Can't get passed the Welcome Screen

[Oskari]

Hi Jacee,

I ran the program. I saved DDS.txt to desktop (results pasted below). However, I cannot find Attach.txt file. It does not appear anywhere on my task tray (taskbar). I'll keep looking (searching).
-----------------
CONTENTS OF DDS.TXT

.
DDS (Ver_11-03-05.01) - NTFS_AMD64 NETWORK
Run by Oskari at 9:37:20.01 on Wed 13/04/2011
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.61.1033.18.4094.3456 [GMT 10:00]
.
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Oskari\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.hotmail.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
uRun: [AdobeBridge]
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
mRun: [<NO NAME>]
mRun: [MFARestart] "C:\ProgramData\MFAData\pack\avgrunasx.exe" /usereg
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
TB-X64: DAEMON Tools Toolbar: {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
mRun-x64: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Oskari\AppData\Roaming\Mozilla\Firefox\Profiles\8evcbsg8.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - plugin: C:\Program Files (x86)\TabletPlugins\npwacom.dll
FF - plugin: C:\Users\Oskari\AppData\Roaming\Mozilla\Firefox\Profiles\8evcbsg8.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
.
============= SERVICES / DRIVERS ===============
.
S2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-3-8 219360]
S2 GEST Service;GEST Service for program management.;C:\Program Files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2010-3-8 68136]
S2 TabletServiceWacom;TabletServiceWacom;C:\Windows\System32\Wacom_Tablet.exe [2010-6-22 1908520]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-1-21 93696]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-21 19968]
S3 VST64_DPV;VST64_DPV;C:\Windows\System32\drivers\VSTDPV6.SYS [2008-1-21 1523712]
S3 VST64HWBS2;VST64HWBS2;C:\Windows\System32\drivers\VSTBS26.SYS [2008-1-21 392704]
S3 wacmoumonitor;Wacom Mode Helper;C:\Windows\System32\drivers\wacmoumonitor.sys [2010-6-22 18216]
.
=============== Created Last 30 ================
.
2011-04-12 00:57:08 -------- d-----w- C:\Users\Oskari\AppData\Roaming\SUPERAntiSpyware.com
2011-04-12 00:57:08 -------- d-----w- C:\PROGRA~3\SUPERAntiSpyware.com
2011-04-11 23:56:59 -------- d-----w- C:\Users\Oskari\AppData\Roaming\QuickScan
2011-04-11 23:51:52 -------- d-----w- C:\5bc426e98ace87427b4f5ae1
2011-04-11 23:30:53 -------- d-----w- C:\Windows\pss
2011-04-11 23:21:53 -------- d-----w- C:\Users\Oskari\AppData\Roaming\Malwarebytes
2011-04-11 23:21:46 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-04-11 23:21:46 -------- d-----w- C:\PROGRA~3\Malwarebytes
2011-04-11 23:21:43 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-04-11 23:21:43 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-04-11 08:33:54 -------- d-----w- C:\Boot
2011-04-11 08:33:38 -------- d-----w- C:\$WINDOWS.~BT
2011-04-10 03:27:23 -------- d--h--w- C:\$AVG
2011-04-10 01:22:22 -------- d-----w- C:\Program Files (x86)\Plants vs Zombies
2011-04-10 01:18:40 -------- d-----w- C:\PROGRA~3\Big Fish Games
2011-04-10 01:18:38 -------- d-----w- C:\Program Files (x86)\bfgclient
2011-04-10 01:17:54 -------- d-----w- C:\BigFishGamesCache
2011-04-10 00:14:34 -------- d-----w- C:\Users\Oskari\AppData\Roaming\AVG
2011-04-09 23:14:28 -------- d--h--w- C:\PROGRA~3\Common Files
2011-04-09 06:51:58 -------- d-----w- C:\PROGRA~3\AVG10
2011-04-09 06:47:28 -------- d-----w- C:\PROGRA~3\MFAData
2011-04-09 06:46:18 781272 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll
2011-04-09 06:46:18 728024 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libGLESv2.dll
2011-04-09 06:46:18 1975768 ----a-w- C:\Program Files (x86)\Mozilla Firefox\D3DCompiler_42.dll
2011-04-09 06:46:18 1893336 ----a-w- C:\Program Files (x86)\Mozilla Firefox\d3dx9_42.dll
2011-04-09 06:46:18 1874904 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-04-09 06:46:18 15832 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll
2011-04-09 06:46:18 142296 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libEGL.dll
2011-04-09 06:46:18 142296 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
2011-04-07 20:21:17 -------- d-----w- C:\PROGRA~3\AVAST Software
2011-04-03 04:49:49 129024 ----a-w- C:\Windows\UNWISE.EXE
2011-04-03 04:49:46 -------- d-----w- C:\audio(0)
2011-04-03 04:42:09 212992 ----a-w- C:\Windows\SysWow64\ReWire.dll
2011-04-01 22:13:19 -------- d-----w- C:\Users\Oskari\AppData\Local\FalloutNV
.
==================== Find3M ====================
.
2011-04-09 21:41:34 25640 ----a-w- C:\Windows\gdrv.sys
.
============= FINISH: 9:38:02.41 ===============

 

[Oskari]

My computer cannot locate a file named: attach.txt

As you may know I am stuck in Safe Mode. Would this affect the creation of this file?

Regarding script blockers. I'm assuming I don't have anything like that running, but I really don't know what they are.

 

[Oskari]

I'm wondering at this stage whether it is just best for me to start again fresh. I think that I've let this computer get too riddled with conflicts, bugs and viruses/maleware/etc. And too many people have come and gone with their software and USB sticks and who-knows-what, because there are traces of software on this machine I've never used.

To cut it short, what is the most fool-proof way of starting from scratch. I don't have a big issue with losing everything. Any documents or images I've created are backed-up, anyway. It's a minor pain to have to re-install the software I use.

I really need this 'starting again' to be as thorough as possible. If I boot from my Vista disk and choose, Install, will that really get rid of everything?

I'm pretty sure I have a full OEM version of MS Vista Home Premium x64. Well, it's right in front of me. It's the one that says, For distribution only with a PC. I'm guessing it's the full product, not an upgrade. I'm only mentioning this in case I'm adviced to format(?) the C-drive and start again with a hard-drive that is completely blank - and I mean completely!

So, any good advice on this next stage would be much appreciated.

 

[Jacee]

From the control panel, go to Programs and Features, and uninstall DAEMON Tools Toolbar It could be either one of these DTToolbar.dll or DTToolbar64.dll.

Next, navigate to C:\Program Files (x86)\DAEMON Tools Toolbar and delete the folder.

You have a few programs that you have not updated and are vulnerable to malware attacks!
Java
AVG
Adobe

I'm wondering at this stage whether it is just best for me to start again fresh. I think that I've let this computer get too riddled with conflicts, bugs and viruses/maleware/etc. And too many people have come and gone with their software and USB sticks and who-knows-what, because there are traces of software on this machine I've never used.

Absolutely!! Go for it

 

[Oskari]

Thanks Jacee! Uninstalling as I type. It's gone.

So, you think it's malware?

So, starting fresh is as simple as booting from the disk and selecting Install? BTW, I already have a folder on my machine called Windows.Old, meaning that the OS has been re-installed before. I kind of don't like the idea that re-installing pulls stuff from the previous installation. I really need this to be a re-install with a flame-thrower, if ya know what I mean.

 

[Jacee]

You're the only one who knows how Vista got on your current computer.
Was this an upgrade from XP?

 

[Oskari]

No, I bought the computer about three years ago (when I joined this forum ).

The machine was put together totally by the techs at the shop. A year ago lightening blew my motherboard and power supply - and another shop replaced these parts and put Vista back on (with my disk). That's why I have that windows.old folder sitting on my machine.

What's the likelihood of that folder containing the problem?

 

[americancritic]

Hello

I was thinking the same thing when I saw Daemon but not being a expert in this matter I chose to be silent and let Jacee tell you because she is a expert, thank you Jacee for stepping in and helping. Great Job...


americancritic

 

[Jacee]

The machine was put together totally by the techs at the shop. A year ago lightening blew my motherboard and power supply - and another shop replaced these parts and put Vista back on (with my disk). That's why I have that windows.old folder sitting on my machine

You are going to have to 'validate' your Vista Version with MS. I'm sorry to tell you this, but it's really for the best to be able to run a reliable OS.

 

[Oskari]

That's okay. I've validated Vista twice now. It's never been a concern.

 

[Oskari]

But the real question (other than why the OS stuffed anyway) is what's the best way to make sure that when I re-install Vista there will be no suspicious software still lurking on the drive?