What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Hijack log

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I posted a diffrent hijack log the other day. I believe the steps we took were 1.atf cleaner 2. malwarebytes 3. new hijack log 4.rooter, In the end everything looked clean. I have had to run 2 recoverys in the past few months i do have norton 360 but all its found in that time is 1 screen capture and cookies. my pc seems fine nothing runs to slow although lately ie has started up slowly. I dont do alot of downloading i do have some additional information to share but im just not comfortable discussing it here if its at all possible to speak to a tech someway else i would really appreciate it.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:59:16 PM, on 12/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\arservice.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdMgr.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\HP_Administrator.FERNANDES\Desktop\New Folder\ATF-Cleaner.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flash…ent/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
Post #3
Exstatic,

Let's dig a little deeper than we did before.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #4
ComboFix 08-12-26.03 - HP_Administrator 2008-12-27 23:26:41.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.681 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning disabled* (Updated)
FW: Norton 360 *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-28 )))))))))))))))))))))))))))))))
.

2008-12-27 19:19 . 2008-12-27 19:19 0 –a—— c:\windows\nsreg.dat
2008-12-26 19:33 . 2008-12-26 20:46 d——– c:\program files\Runes of Magic
2008-12-26 17:59 . 2008-12-26 17:59 d——– c:\windows\system32\LogFiles
2008-12-25 12:36 . 2008-12-25 12:36 d——– c:\program files\BillP Studios
2008-12-25 12:36 . 2008-12-25 12:36 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\WinPatrol
2008-12-25 12:31 . 2008-12-25 12:41 d——– c:\program files\SpywareBlaster
2008-12-25 12:31 . 2008-12-26 19:24 d-a—— c:\documents and settings\All Users\Application Data\TEMP
2008-12-25 12:31 . 2005-08-25 19:18 118,784 –a—— c:\windows\system32\MSSTDFMT.DLL
2008-12-25 12:06 . 2008-12-26 16:35 d——– C:\Rooter$
2008-12-25 11:39 . 2008-12-25 11:39 0 –a—— c:\documents and settings\HP_Administrator.FERNANDES\Application Data\wklnhst.dat
2008-12-25 11:26 . 2008-12-27 16:07 31 –a—— c:\documents and settings\HP_Administrator.FERNANDES\jagex_runescape_preferences.dat
2008-12-25 10:55 . 2008-12-25 10:55 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\Malwarebytes
2008-12-25 10:55 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-25 10:54 . 2008-12-25 10:55 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-25 10:54 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-25 10:33 . 2008-12-25 10:32 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-12-25 09:44 . 2008-12-25 09:44 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\MSNInstaller
2008-12-24 23:13 . 2008-12-25 10:32 410,984 –a—— c:\windows\system32\deploytk.dll
2008-12-24 21:33 . 2008-12-24 21:34 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\mIRC
2008-12-24 15:04 . 2008-12-24 15:04 262,144 –a—— C:\ntuser.dat
2008-12-24 15:01 . 2008-12-24 15:04 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\Yahoo!
2008-12-24 10:43 . 2008-12-24 10:43 56 –ah—– c:\windows\system32\ezsidmv.dat
2008-12-24 10:42 . 2008-12-26 20:40 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\skypePM
2008-12-24 10:40 . 2008-12-26 20:41 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\Skype
2008-12-24 10:39 . 2008-04-13 13:45 60,032 –a—— c:\windows\system32\drivers\USBAUDIO.sys
2008-12-24 10:39 . 2008-04-13 13:45 60,032 –a—— c:\windows\system32\dllcache\usbaudio.sys
2008-12-24 10:39 . 2008-04-13 13:45 32,128 –a—— c:\windows\system32\drivers\usbccgp.sys
2008-12-24 10:39 . 2008-04-13 13:45 32,128 –a—— c:\windows\system32\dllcache\usbccgp.sys
2008-12-24 10:02 . 2008-12-24 10:02 d——– c:\windows\system32\scripting
2008-12-24 10:02 . 2008-12-24 10:02 d——– c:\windows\system32\en
2008-12-24 10:02 . 2008-12-24 10:02 d——– c:\windows\system32\bits
2008-12-24 09:47 . 2008-04-13 19:11 1,888,992 ——— c:\windows\system32\ati3duag.dll
2008-12-23 20:13 . 2008-12-23 20:13 d——– c:\windows\system32\N360_BACKUP
2008-12-23 19:50 . 2008-10-16 15:38 6,066,176 ——— c:\windows\system32\dllcache\ieframe.dll
2008-12-23 19:50 . 2007-04-17 04:32 2,455,488 ——— c:\windows\system32\dllcache\ieapfltr.dat
2008-12-23 19:50 . 2007-03-08 00:10 991,232 ——— c:\windows\system32\dllcache\ieframe.dll.mui
2008-12-23 19:50 . 2008-10-16 15:38 459,264 ——— c:\windows\system32\dllcache\msfeeds.dll
2008-12-23 19:50 . 2008-10-16 15:38 383,488 ——— c:\windows\system32\dllcache\ieapfltr.dll
2008-12-23 19:50 . 2008-10-16 15:38 267,776 ——— c:\windows\system32\dllcache\iertutil.dll
2008-12-23 19:50 . 2008-10-16 15:38 63,488 ——— c:\windows\system32\dllcache\icardie.dll
2008-12-23 19:50 . 2008-10-16 15:38 52,224 ——— c:\windows\system32\dllcache\msfeedsbs.dll
2008-12-23 19:50 . 2008-10-16 08:11 13,824 ——— c:\windows\system32\dllcache\ieudinit.exe
2008-12-23 19:24 . 2008-10-24 06:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-12-23 19:23 . 2008-08-14 05:11 2,189,184 ——— c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-23 19:23 . 2008-08-14 05:09 2,145,280 ——— c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-23 19:23 . 2008-08-14 04:33 2,066,048 ——— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-23 19:23 . 2008-08-14 04:33 2,023,936 ——— c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-23 19:23 . 2008-09-15 07:12 1,846,400 ——— c:\windows\system32\dllcache\win32k.sys
2008-12-23 19:23 . 2008-10-15 11:34 337,408 ——— c:\windows\system32\dllcache\netapi32.dll
2008-12-23 19:23 . 2008-09-08 05:41 333,824 ——— c:\windows\system32\dllcache\srv.sys
2008-12-23 19:23 . 2008-08-14 05:04 138,496 ——— c:\windows\system32\dllcache\afd.sys
2008-12-23 19:22 . 2008-12-23 19:22 d—-c— c:\windows\system32\DRVSTORE
2008-12-23 19:22 . 2008-04-11 14:04 691,712 ——— c:\windows\system32\dllcache\inetcomm.dll
2008-12-23 19:21 . 2008-06-13 06:05 272,128 ——— c:\windows\system32\drivers\bthport.sys
2008-12-23 19:21 . 2008-06-13 06:05 272,128 ——— c:\windows\system32\dllcache\bthport.sys
2008-12-23 19:21 . 2008-05-08 09:02 203,136 ——— c:\windows\system32\dllcache\rmcast.sys
2008-12-23 18:55 . 2008-12-23 20:04 d——– c:\program files\Norton 360
2008-12-23 18:53 . 2008-12-23 20:11 d——– c:\program files\Symantec
2008-12-23 18:53 . 2008-12-23 20:11 123,952 –a—— c:\windows\system32\drivers\SYMEVENT.SYS
2008-12-23 18:53 . 2008-12-23 20:11 60,800 –a—— c:\windows\system32\S32EVNT1.DLL
2008-12-23 18:49 . 2008-12-23 18:49 1,836 -rahs—- c:\windows\system32\drivers\103C_HP_CPC_RC656AA-ABA a1624n_YC_0Pavi_QMXX647_E64NAemMPA4_48_INODUSM3_SASUSTek Computer INC._V1.05_B3.07_T060802_WXP2_L409_M1023_J250_7AMD_8Athlon 64 X2 Dual Core_92_#080921_N_Z14F12F20_G.MRK
2008-12-23 18:46 . 2006-09-07 04:42 d——– c:\documents and settings\HP_Administrator.FERNANDES\WINDOWS
2008-12-23 18:46 . 2006-09-07 04:44 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\Intuit
2008-12-23 18:46 . 2008-12-25 11:26 d——– c:\documents and settings\HP_Administrator.FERNANDES
2008-12-23 18:45 . 2006-09-07 04:42 d——– c:\windows\system32\config\systemprofile\WINDOWS
2008-12-23 18:45 . 2006-09-07 05:07 d——– c:\windows\system32\config\systemprofile\Application Data\Symantec
2008-12-23 18:45 . 2006-09-07 04:44 d——– c:\windows\system32\config\systemprofile\Application Data\Intuit
2008-12-23 18:13 . 2008-12-24 10:39 dr-hs—- c:\windows\system32\dllcache
2008-12-23 17:44 . 2008-12-23 20:11 10,671 –a—— c:\windows\system32\drivers\SYMEVENT.CAT
2008-12-23 17:44 . 2008-12-23 20:11 805 –a—— c:\windows\system32\drivers\SYMEVENT.INF
2008-12-23 17:34 . 2008-12-23 20:12 d——– c:\documents and settings\HP_Administrator.FERNANDES\Application Data\Symantec
2008-12-23 17:28 . 2008-12-23 17:28 d–hs—- c:\documents and settings\HP_Administrator.FERNANDES\UserData
2008-12-23 17:09 . 2008-12-23 17:10 d——– c:\windows\NV23002108.TMP
2008-12-23 17:09 . 2008-05-16 11:25 219,156 -ra—— c:\windows\system32\nvdspcsy.chm
2008-12-23 17:09 . 2008-05-16 11:25 200,405 -ra—— c:\windows\system32\nvdspara.chm
2008-12-23 17:09 . 2008-05-16 11:25 188,707 -ra—— c:\windows\system32\nvdspdan.chm
2008-12-23 17:09 . 2008-05-16 11:25 128,958 -ra—— c:\windows\system32\nv3dcsy.chm
2008-12-23 17:09 . 2008-05-16 11:25 128,544 -ra—— c:\windows\system32\nv3dara.chm
2008-12-23 17:09 . 2008-05-16 11:25 125,735 -ra—— c:\windows\system32\nvcplara.chm
2008-12-23 17:09 . 2008-05-16 11:25 124,067 -ra—— c:\windows\system32\nvcplcsy.chm
2008-12-23 17:09 . 2008-05-16 11:25 120,933 -ra—— c:\windows\system32\nvcpldan.chm
2008-12-23 17:09 . 2008-05-16 11:25 118,926 -ra—— c:\windows\system32\nv3ddan.chm
2008-12-23 17:09 . 2008-05-16 11:25 57,387 -ra—— c:\windows\system32\nvmobcsy.chm
2008-12-23 17:09 . 2008-05-16 11:25 57,328 -ra—— c:\windows\system32\nvmobara.chm
2008-12-23 17:09 . 2008-05-16 11:25 55,622 -ra—— c:\windows\system32\nvmobdan.chm
2008-12-23 17:08 . 2008-04-30 17:27 442,368 –a—— c:\windows\system32\NVUNINST.EXE
2008-12-23 17:03 . 2008-12-23 17:04 664 –a—— c:\windows\system32\d3d9caps.dat
2008-12-23 17:03 . 2008-12-23 17:03 552 –a—— c:\windows\system32\d3d8caps.dat
2008-12-22 23:42 . 2008-12-22 23:42 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 19:26 . 2008-12-22 19:26 d——– C:\CrashReport
2008-12-21 21:59 . 2008-12-21 21:59 d——– c:\program files\Pando Networks
2008-12-21 21:59 . 2008-12-21 21:59 d——– c:\documents and settings\All Users\Application Data\PMB Files
2008-12-21 21:59 . 2008-12-21 21:59 204 –a—— C:\Plugins
2008-12-12 12:08 . 2008-12-21 21:44 d——– c:\program files\World of Warcraft Trial
2008-12-10 11:43 . 2008-12-10 11:43 d——– c:\documents and settings\NetworkService\Application Data\Xfire
2008-12-10 11:06 . 2008-12-10 11:06 d——– c:\program files\Panda Security
2008-12-08 21:18 . 2008-12-09 04:24 d——– c:\documents and settings\All Users\Application Data\SITEguard
2008-12-08 21:17 . 2008-12-08 21:17 d——– c:\program files\Common Files\iS3
2008-12-08 21:17 . 2008-12-09 07:02 d——– c:\documents and settings\All Users\Application Data\STOPzilla!
2008-12-08 21:00 . 2008-12-08 21:00 d——– c:\program files\Trend Micro
2008-12-05 14:36 . 2008-12-24 21:33 d——– c:\program files\mIRC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-28 04:21 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-25 15:32 ——— d—–w c:\program files\Java
2008-12-25 15:16 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-24 20:05 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-24 20:04 ——— d—–w c:\program files\Yahoo!
2008-12-24 20:04 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-24 15:40 ——— d—–w c:\program files\Google
2008-12-23 22:14 ——— d—–w c:\program files\PC-Doctor 5 for Windows
2008-12-22 20:15 ——— d—–w c:\program files\Vuze
2008-12-21 05:47 ——— d—–w c:\program files\NCSoft
2008-12-13 06:40 3,593,216 ——w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 17:08 ——— d—–w c:\program files\Common Files\Blizzard Entertainment
2008-11-25 14:49 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-11-25 14:49 ——— d—–w c:\program files\AGEIA Technologies
2008-11-17 18:32 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-17 15:18 ——— d—–w c:\documents and settings\All Users\Application Data\PCPitstop
2008-11-16 23:08 ——— d—–w c:\program files\Turbine
2008-11-16 16:29 ——— d—–w c:\program files\SystemRequirementsLab
2008-11-16 15:56 ——— d—–w c:\program files\Curse
2008-11-16 15:36 ——— d—–w c:\program files\Microsoft DirectX SDK (August 2008)
2008-11-16 15:33 120,328 —-a-w c:\windows\dxsdkuninst.exe
2008-11-15 23:21 ——— d—–w c:\program files\World of Warcraft
2008-11-15 21:54 ——— d—–w c:\program files\Skype
2008-11-15 21:54 ——— d—–w c:\program files\Common Files\Skype
2008-11-15 21:54 ——— d—–w c:\documents and settings\All Users\Application Data\Skype
2008-11-15 13:02 ——— d—–w c:\program files\City of Heroes
2008-11-13 20:25 ——— d–h–w c:\documents and settings\All Users\Application Data\{1BFA58C9-6B9E-433B-875A-6AD34E8AE1C3}
2008-11-10 10:45 ——— d—–w c:\documents and settings\All Users\Application Data\AOL OCP
2008-11-10 10:44 ——— d—–w c:\program files\AIM6
2008-11-10 10:40 ——— d—–w c:\program files\Viewpoint
2008-11-10 10:40 ——— d—–w c:\program files\Common Files\Software Update Utility
2008-11-10 10:40 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-10 10:40 ——— d—–w c:\documents and settings\All Users\Application Data\acccore
2008-11-10 10:39 ——— d—–w c:\program files\Common Files\AOL
2008-11-10 10:39 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2008-11-04 02:38 ——— d—–w c:\documents and settings\LocalService\Application Data\Xfire
2008-11-03 22:10 ——— d-s—w c:\program files\Xfire
2008-11-01 14:19 ——— d—–w c:\program files\Gpotato
2008-11-01 06:12 ——— d—–w c:\program files\Common Files\DirectX
2008-10-27 18:38 995,154 —-a-w c:\program files\Nov2008_d3dx10_40_x64.cab
2008-10-27 18:38 966,445 —-a-w c:\program files\Nov2008_d3dx10_40_x86.cab
2008-10-27 18:38 93,700 —-a-w c:\program files\Nov2008_XACT_x86.cab
2008-10-27 18:38 55,538 —-a-w c:\program files\Nov2008_X3DAudio_x64.cab
2008-10-27 18:38 22,867 —-a-w c:\program files\Nov2008_X3DAudio_x86.cab
2008-10-27 18:38 122,810 —-a-w c:\program files\Nov2008_XACT_x64.cab
2008-10-27 18:38 1,907,944 —-a-w c:\program files\Nov2008_d3dx9_40_x64.cab
2008-10-27 18:38 1,551,228 —-a-w c:\program files\Nov2008_d3dx9_40_x86.cab
2008-10-27 18:38 1,348,370 —-a-w c:\program files\Apr2005_d3dx9_25_x64.cab
2008-10-27 18:37 274,976 —-a-w c:\program files\Nov2008_XAudio_x64.cab
2008-10-27 18:37 273,627 —-a-w c:\program files\Nov2008_XAudio_x86.cab
2008-10-27 18:37 139,033 —-a-w c:\program files\OCT2006_XACT_x86.cab
2008-10-23 12:36 286,720 —-a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ——w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:11 70,656 ——w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-15 07:06 633,632 ——w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ——w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:02 247,326 ——w c:\windows\system32\strmdll.dll
2008-10-03 10:02 247,326 ——w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-08-11 08:08 978,396 —-a-w c:\program files\BDAXP.cab
2004-07-22 18:51 3,432,656 —-a-w c:\program files\ManagedDX.CAB
2004-07-09 17:13 703,080 —-a-w c:\program files\BDA.cab
2004-07-09 17:13 15,493,481 —-a-w c:\program files\DirectX.cab
2008-06-30 18:44 324,976 —-a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
2008-11-20 16:21 160496 –a—— c:\program files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 –a—— c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 –a—— c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 –a—— c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4347120]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-25 136600]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"ftutil2"="ftutil2.dll" [2004-06-07 c:\windows\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 c:\windows\RTHDCPL.EXE]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]
"nwiz"="nwiz.exe" [2006-05-09 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-09-07 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-02-18 149352]
R2 YahooAUService;Yahoo! Updater;"c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe" [2008-11-09 602392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-23 99376]
S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888]

*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-12-23 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Hewlett-Packard\SDP\HPSdpApp.exe [2005-09-08 21:23]

2008-12-23 c:\windows\Tasks\Warranty Reminder 11 month.job
- c:\windows\system32\pcintro\reminder\Warranty_Reminder_11_month\Warranty_Reminder_11_month.bat [2008-12-23 18:49]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PCDrProfiler - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PAVILION&pf=desktop
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

c:\windows\Downloaded Program Files\CONFLICT.1\sysreqlab_srl.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\CONFLICT.1\sysreqlab.osd
FF - ProfilePath - c:\documents and settings\HP_Administrator.FERNANDES\Application Data\Mozilla\Firefox\Profiles\kj36dw1z.default\
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-27 23:29:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-27 23:30:34
ComboFix-quarantined-files.txt 2008-12-28 04:30:31

Pre-Run: 161,030,070,272 bytes free
Post-Run: 161,032,302,592 bytes free

303 — E O F — 2008-12-24 04:09:26
Post #6
Exstatic,

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]

  • Copy the following in your clipboard by highlighting it all, then right click and select copy.
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE" /ve /t REG_SZ /d %systemroot%\pchealth\helpctr\Binaries\MSCONFIG.EXE /f
  • Click START in the lower left of your screen
  • Then click RUN
  • Now right-click in the runbox then select Paste
  • Click OK

This will fix your msconfig.
Post #7 last edited
when i entered "ComboFix /u" i still got the same error. but by just copying the text u gave me it fixed it ty also i tried to run a kapersky scan and it found 1 adware file.weatherbug
Post #8
Exstatic, lmi_rescue.exe is related to a program call Log Me In. Did you used to have it installed? winpatrol.exe is from (big surprise here) Winpatrol. Neither one is related to a keylogger. RTHDCPL.exe is Realtek HD Audio Sound Effect Manager mshtml.dll is a windows file (Microsoft HTML Viewer) The browser homepage information was simply MSN to Yahoo. Neither one should be a problem. I just don't see a problem. :blush:
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI