What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Having Problems With Hanonvt.ini

66 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
Actually, the system seems to be running well, and no new pop-ups from Trend for quite awhile now.


ComboFix 07-08-30.3 - "AndiL" 2007-09-01 17:16:53.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.325 [GMT -5:00]
Command switches used :: C:\Documents and Settings\AndiL\Desktop\CFScript
* Created a new restore point

FILE::
C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.0.15.inf
C:\WINDOWS\19967468


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\MyWebSearchWB
C:\Program Files\MyWebSearchWB\bar\1.bin\W6PLUGIN.DLL
C:\Program Files\MyWebSearchWB\bar\1.bin\W6WBTEMP.DLL
C:\Program Files\MyWebSearchWB\bar\Cache\files.ini
C:\WINDOWS\19967468
C:\WINDOWS\19967468\
C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.0.15.inf


((((((((((((((((((((((((( Files Created from 2007-08-01 to 2007-09-01 )))))))))))))))))))))))))))))))


2007-08-29 23:12 d——– C:\WINDOWS\SYSTEM32\ActiveScan
2007-08-29 23:05 drahsc— C:\autorun.inf
2007-08-29 23:04 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-28 23:55 d—-c— C:\gmer
2007-08-28 08:26 d——– C:\DOCUME~1\AndiL\.limewire
2007-08-27 21:20 d—-c— C:\DiagHelp
2007-08-25 19:43 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-08-25 19:43 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-24 21:13 d—-c— C:\getservice
2007-08-24 20:31 d——– C:\WINDOWS\ERUNT
2007-08-23 23:41 d——– C:\Program Files\SUPERAntiSpyware
2007-08-23 23:41 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-08-23 23:40 d——– C:\DOCUME~1\AndiL\APPLIC~1\SUPERAntiSpyware.com
2007-08-23 23:39 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-08-18 22:52 82,248 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\iksyssec.sys
2007-08-18 22:52 57,672 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\iksysflt.sys
2007-08-18 22:52 40,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ikfilesec.sys
2007-08-18 22:52 29,000 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kcom.sys
2007-08-18 22:52 d——– C:\Program Files\Spyware Doctor
2007-08-18 22:52 d——– C:\DOCUME~1\AndiL\APPLIC~1\PC Tools
2007-08-18 22:50 626,688 –a—— C:\WINDOWS\SYSTEM32\msvcr80.dll
2007-08-18 21:43 77,312 –a—— C:\WINDOWS\ua2.dll
2007-08-17 23:57 d——– C:\WINDOWS\Google Toolbar
2007-08-17 19:44 5,140 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-08-11 16:50 4,096 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ohciusb.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-01 14:33 ——— d——– C:\Program Files\Pink Calendar
2007-08-31 23:09 ——— d——– C:\DOCUME~1\AndiL\APPLIC~1\BayScribe
2007-08-30 00:18 ——— d——– C:\Program Files\Google
2007-08-30 00:17 ——— d——– C:\Program Files\eFax Messenger Plus
2007-08-30 00:16 ——— d——– C:\Program Files\Dell AIO Printer A940
2007-08-30 00:14 ——— d——– C:\Program Files\BayScribe
2007-08-28 12:14 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\GuruNet
2007-08-27 19:32 ——— d——– C:\DOCUME~1\AndiL\APPLIC~1\WeatherBug
2007-08-24 08:13 2433 –a—— C:\WINDOWS\system32\drivers\ohciusb.zip
2007-08-18 21:30 131584 –a—— C:\WINDOWS\system32\SpoonUninstall.exe
2007-08-18 00:05 ——— d——– C:\Program Files\Collectorz.com
2007-08-18 00:03 ——— d——– C:\Program Files\ICQ
2007-08-18 00:02 ——— d——– C:\Program Files\WS_FTP Pro
2007-08-18 00:00 ——— d——– C:\Program Files\MUSICMATCH
2007-08-17 23:59 ——— d——– C:\Program Files\Ahead
2007-08-17 23:55 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-17 23:53 ——— d——– C:\Program Files\Critical Thinking Software
2007-08-17 23:52 ——— d–h—– C:\Program Files\Zero G Registry
2007-08-17 23:52 ——— d——– C:\Program Files\Critical Thinking Demos
2007-08-17 23:50 ——— d——– C:\Program Files\Spelling Bee Tutor-PDA
2007-08-17 23:48 ——— d——– C:\Program Files\Yahoo!
2007-08-17 23:48 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo
2007-08-13 09:41 ——— d——– C:\Program Files\Red NoteBook
2007-08-11 16:16 ——— d——– C:\Program Files\Creative
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-05 13:44 ——— d——– C:\DOCUME~1\AndiL\APPLIC~1\Sibelius Software
2007-07-05 13:42 ——— d——– C:\Program Files\Sibelius Software
2005-09-19 12:30 774144 –a—— C:\Program Files\RngInterstitial.dll
2005-05-18 00:18 224590 –a–c— C:\WINDOWS\Fonts.\PCSimplicitee.exe
2005-05-18 00:18 145088 –a–c— C:\WINDOWS\Fonts.\PCHardBall.exe
2005-05-18 00:18 141355 –a–c— C:\WINDOWS\Fonts.\PCmichelle.exe
2005-05-18 00:18 138703 –a–c— C:\WINDOWS\Fonts.\PCBrita.exe
2005-05-18 00:17 233454 –a–c— C:\WINDOWS\Fonts.\PCLewis.exe
2005-05-18 00:17 146103 –a–c— C:\WINDOWS\Fonts.\PCScratchPad.exe
2005-05-18 00:17 133873 –a–c— C:\WINDOWS\Fonts.\pcplayful.exe
2005-05-18 00:17 128153 –a–c— C:\WINDOWS\Fonts.\PCBigStick.exe
2005-05-18 00:17 124681 –a–c— C:\WINDOWS\Fonts.\PCKnobbish.exe
2005-05-18 00:16 134489 –a–c— C:\WINDOWS\Fonts.\PCGoo.exe
2005-05-18 00:16 131330 –a–c— C:\WINDOWS\Fonts.\PCSketched.exe
2005-05-18 00:16 130498 –a–c— C:\WINDOWS\Fonts.\PCEightBall.exe
2005-05-18 00:16 130000 –a–c— C:\WINDOWS\Fonts.\PCJennPen.exe
2005-05-18 00:14 130751 –a–c— C:\WINDOWS\Fonts.\PCSquirrelly.exe
2005-05-07 21:49 6132 –a–c— C:\Program Files\top52–0047.htm
2005-05-07 21:48 6132 –a–c— C:\Program Files\top52–0028.htm
2005-05-07 21:47 1039189 –a–c— C:\Program Files1mp3ins.exe
2005-04-17 12:07 1584088 –a–c— C:\Program Files\earpro4setup.exe
2005-03-27 20:08 10831584 –a–c— C:\Program Files\PestPatrolv5.exe
2004-10-20 21:18 376672 –a–c— C:\Program Files\DLM_2200043_ENU.exe
2004-06-22 21:03 411329 –a–c— C:\Program Files\slimlist.exe
2004-05-04 11:50 8029451 –a–c— C:\Program Files\SetupPestPatrolHome.exe
2004-04-07 09:28 2736029 –a–c— C:\Program Files\treepadplus.zip
2004-02-19 23:15 457 –a–c— C:\Program Files\INSTALL.LOG
2003-05-21 19:10 3662787 –a–c— C:\Program Files\spybotsd12.exe
2003-05-15 11:17 2838184 –a–c— C:\Program Files\ica32.exe
2003-05-13 23:30 260684 –a–c— C:\Program Files\ICQMessageArchive.exe
2003-05-13 18:14 1897672 –a–c— C:\Program Files\winzip81.exe
2003-05-12 22:51 660696 –a–c— C:\Program Files\rednotebook19b.exe
2003-05-12 18:55 5082328 –a–c— C:\Program Files\cuteftppro.exe
2003-05-12 18:48 3025408 –a–c— C:\Program Files\cuteftp.exe
2003-05-12 18:16 3978384 –a–c— C:\Program Files\icqpro2003a.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 –a—— C:\Program Files\BayScribe\bayscribe.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-08-20 15:55]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-08-20 15:51]
"FinePrint Dispatcher v5"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2003-06-17 10:12]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2002-08-14 18:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2003-04-29 18:31]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-09 21:45]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe" [2006-03-08 13:30]
"F5D9050"="C:\Program Files\Belkin\F5D9050\Belkinwcui.exe" [2006-03-14 16:52]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="C:\Program Files\AWS\WeatherBug\Weather.exe" [2005-06-07 13:58]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-20 20:14]

C:\DOCUME~1\AndiL\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 09:00:00]
PinkCal.lnk - C:\Program Files\Pink Calendar\PinkCal.exe [2007-08-18 21:30:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 relog_ap
"Notification Packages"= :\WINDOWS\system32\srrstr.dll cecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Device Detector 2.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Device Detector 2.lnk
backup=C:\WINDOWS\pss\Device Detector 2.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax Tray Menu.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\eFax Tray Menu.lnk
backup=C:\WINDOWS\pss\eFax Tray Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GuruNet.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GuruNet.lnk
backup=C:\WINDOWS\pss\GuruNet.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Printkey2000.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Printkey2000.lnk
backup=C:\WINDOWS\pss\Printkey2000.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^AndiL^Start Menu^Programs^Startup^.lnk]
path=C:\Documents and Settings\AndiL\Start Menu\Programs\Startup\.lnk
backup=C:\WINDOWS\pss\.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^AndiL^Start Menu^Programs^Startup^eBot.lnk]
path=C:\Documents and Settings\AndiL\Start Menu\Programs\Startup\eBot.lnk
backup=C:\WINDOWS\pss\eBot.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^AndiL^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\AndiL\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
"C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CaISSDT]
"C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A940]
"C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrustPPAP]
"C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
C:\PROGRA~1\ICQ\ICQNet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp10.0]
"C:\Program Files\Microsoft Money\System\Activation.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
"C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe

R0 snapman;Acronis Snapshots Manager;C:\WINDOWS\System32\DRIVERS\snapman.sys
R0 timounter;Acronis TrueImage Backup Archive Explorer;C:\WINDOWS\System32\DRIVERS\timntr.sys
R2 tifsfilter;Acronis TrueImage FS Filter;C:\WINDOWS\System32\DRIVERS\tifsfilt.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\System32\DRIVERS\BCMSM.sys
R3 StreamSurge;StreamSurge Driver (miniport);C:\WINDOWS\System32\DRIVERS\ss.sys
S2 InCDsrvR;InCD Helper (read only);C:\Program Files\Ahead\InCD\InCDsrv.exe -r
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\System32\Drivers\StMp3Rec.sys
S3 VNUSB;VN Series Device;C:\WINDOWS\System32\DRIVERS\VNUSB.sys
S4 ohciusb;Open Host Controller Miniport USB Driver;\??\C:\WINDOWS\System32\drivers\ohciusb.sys


Contents of the 'Scheduled Tasks' folder
2007-08-29 23:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-30 06:55:34 C:\WINDOWS\Tasks\PPv5Scan_Daily as AndiL at 1 55 AM.job - C:\Program Files\CA\eTrust PestPatrol\ppv5consumercl.exe
2007-08-24 17:12:01 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job - C:\Program Files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe
2007-05-16 17:12:19 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job - C:\Program Files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-01 17:23:52
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************

Completion time: 2007-09-01 17:27:27 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-01 17:26
C:\ComboFix2.txt … 2007-08-30 23:05
C:\ComboFix3.txt … 2007-08-26 16:40

— E O F —


The zip file was uploaded on the other forum.



SC] GetServiceConfig SUCCESS

SERVICE_NAME: ohciusb
TYPE : 1 KERNEL_DRIVER
START_TYPE : 4 DISABLED
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : \??\C:\WINDOWS\System32\drivers\ohciusb.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Open Host Controller Miniport USB Driver
DEPENDENCIES :
SERVICE_START_NAME :
Post #47
Good - I had expected with the minimal infection indicated in these later logs your system would be doing well. Sorta at an impasse as far as any additional recommended changes without knowing more, or in truth, having a good reason to make them. The service still not quite understood is currently disabled, and remains that way without appearing to have any impact there plus or minus. You created a servstart.bat to have available should any system alerts suggest there is a need for that service after all (at least a beneficial need). The last file sent was as the scans suggested so a known infection downloader that didn't add more to any unknowns here. A good measure would be to rename that ohciusb.sys file in the System32\Drivers folder to ohciusb.sys.old, just to leave it neutral as well. For now I would recommend just continuing to monitor activities there as you have been doing so well so far. If further information comes from others reviewing the driver and other settings I will post that back here. Best to reset the System Restore now, to clear out anything planning on returning from past infection. To do this, right-click My Computer and select Properties. Click the System Restore tab in the window that appears, and check the box that says "Turn off System Restore on all drives" and click Apply. You will be asked if you are sure, click Yes. This will delete the restore points. Then click OK in the Properties window and reboot your computer. When your desktop appears, right-click My Computer and select Properties once more. Uncheck the "Turn off System Restore…" box and click Apply. OK.
Post #48
I will follow up on these instructions. I do thank you very much for your help and patience in getting this cleaned off. Hopefully you won't need to hear from me again. :D
Post #49
Glad to assist. If you ever do decide to uninstall Spyware Doctor, why not give GMER another try. Just on the off chance a corrupted Spyware Doctor install is involved there. And as I mentioned, should other info come available in the near future I will post an update here.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI