What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser hijacked by conduit [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #32
Yes, I'm here. I was waiting for you. lol. I had an odd thing happen today. I shut down the computer and Comodo kept zapping something that has been trying to get into the computer, even though Comodo says it's a safe file but the ip address says it's of unknown origin so I keep blocking it. I went ahead and shut down after telling it to deny and when I got back home and booted up the computer, I got a message that Windows had not been shut down properly and it recommended the Windows Recovery tool. I didn't use it because this computer had just been wiped 1 month ago and this did not make any sense to me. Any ideas? In the mean time, I need to know how to get all these programs I downloaded to my desktop, off of the desktop.
Post #33
Was something trying to get in or was there something trying to get out? Comodo will work both ways and sometimes there are programs that do updates on their own and will be stopped until they are added to an exclusions list. Do you remember what the program was? We will remove our tools after we have completed. :) Are you having anymore malware related problems like before?
Post #35
Yes, sorry. Something was trying to get in. I tried to copy the name to wordpad but Comodo locks down everything until I either ok or say no so I can't copy what it is unless I write the thing out on paper. UGH!!! Comodo says it's a safe program but like I said, the ip address comes back as unknown origin which spooks me. Windows wouldn't start, again, last night, and went into the recovery program and I went ahead and let it run this time. This is getting annoying and worrisome. I am afraid I'll have to get a new computer soon and I can't afford that.
Post #36
Hi, No problem….I was just checking to see if you needed help still. How long have you had your operating system installed on your system? I see that it is a Windows Vista system.
Post #37
I bought the computer from Walmart in the spring of 2009. I have a feeling it was a demo model at one time even though it was sold as new. I had some really bad virus problems last month or the beginning of this month and due to the recurring problem, the tech on here suggested I wipe the hard drive which was what I wanted to do so we did it. I had that same error, again, last night. So that's 3 times in 3 days, I believe.
Post #38
Seems to me that there are some problems with Windows itself rather than particularly anything malware related. It may be that a reinstall might be the best option, especially with the error messages.
Post #39
OK, well, let me see if it happens anymore. Like I said, we just did a reinstall of the whole C drive less than a month ago. This does not make a whole lot of sense to me to have to do it again so soon. Also, Avira will not turn itself on, no matter how many places I check to enable it for virus and web protection. Before it just said web protection was stopped. Now it says real time is also stopped, yet it still updates on a daily basis and i can run the antivirus checker. :scratch:
Post #41
I had a heck of a lot of trouble with Comodo, allowing me to run dds etc, so let's hope this came out ok. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16502 BrowserJavaVersion: 10.25.2 Run by [removed] at 15:18:34 on 2013-09-01 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4024.2882 [GMT -5:00] . AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: COMODO Antivirus *Disabled/Outdated* {0C2D2636-923D-EE52-2A83-E643204A8275} FW: COMODO Firewall *Enabled* {8F7746F7-FE68-E084-3B6C-7404A51E8FB3} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe C:\Program Files\Acer\Empowering Technology\Service\ETService.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Acer\Mobility Center\MobilityService.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio64.exe C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskeng.exe C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSLoader.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\RAVCpl64.exe C:\Windows\PLFSetI.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\COMODO\COMODO Internet Security\cistray.exe C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Launch Manager\QtZgAcer.EXE C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Common Files\AOL\1373719338\ee\aolsoftware.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe C:\Windows\system32\igfxext.exe C:\Users\arwen\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSMSNLoader32.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\COMODO\COMODO Internet Security\cis.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe C:\Windows\System32\notepad.exe C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" mRun: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" mRun: [BkupTray] "C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" mRun: [LManager] C:\PROGRA~2\LAUNCH~1\QtZgAcer.EXE mRun: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" mRun: [CLMLServer] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" mRun: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun: [HostManager] "C:\Program Files (x86)\Common Files\AOL\1373719338\ee\AOLSoftware.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [LTCM Client] C:\Program Files (x86)\LTCM Client\ltcmClient.exe /startup mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\STARTG~1.LNK - C:\Program Files (x86)\Comodo\GeekBuddy\launcher.exe uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} LSP: C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab TCP: NameServer = 97.64.183.164 97.64.209.37 TCP: Interfaces\{4419B82C-77FD-4AF8-90A5-2A7250CAA01B} : NameServer = 156.154.70.22,156.154.71.22 TCP: Interfaces\{E93E5B99-0B10-4A51-92DE-58B98276B5AE} : NameServer = 156.154.70.22,156.154.71.22 TCP: Interfaces\{E93E5B99-0B10-4A51-92DE-58B98276B5AE} : DHCPNameServer = [removed] [removed] LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome x64-mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 x64-BHO: ShowBarObj Class: {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\ActiveToolBand.dll x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDStoolbar.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-Run: [IAAnotif] "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" x64-Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe x64-Run: [eDataSecurity Loader] "C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe x64-Run: [RtHDVCpl] RAVCpl64.exe x64-Run: [Skytel] Skytel.exe x64-Run: [PLFSetI] C:\Windows\PLFSetI.exe x64-Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe x64-Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe x64-mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 x64-mPolicies-Explorer: NoDrives = dword:0 x64-mPolicies-System: EnableUIADesktopToggle = dword:0 x64-Notify: igfxcui - igfxdev.dll . ============= SERVICES / DRIVERS =============== . R1 avkmgr;avkmgr;C:\Windows\System32\drivers\avkmgr.sys [2013-7-13 28600] R1 cmderd;COMODO Internet Security Eradication Driver;C:\Windows\System32\drivers\cmderd.sys [2013-6-18 23168] R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\Windows\System32\drivers\cmdguard.sys [2013-6-18 709144] R1 cmdHlp;COMODO Internet Security Helper Driver;C:\Windows\System32\drivers\cmdhlp.sys [2013-6-18 47336] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [2013-7-13 32240] R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2013-7-13 84024] R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2013-7-13 100712] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-3-3 16384] R2 CLHNService;CLHNService;C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2013-7-13 81504] R2 DragonUpdater;COMODO Dragon Update Service;C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2013-5-29 2094216] R2 ETService;Empowering Technology Service;C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [2008-12-18 24576] R2 FontCache;Windows Font Cache Service;C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-8-22 418376] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-8-22 701512] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-4-26 45056] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-4-26 131072] R3 CAXHWAZL;CAXHWAZL;C:\Windows\System32\drivers\CAXHWAZL.sys [2008-12-18 294400] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;C:\Windows\System32\drivers\IntcHdmi.sys [2008-12-18 129536] R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-8-22 25928] R3 NETw5v64;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit ;C:\Windows\System32\drivers\NETw5v64.sys [2008-12-18 4730368] R3 winbondcir;Winbond IR Transceiver;C:\Windows\System32\drivers\winbondcir.sys [2007-3-28 46592] S2 AntiVirService;Avira Real-Time Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2013-7-13 108088] S2 AntiVirWebService;Avira Web Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe [2013-7-13 589368] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 cmdvirth;COMODO Virtual Service Manager;C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2013-8-25 158936] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-4-19 1022632] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2013-7-14 89920] . =============== File Associations =============== . FileExt: .jse: JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* . =============== Created Last 30 ================ . . ==================== Find3M ==================== . 2013-08-25 03:49:31 56072 —-a-w- C:\Windows\System32\certsentry.dll 2013-08-25 03:49:31 47368 —-a-w- C:\Windows\SysWow64\certsentry.dll 2013-08-15 04:55:39 78161360 —-a-w- C:\Windows\System32\mrt.exe 2013-08-02 14:06:01 1706496 —-a-w- C:\Windows\System32\WMVDECOD.DLL 2013-08-02 04:09:35 1548288 —-a-w- C:\Windows\SysWow64\WMVDECOD.DLL 2013-07-30 06:48:59 96168 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-07-30 06:48:55 867240 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll 2013-07-30 06:48:55 263592 —-a-w- C:\Windows\SysWow64\javaws.exe 2013-07-30 06:48:55 175016 —-a-w- C:\Windows\SysWow64\javaw.exe 2013-07-30 06:48:55 175016 —-a-w- C:\Windows\SysWow64\java.exe 2013-07-30 06:48:54 789416 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2013-07-25 03:54:29 17830400 —-a-w- C:\Windows\System32\mshtml.dll 2013-07-25 03:37:25 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2013-07-25 03:35:45 10926080 —-a-w- C:\Windows\System32\ieframe.dll 2013-07-25 03:31:23 1346560 —-a-w- C:\Windows\System32\urlmon.dll 2013-07-25 03:30:49 1392128 —-a-w- C:\Windows\System32\wininet.dll 2013-07-25 03:29:41 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2013-07-25 03:29:21 237056 —-a-w- C:\Windows\System32\url.dll 2013-07-25 03:29:06 86016 —-a-w- C:\Windows\System32\jsproxy.dll 2013-07-25 03:28:46 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2013-07-25 03:28:31 599040 —-a-w- C:\Windows\System32\vbscript.dll 2013-07-25 03:28:27 816640 —-a-w- C:\Windows\System32\jscript.dll 2013-07-25 03:28:24 2147840 —-a-w- C:\Windows\System32\iertutil.dll 2013-07-25 03:28:18 729088 —-a-w- C:\Windows\System32\msfeeds.dll 2013-07-25 03:27:29 96768 —-a-w- C:\Windows\System32\mshtmled.dll 2013-07-25 03:27:20 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2013-07-25 03:26:53 248320 —-a-w- C:\Windows\System32\ieui.dll 2013-07-25 02:40:07 12334080 —-a-w- C:\Windows\SysWow64\mshtml.dll 2013-07-25 02:32:35 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2013-07-25 02:30:47 9738752 —-a-w- C:\Windows\SysWow64\ieframe.dll 2013-07-25 02:26:45 1104384 —-a-w- C:\Windows\SysWow64\urlmon.dll 2013-07-25 02:26:10 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2013-07-25 02:25:30 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2013-07-25 02:24:39 231936 —-a-w- C:\Windows\SysWow64\url.dll 2013-07-25 02:24:24 65536 —-a-w- C:\Windows\SysWow64\jsproxy.dll 2013-07-25 02:23:59 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2013-07-25 02:23:58 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll 2013-07-25 02:23:51 717824 —-a-w- C:\Windows\SysWow64\jscript.dll 2013-07-25 02:23:30 1796096 —-a-w- C:\Windows\SysWow64\iertutil.dll 2013-07-25 02:23:27 607744 —-a-w- C:\Windows\SysWow64\msfeeds.dll 2013-07-25 02:22:47 73216 —-a-w- C:\Windows\SysWow64\mshtmled.dll 2013-07-25 02:22:35 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2013-07-25 02:22:04 176640 —-a-w- C:\Windows\SysWow64\ieui.dll 2013-07-20 06:57:44 71048 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-20 06:57:44 692104 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-07-17 20:01:51 2048 —-a-w- C:\Windows\System32\tzres.dll 2013-07-17 19:41:34 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2013-07-17 10:53:52 979456 —-a-w- C:\Windows\SysWow64\MFH264Dec.dll 2013-07-17 10:52:55 519680 —-a-w- C:\Windows\SysWow64\d3d11.dll 2013-07-13 12:32:47 58696 —-a-w- C:\Windows\SysWow64\AOLParconLink.exe 2013-07-13 09:03:22 28600 —-a-w- C:\Windows\System32\drivers\avkmgr.sys 2013-07-13 09:03:22 130016 —-a-w- C:\Windows\System32\drivers\avipbb.sys 2013-07-13 09:03:22 100712 —-a-w- C:\Windows\System32\drivers\avgntflt.sys 2013-07-13 05:57:04 525792 —-a-w- C:\Windows\DIFxAPI.dll 2013-07-13 05:56:59 319488 —-a-w- C:\Windows\HideWin.exe 2013-07-10 09:47:49 677888 —-a-w- C:\Windows\SysWow64\rpcrt4.dll 2013-07-10 09:42:55 1303552 —-a-w- C:\Windows\System32\rpcrt4.dll 2013-07-09 12:04:30 1585256 —-a-w- C:\Windows\System32\ntdll.dll 2013-07-09 12:04:30 1168088 —-a-w- C:\Windows\SysWow64\ntdll.dll 2013-07-08 20:59:47 709144 —-a-w- C:\Windows\System32\drivers\cmdguard.sys 2013-07-08 04:51:57 4691904 —-a-w- C:\Windows\System32\ntoskrnl.exe 2013-07-08 04:20:17 5120 —-a-w- C:\Windows\SysWow64\wow32.dll 2013-07-08 04:20:04 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll 2013-07-08 04:18:51 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll 2013-07-08 04:16:55 98304 —-a-w- C:\Windows\SysWow64\cryptnet.dll 2013-07-08 04:16:55 133120 —-a-w- C:\Windows\SysWow64\cryptsvc.dll 2013-07-08 04:16:54 992768 —-a-w- C:\Windows\SysWow64\crypt32.dll 2013-07-08 04:16:33 43008 —-a-w- C:\Windows\apppatch\acwow64.dll 2013-07-08 04:15:39 234496 —-a-w- C:\Windows\System32\wow64.dll 2013-07-08 04:15:25 218624 —-a-w- C:\Windows\System32\wintrust.dll 2013-07-08 04:14:21 16384 —-a-w- C:\Windows\System32\ntvdm64.dll 2013-07-08 04:12:34 174592 —-a-w- C:\Windows\System32\cryptsvc.dll 2013-07-08 04:12:34 132096 —-a-w- C:\Windows\System32\cryptnet.dll 2013-07-08 04:12:34 1276416 —-a-w- C:\Windows\System32\crypt32.dll 2013-07-08 01:39:04 26112 —-a-w- C:\Windows\SysWow64\setup16.exe 2013-07-08 01:39:03 7680 —-a-w- C:\Windows\SysWow64\instnm.exe 2013-07-08 01:39:02 2560 —-a-w- C:\Windows\SysWow64\user.exe 2013-07-05 04:45:27 1423808 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2013-06-18 21:16:04 96800 —-a-w- C:\Windows\System32\drivers\inspect.sys 2013-06-18 21:16:04 47336 —-a-w- C:\Windows\System32\drivers\cmdhlp.sys 2013-06-18 21:16:02 23168 —-a-w- C:\Windows\System32\drivers\cmderd.sys 2013-06-18 21:15:50 43216 —-a-w- C:\Windows\System32\cmdcsr.dll 2013-06-18 21:15:48 437688 —-a-w- C:\Windows\System32\guard64.dll 2013-06-18 21:15:48 348584 —-a-w- C:\Windows\SysWow64\guard32.dll 2013-06-18 21:15:40 45784 —-a-w- C:\Windows\System32\cmdkbd64.dll 2013-06-18 21:15:40 344792 —-a-w- C:\Windows\System32\cmdvrt64.dll 2013-06-18 21:15:36 40664 —-a-w- C:\Windows\SysWow64\cmdkbd32.dll 2013-06-18 21:15:36 278232 —-a-w- C:\Windows\SysWow64\cmdvrt32.dll 2013-06-15 13:27:51 20480 —-a-w- C:\Windows\System32\icaapi.dll 2013-06-15 11:38:39 29184 —-a-w- C:\Windows\System32\drivers\tssecsrv.sys 2013-06-04 04:17:26 52736 —-a-w- C:\Windows\apppatch\iebrshim.dll 2013-06-04 04:17:01 145920 —-a-w- C:\Windows\apppatch\AppPatch64\iebrshim.dll 2013-06-04 02:03:07 2775040 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 15:21:04.59 ===============
Post #42
. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 7/13/2013 1:43:48 AM System Uptime: 9/1/2013 9:12:44 AM (6 hours ago) . Motherboard: Acer | | Makalu Processor: Intel® Core™2 Duo CPU T6400 @ 2.00GHz | U2E1 | 2000/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 143 GiB total, 76.873 GiB free. D: is FIXED (NTFS) - 139 GiB total, 101.185 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== Installed Programs ====================== . Acer Arcade Deluxe Acer Crystal Eye Webcam 2.0.8 Acer eAudio Management Acer eDataSecurity Management Acer Empowering Technology Acer ePower Management Acer eRecovery Management Acer eSettings Management Acer GameZone Console 2.0.1.1 Acer GridVista Acer Mobility Center Plug-In Acer Registration Acer ScreenSaver Acrobat.com Activation Assistant for the 2007 Microsoft Office suites Adobe AIR Adobe Flash Player 11 ActiveX Adobe Reader X (10.1.4) Agatha Christie Death on the Nile Alice Greenfingers AOL Uninstaller (Choose which Products to Remove) Apple Application Support Apple Software Update Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver Avira Free Antivirus Avira SearchFree Toolbar plus Web Protection Azada Backspin Billiards Big Kahuna Reef Bookworm Deluxe Bricks of Egypt Cake Mania CCleaner Chicken Invaders 3 Chuzzle Comodo Dragon COMODO Firewall CyberLink PowerDirector Diner Dash Flo on the Go ESET Online Scanner v3 eSobi v2 Flip Words 2 GeekBuddy Google Chrome Google Toolbar for Internet Explorer Google Update Helper HDAUDIO Soft Data Fax Modem with SmartCP HiJackThis Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Intel® Graphics Media Accelerator Driver Intel® Matrix Storage Manager Java 7 Update 25 Java Auto Updater Jewel Quest Solitaire Kick N Rush Launch Manager LightScribe 1.4.142.1 LTCM Client Mahjong Escape Ancient China Mahjongg Artifacts Malwarebytes Anti-Malware version 1.75.0.1300 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft VC9 runtime libraries Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Works MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Mystery Case Files - Huntsville Mystery Solitaire - Secret Island NTI Backup Now 5 NTI Backup Now Standard NTI Media Maker 8 PhotoNow! QuickTime Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576) Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407) Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Synaptics Pointing Device Driver Turbo Pizza Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Winamp Winamp Detector Plug-in Winbond CIR Device Drivers Zuma Deluxe . ==== End Of File ===========================
Post #43
I don't see anything malware related in the logs that you are providing any longer which is good, but we are still having problems. You might be better off at this point posting a new topic in the Windows forum here at What the Tech. They are fantastic there and you will be in good hands. Be sure to post what remaining problems you are having as well as a link to this topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI