 13:13:01 . 2012-07-15 13:39:56 861088 โ€”-a-w- C:\WINDOWS\system32\npDeployJava1.dll 2013-03-26 13:13:01 . 2010-11-05 03:22:53 782240 โ€”-a-w- C:\WINDOWS\system32\deployJava1.dll 2013-03-13 01:07:32 . 2012-04-08 14:12:52 693976 โ€”-a-w- C:\WINDOWS\system32\FlashPlayerApp.exe 2013-03-13 01:07:32 . 2011-06-13 00:36:04 73432 โ€”-a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2013-03-08 08:36:22 . 2006-03-15 12:00:00 293376 โ€”-a-w- C:\WINDOWS\system32\winsrv.dll 2013-03-07 01:28:24 . 2006-03-15 12:00:00 2193408 โ€”-a-w- C:\WINDOWS\system32\ntoskrnl.exe 2013-03-07 00:50:28 . 2004-08-03 22:59:00 2070016 โ€”-a-w- C:\WINDOWS\system32\ntkrnlpa.exe 2013-03-02 02:06:31 . 2006-03-15 12:00:00 916480 โ€”-a-w- C:\WINDOWS\system32\wininet.dll 2013-03-02 02:06:30 . 2006-03-15 12:00:00 43520 โ€”-a-w- C:\WINDOWS\system32\licmgr10.dll 2013-03-02 02:06:30 . 2006-03-15 12:00:00 1469440 โ€”โ€”w- C:\WINDOWS\system32\inetcpl.cpl 2013-03-02 01:25:02 . 2006-03-15 12:00:00 1867264 โ€”-a-w- C:\WINDOWS\system32\win32k.sys 2013-03-02 01:08:47 . 2006-03-15 12:00:00 385024 โ€”-a-w- C:\WINDOWS\system32\html.iec 2013-02-27 07:56:51 . 2010-10-26 22:23:11 2067456 โ€”-a-w- C:\WINDOWS\system32\mstscax.dll 2013-02-12 00:32:23 . 2008-04-13 18:56:49 12928 โ€”โ€”w- C:\WINDOWS\system32\drivers\usb8023x.sys 2013-02-12 00:32:23 . 2006-03-15 12:00:00 12928 โ€”-a-w- C:\WINDOWS\system32\drivers\usb8023.sys
As I'd mentioned, right clicking on command prompt brought up "move, size minimize, maximize, close, edits, default, properties" but that's it. I decided to try running it anyway while waiting and it asked for the cd which I put in. It ran right up until the end and told me I had the wrong cd and needed cd2 which I put in, only to be told the same thing- need cd2. This kept popping up over and over and it refused to continue running. I've checked for a log just in case, but it says "FINDSTR: Cannot open C:\WINDOWS\logs\cbs\cbs.log
Thanks for the Malwarebytes log.

My apologies: I gave you the wrong instructions for your operating system. Let's try again.
  • click on Start > Run
  • type cmd and press Enter
  • in the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter
  • if there is a problem, the program may ask you for your Windows XP installation CD - please insert it at the prompt. If it doesn't ask you for the CD this means that it wasn't necessary to replace any files.
===========================================

There are still some remnants of AVG on your computer so if you didnโ€™t do so before, please download and run AVG Removal Tool from here.


I am also waiting for the SecurityCheck log. B)

Let me know how things are running now.

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI