Computer not been right since Windows update

niemiro · Aug 20, 2010

shug99 said:
I'm going to go ahead with Jaycee's instructions. Do you want me to use HijackThis or should i use the OTL program as richy instructed earlier on. Because i noticed that this forum favours OTL since HijackThis was taken over by a different company or something.

HiJackThis is basically included in OTL, plus lots more. From time to time, after a quick look at your OTL log, we need to ask for another log first, and in this case, Jacee has asked for ComboFix. The OTL log was not wasted, and provides a very firm start, but from here on, can you please do what Jacee asks. I understand your question, and it is not a problem, we just still would like the ComboFix log.

Thanks!

shug99 · Aug 20, 2010

Here is the log from combofix:

ComboFix 10-08-19.02 - Sam 20/08/2010 21:59:52.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3069.1985 [GMT 1:00]
Running from: c:\users\Sam\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\st326017.dll
c:\windows\system32\st326162.dll

.
((((((((((((((((((((((((( Files Created from 2010-07-20 to 2010-08-20 )))))))))))))))))))))))))))))))
.

2010-08-20 21:11 . 2010-08-20 21:11 -------- d-----w- c:\users\TEMP.VP0021706BA0A8\AppData\Local\temp
2010-08-20 21:11 . 2010-08-20 21:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-19 16:37 . 2010-08-19 16:37 -------- d-----w- c:\program files\ERUNT
2010-08-14 19:42 . 2010-08-14 19:42 -------- d-----w- c:\users\Sam\AppData\Roaming\Malwarebytes
2010-08-14 19:42 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-14 19:42 . 2010-08-14 19:42 -------- d-----w- c:\programdata\Malwarebytes
2010-08-14 19:42 . 2010-08-14 19:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-14 19:42 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-13 21:37 . 2010-08-13 21:37 -------- d-----w- c:\users\Sam\AppData\Roaming\Auslogics
2010-08-13 21:37 . 2010-08-13 21:37 -------- d-----w- c:\program files\Auslogics
2010-08-12 17:25 . 2010-08-12 17:25 -------- d-----w- c:\programdata\IObit
2010-08-12 17:06 . 2010-08-17 19:25 -------- d-----w- c:\programdata\FLEXnet
2010-08-12 16:37 . 2010-08-12 16:37 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-08-12 15:17 . 2010-08-12 15:17 -------- d-----w- c:\users\Sam\AppData\Roaming\Juce VST Host
2010-08-12 10:17 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-12 10:17 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-12 10:17 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-08-11 21:40 . 2010-08-11 21:40 -------- d-----w- c:\programdata\Research In Motion
2010-08-11 21:34 . 2010-08-11 21:39 102135128 ----a-w- c:\users\Sam\AppData\Roaming\Research In Motion\BlackBerry\Updates\5D17024E-6DC2-41aa-B38E-DA95AA158934\Extractor.exe
2010-08-08 22:07 . 2010-08-08 22:07 -------- d-----w- c:\users\Sam\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
2010-08-08 22:07 . 2010-08-08 22:07 -------- d-----w- c:\program files\TweetDeck
2010-08-06 11:29 . 2010-08-06 11:29 -------- d-----w- c:\users\Sam\AppData\Roaming\Blackberry Desktop
2010-08-03 20:38 . 2010-08-03 20:38 1821192 ----a-w- c:\users\Sam\AppData\Roaming\Research In Motion\BlackBerry\Updates\5D17024E-6DC2-41aa-B38E-DA95AA158934\vcredist_x86.exe
2010-08-03 20:38 . 2010-08-03 20:38 400728 ----a-w- c:\users\Sam\AppData\Roaming\Research In Motion\BlackBerry\Updates\5D17024E-6DC2-41aa-B38E-DA95AA158934\BBDesktopInstaller.exe
2010-08-03 20:38 . 2010-08-03 20:38 2959376 ----a-w- c:\users\Sam\AppData\Roaming\Research In Motion\BlackBerry\Updates\5D17024E-6DC2-41aa-B38E-DA95AA158934\dotnetfx35setup.exe
2010-08-03 20:38 . 2010-08-03 20:38 128472 ----a-w- c:\users\Sam\AppData\Roaming\Research In Motion\BlackBerry\Updates\5D17024E-6DC2-41aa-B38E-DA95AA158934\Helper.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-20 21:12 . 2009-01-26 15:47 -------- d-----w- c:\programdata\Kontiki
2010-08-20 11:16 . 2008-09-05 19:12 -------- d-----w- c:\programdata\Google Updater
2010-08-19 16:24 . 2008-09-05 14:21 7728 ----a-w- c:\users\Sam\AppData\Local\d3d9caps.dat
2010-08-19 15:03 . 2008-09-01 21:46 -------- d-----w- c:\program files\Microsoft Works
2010-08-18 22:58 . 2009-08-31 17:30 -------- d-----w- c:\users\Sam\AppData\Roaming\vlc
2010-08-17 15:25 . 2009-09-20 17:15 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-08-15 21:24 . 2009-11-08 19:30 -------- d-----w- c:\users\Sam\AppData\Roaming\FileZilla
2010-08-12 17:06 . 2008-09-04 12:14 86168 ----a-w- c:\users\Sam\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-12 16:45 . 2008-10-02 16:11 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-12 12:00 . 2008-09-06 23:39 -------- d-----w- c:\users\Sam\AppData\Roaming\Azureus
2010-08-12 11:53 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-08-11 22:09 . 2009-11-17 21:33 -------- d-----w- c:\users\Sam\AppData\Roaming\Research In Motion
2010-08-11 21:54 . 2009-11-17 21:29 -------- d-----w- c:\program files\Common Files\Research In Motion
2010-08-11 21:53 . 2009-11-17 21:48 -------- d-----w- c:\programdata\Roxio
2010-08-11 21:53 . 2008-09-01 21:33 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-11 21:52 . 2009-11-17 21:29 -------- d-----w- c:\program files\Common Files\Roxio Shared
2010-08-11 21:42 . 2009-11-17 21:29 -------- d-----w- c:\program files\Research In Motion
2010-08-04 14:44 . 2008-09-01 21:33 -------- d-----w- c:\program files\Common Files\Java
2010-08-04 14:41 . 2008-09-01 21:33 -------- d-----w- c:\program files\Java
2010-07-20 17:37 . 2010-06-22 11:25 -------- d-----w- c:\program files\iTunes
2010-07-20 17:36 . 2010-07-20 17:36 -------- d-----w- c:\program files\iPod
2010-07-20 17:36 . 2008-09-04 14:13 -------- d-----w- c:\program files\Common Files\Apple
2010-07-20 17:31 . 2010-07-20 17:31 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe
2010-07-17 04:00 . 2010-06-05 18:59 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-15 16:36 . 2010-07-15 16:36 53248 ----a-r- c:\users\Sam\AppData\Roaming\Microsoft\Installer\{3360D505-B0AA-4284-92DF-F872AF90A448}\ARPPRODUCTICON.exe
2010-07-14 22:16 . 2008-11-08 19:19 -------- d-----w- c:\users\Sam\AppData\Roaming\gtk-2.0
2010-07-01 11:07 . 2010-07-01 11:07 434176 ----a-w- c:\programdata\Trusteer\Rapport\store\exts\RapportMS\17053\RapportMS.dll
2010-06-29 17:47 . 2008-11-19 18:07 -------- d-----w- c:\program files\VstPlugins
2010-06-29 17:42 . 2009-05-30 15:53 -------- d-----w- c:\program files\Native Instruments
2010-06-26 06:05 . 2010-08-12 10:18 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-12 10:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-12 10:18 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-12 10:18 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-25 13:07 . 2008-09-23 08:08 -------- d-----w- c:\program files\Microsoft.NET
2010-06-22 11:20 . 2010-06-22 11:20 -------- d-----w- c:\program files\Bonjour
2010-06-21 13:37 . 2010-08-12 10:18 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-06-18 17:31 . 2010-08-12 10:18 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-06-18 15:04 . 2010-08-12 10:18 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-18 15:04 . 2010-08-12 10:18 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-16 16:04 . 2010-08-12 10:18 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-11 16:16 . 2010-08-12 10:18 274944 ----a-w- c:\windows\system32\schannel.dll
2010-06-08 12:15 . 2008-11-28 15:23 173 ----a-w- c:\users\Sam\AppData\Roaming\Azureus\restart.bat
2010-05-28 00:44 . 2010-05-28 00:43 145 --s-a-w- c:\users\Sam\AppData\Local\178776936.dat
2010-05-28 00:42 . 2010-05-28 00:42 4 ----a-w- c:\users\Sam\AppData\Roaming\ovczpx.dat
2010-05-27 20:08 . 2010-08-12 10:18 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-05-26 17:06 . 2010-06-11 11:59 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-11 11:59 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-08-20 11:15 . 2009-12-17 19:58 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
2008-09-01 21:47 . 2008-09-01 21:47 74 --sh--r- c:\windows\CT4CET.bin
2008-09-02 06:13 . 2008-09-02 06:13 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-16 483428]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2008-01-14 132392]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"Hercules DJ Series"="c:\program files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe" [2009-05-20 501032]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-20 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-03-12 3563520]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-06-30 196608]

c:\users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-5-2 1211472]
VPNGuardUI.lnk - c:\program files\opswat\VPNGuard\VPNGuardUI.exe [2007-10-23 98304]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4oD]
2007-04-23 11:23 1032640 ----a-w- c:\program files\Kontiki\KHost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-17 06:24 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-03-16 20:58 47392 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Webcam Central]
2008-06-03 14:54 446635 ------w- c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX5000 Series]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBVE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX5000 Series (Copy 1)]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBVE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-09-04 16:25 133104 ----atw- c:\users\Sam\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-16 06:41 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx]
2007-04-23 11:23 1032640 ----a-w- c:\program files\Kontiki\KHost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 10:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 20:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SightSpeed]
2008-06-13 02:56 4758904 ----a-w- c:\program files\Dell Video Chat\DellVideoChat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-05-27 20:24 1238352 ----a-w- c:\program files\Valve\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-09-01 21:42 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-06 22:09 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):ef,72,af,28,d6,0b,ca,01

R2 gupdate1c9865d669d927e;Google Update Service (gupdate1c9865d669d927e);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 133104]
R2 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [2007-11-21 17408]
R2 SIMUL8Parallel;SIMUL8 Parallel Processor;c:\progra~1\SIMUL8\SIMUL8_ParallelSVC.exe [2007-03-29 502272]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-20 30192]
R3 HDJCtrl;Hercules DJ Control MP3 Service;c:\windows\system32\Drivers\HDJCtrl.sys [2009-05-20 24064]
R3 HDJMidi;Hercules DJ Control MP3 MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys [2009-05-20 122368]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-04-05 1029456]
R3 P0630VID;Creative WebCam Live!;c:\windows\system32\DRIVERS\P0630Vid.sys [2004-04-14 91797]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2008-09-06 717296]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-06-05 64160]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [2009-03-16 81920]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2010-03-08 62496]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-03-13 203264]
S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\DRIVERS\OA001Ufd.sys [2009-03-06 133632]
S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\DRIVERS\OA001Vid.sys [2009-03-08 280096]
S3 VPNGuardService;VPNGuardService;c:\program files\OPSWAT\VPNGuard\VPNGuardService.exe [2007-10-23 299008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-08-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 12:11]

2010-08-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-01 15:05]

2010-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb0ceb245f0d00.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 00:13]

2010-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 00:13]

2010-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1596938837-54953107-2832527327-1000Core.job
- c:\users\Sam\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-04 16:25]

2010-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1596938837-54953107-2832527327-1000UA.job
- c:\users\Sam\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-04 16:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/home.php
uInternet Settings,ProxyOverride = <local>;*.local
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
FF - ProfilePath - c:\users\Sam\AppData\Roaming\Mozilla\Firefox\Profiles\0a3jjibc.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLC\npvlc.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Sam\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\Sam\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKLM-Run-BlackBerryAutoUpdate - c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
MSConfigStartUp-dscactivate - c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
AddRemove-Free Audio Editor - c:\progra~1\Free Audio Editor\UNWISE.EXE
AddRemove-Octoshape add-in for Adobe Flash Player - c:\users\Sam\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-20 22:12
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1596938837-54953107-2832527327-1000\Software\G*e*n*i*e*"!\FM Genie Scout 2009 XE]
"GameDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009\\games"
"ShortlistDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009\\shortlists"
"ScreenshotsDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009"
"SaveDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009\\"
"HistoryDir"="c:\\Users\\Sam\\Desktop\\fm_genie_scout_2009_xe\\FM Genie Scout 2009 XE\\History Points"
"LangDB"=""
"LastSaveGame"=""
"Language"="English"
"LoadLangDB"=dword:00000000
"CompressHistoryPoints"=dword:00000000
"HighlightedAttributes"=dword:00000000
"MinCondition"=dword:00000050
"SkinName"="Champions League"
"LastUpdateCheck"=dword:00000000
"HighQualityGUI"=dword:00000001
"AutomaticallyUpdateCheck"=dword:00000001
"AdvancedGeneration"=dword:00000000
"TranslateStaffSkills"=dword:00000001
"TranslatePlayerSkills"=dword:00000001
"TranslatePositions"=dword:00000001
"ShowHistory"=dword:00000001
"Version"=dword:00000066
"UniqueID"="B5-A280-E07F"
"Currency"=dword:00000056
"UseProxy"=dword:00000000
"ProxyHost"=""
"ProxyPort"=""
"UseAuthentication"=dword:00000000
"UserName"=""
"UserPassword"=""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-08-20 22:16:51
ComboFix-quarantined-files.txt 2010-08-20 21:16

Pre-Run: 101,974,974,464 bytes free
Post-Run: 101,984,174,080 bytes free

- - End Of File - - 52FFD25E82A73F5EC3AD4701E24801C5

Jacee · Aug 20, 2010

There are three files I'd like you to scan (one at a time, please).

You may need to un-hide hidden files and folders to browse to each:
Control Panel Home view do the following:
1. Click on the Appearance and Personalization link .
2. Click on Show Hidden Files or Folders.
3. Go to step 5.

5. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
6. Remove the checkmark from the checkbox labeled Hide extensions for known file types.
7. Remove the checkmark from the checkbox labeled Hide protected operating system files.
8. Press the Apply button and then the OK button

Scan these files
c:\users\TEMP.VP0021706BA0A8\AppData\Local\temp
c:\users\Sam\AppData\Local\178776936.dat
c:\users\Sam\AppData\Roaming\ovczpx.dat

Upload to VirSCAN.org - Free Multi-Engine Online Virus Scanner v1.02, Supports 36 AntiVirus Engines! When the results come back, save each log, then copy/paste it back here.

shug99 · Aug 20, 2010

The first file you have mention is a folder which appears to be empty (i check whether i needed to unhide files etc but the other 2 showed up fine. Because its a folder i wasnt able to upload it for a scan.

here is the log for the second file:

VirSCAN.org Scanned Report :
Scanned time : 2010/08/20 23:59:55 (BST)
Scanner results: Scanners did not find malware!
File Name : 178776936.dat
File Size : 145 byte
File Type : data
MD5 : fa1af300a15f0918937f94f70a95d223
SHA1 : 9f84dcf7d6a1295f640871cc348bb00e3697fbf6
Online report : 178776936.dat MD5:fa1af300a15f0918937f94f70a95d223 - VirSCAN.org Scanners did not find malware!

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.19 20100821061910 2010-08-21 4.96 -
AhnLab V3 2010.08.07.00 2010.08.07 2010-08-07 26.30 -
AntiVir 8.2.4.38 7.10.10.239 2010-08-20 0.27 -
Antiy 2.0.18 20100821.4955373 2010-08-21 0.02 -
Arcavir 2009 201006281601 2010-06-28 0.00 -
Authentium 5.1.1 201008201310 2010-08-20 1.25 -
AVAST! 4.7.4 100820-1 2010-08-20 0.00 -
AVG 8.5.793 271.1.1/3084 2010-08-21 0.23 -
BitDefender 7.90123.6156716 7.33477 2010-08-21 4.43 -
ClamAV 0.96.1 11606 2010-08-20 0.00 -
Comodo 4.0 5799 2010-08-20 8.14 -
CP Secure 1.3.0.5 2010.08.20 2010-08-20 0.01 -
Dr.Web 5.0.2.3300 2010.08.21 2010-08-21 12.38 -
F-Prot 4.4.4.56 20100820 2010-08-20 3.35 -
F-Secure 7.02.73807 2010.08.20.09 2010-08-20 13.56 -
Fortinet 4.1.143 12.265 2010-08-20 0.11 -
GData 21.701/21.273 20100820 2010-08-20 20.17 -
ViRobot 20100820 2010.08.20 2010-08-20 3.19 -
Ikarus T3. 2010.08.20.76564 2010-08-20 5.07 -
JiangMin 13.0.900 2010.08.19 2010-08-19 4.35 -
Kaspersky 5.5.10 2010.08.20 2010-08-20 0.04 -
KingSoft 2009.2.5.15 2010.8.20.18 2010-08-20 1.38 -
McAfee 5400.1158 6080 2010-08-20 19.08 -
Microsoft 1.6103 2010.08.21 2010-08-21 5.50 -
Norman 6.05.11 6.05.00 2010-08-20 10.01 -
Panda 9.05.01 2010.08.16 2010-08-16 6.55 -
Trend Micro 9.120-1004 7.398.15 2010-08-20 0.02 -
Quick Heal 11.00 2010.08.20 2010-08-20 4.78 -
Rising 20.0 22.61.04.04 2010-08-20 1.81 -
Sophos 3.10.0 4.56 2010-08-21 4.13 -
Sunbelt 3.9.2432.2 6763 2010-08-19 40.09 -
Symantec 1.3.0.24 20100820.018 2010-08-20 0.38 -
nProtect 20100820.01 8830232 2010-08-20 40.09 -
The Hacker 6.5.2.1 v00352 2010-08-20 20.08 -
VBA32 3.12.14.0 20100819.1636 2010-08-19 5.45 -
VirusBuster 4.5.11.10 10.127.60/2041928 2010-08-19 2.35 -

This is the last file you mentioned:

VirSCAN.org Scanned Report :
Scanned time : 2010/08/21 00:07:00 (BST)
Scanner results: Scanners did not find malware!
File Name : ovczpx.dat
File Size : 4 byte
File Type : ISO-8859 text, with no line terminators
MD5 : 295f7aeeb63bcf1d09c0f202924370ca
SHA1 : 71ec50ab4d52f3ec9ec43ee36d28e2d051f9df7f
Online report : ovczpx.dat MD5:295f7aeeb63bcf1d09c0f202924370ca - VirSCAN.org Scanners did not find malware!

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.19 20100821061910 2010-08-21 40.09 -
AhnLab V3 2010.08.07.00 2010.08.07 2010-08-07 7.83 -
AntiVir 8.2.4.38 7.10.10.239 2010-08-20 0.27 -
Antiy 2.0.18 20100821.4955373 2010-08-21 0.02 -
Arcavir 2009 201006281601 2010-06-28 0.00 -
Authentium 5.1.1 201008201310 2010-08-20 1.27 -
AVAST! 4.7.4 100820-1 2010-08-20 0.00 -
AVG 8.5.793 271.1.1/3084 2010-08-21 0.23 -
BitDefender 7.90123.6156716 7.33477 2010-08-21 4.44 -
ClamAV 0.96.1 11606 2010-08-20 0.00 -
Comodo 4.0 5799 2010-08-20 40.09 -
CP Secure 1.3.0.5 2010.08.20 2010-08-20 0.01 -
Dr.Web 5.0.2.3300 2010.08.21 2010-08-21 9.01 -
F-Prot 4.4.4.56 20100820 2010-08-20 1.25 -
F-Secure 7.02.73807 2010.08.20.09 2010-08-20 0.07 -
Fortinet 4.1.143 12.265 2010-08-20 31.22 -
GData 21.701/21.273 20100820 2010-08-20 40.09 -
ViRobot 20100820 2010.08.20 2010-08-20 17.33 -
Ikarus T3. 2010.08.20.76564 2010-08-20 4.95 -
JiangMin 13.0.900 2010.08.19 2010-08-19 5.54 -
Kaspersky 5.5.10 2010.08.20 2010-08-20 0.03 -
KingSoft 2009.2.5.15 2010.8.20.18 2010-08-20 40.09 -
McAfee 5400.1158 6080 2010-08-20 18.07 -
Microsoft 1.6103 2010.08.21 2010-08-21 30.38 -
Norman 6.05.11 6.05.00 2010-08-20 8.01 -
Panda 9.05.01 2010.08.16 2010-08-16 18.25 -
Trend Micro 9.120-1004 7.398.15 2010-08-20 0.02 -
Quick Heal 11.00 2010.08.20 2010-08-20 28.40 -
Rising 20.0 22.61.04.04 2010-08-20 0.22 -
Sophos 3.10.0 4.56 2010-08-21 4.17 -
Sunbelt 3.9.2432.2 6763 2010-08-19 16.00 -
Symantec 1.3.0.24 20100820.018 2010-08-20 0.17 -
nProtect 20100820.01 8830232 2010-08-20 40.09 -
The Hacker 6.5.2.1 v00352 2010-08-20 1.58 -
VBA32 3.12.14.0 20100819.1636 2010-08-19 2.97 -
VirusBuster 4.5.11.10 10.127.60/2041928 2010-08-19 2.37 -

Jacee · Aug 20, 2010

Okay, now do this...

ComboFix Script
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Code:

killAll::
File::
c:\users\Sam\AppData\Local\178776936.dat
c:\users\Sam\AppData\Roaming\ovczpx.dat
 
Folder::
c:\users\TEMP.VP0021706BA0A8\AppData\Local\temp

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

shug99 · Aug 21, 2010

Here is the latest log after following your instructions:

ComboFix 10-08-19.02 - Sam 21/08/2010 19:52:34.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3069.2101 [GMT 1:00]
Running from: c:\users\Sam\Desktop\ComboFix.exe
Command switches used :: c:\users\Sam\Desktop\CFScript.txt
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\Sam\AppData\Local\178776936.dat"
"c:\users\Sam\AppData\Roaming\ovczpx.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Sam\AppData\Local\178776936.dat
c:\users\Sam\AppData\Roaming\ovczpx.dat
c:\users\TEMP.VP0021706BA0A8\AppData\Local\temp

.
((((((((((((((((((((((((( Files Created from 2010-07-21 to 2010-08-21 )))))))))))))))))))))))))))))))
.

2010-08-21 19:04 . 2010-08-21 19:07 -------- d-----w- c:\users\Sam\AppData\Local\temp
2010-08-21 19:04 . 2010-08-21 19:04 -------- d-----w- c:\users\TEMP\AppData\Local\temp
2010-08-21 19:04 . 2010-08-21 19:04 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-08-21 19:04 . 2010-08-21 19:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-19 16:37 . 2010-08-19 16:37 -------- d-----w- c:\program files\ERUNT
2010-08-14 19:42 . 2010-08-14 19:42 -------- d-----w- c:\users\Sam\AppData\Roaming\Malwarebytes
2010-08-14 19:42 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-14 19:42 . 2010-08-14 19:42 -------- d-----w- c:\programdata\Malwarebytes
2010-08-14 19:42 . 2010-08-14 19:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-14 19:42 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-13 21:37 . 2010-08-13 21:37 -------- d-----w- c:\users\Sam\AppData\Roaming\Auslogics
2010-08-13 21:37 . 2010-08-13 21:37 -------- d-----w- c:\program files\Auslogics
2010-08-12 17:25 . 2010-08-12 17:25 -------- d-----w- c:\programdata\IObit
2010-08-12 17:06 . 2010-08-17 19:25 -------- d-----w- c:\programdata\FLEXnet
2010-08-12 16:37 . 2010-08-12 16:37 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-08-12 15:17 . 2010-08-12 15:17 -------- d-----w- c:\users\Sam\AppData\Roaming\Juce VST Host
2010-08-12 10:17 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-12 10:17 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-12 10:17 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-08-11 21:40 . 2010-08-11 21:40 -------- d-----w- c:\programdata\Research In Motion
2010-08-08 22:07 . 2010-08-08 22:07 -------- d-----w- c:\users\Sam\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
2010-08-08 22:07 . 2010-08-08 22:07 -------- d-----w- c:\program files\TweetDeck
2010-08-06 11:29 . 2010-08-06 11:29 -------- d-----w- c:\users\Sam\AppData\Roaming\Blackberry Desktop

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-21 19:09 . 2009-01-26 15:47 -------- d-----w- c:\programdata\Kontiki
2010-08-21 18:22 . 2008-09-05 19:12 -------- d-----w- c:\programdata\Google Updater
2010-08-19 16:24 . 2008-09-05 14:21 7728 ----a-w- c:\users\Sam\AppData\Local\d3d9caps.dat
2010-08-19 15:03 . 2008-09-01 21:46 -------- d-----w- c:\program files\Microsoft Works
2010-08-18 22:58 . 2009-08-31 17:30 -------- d-----w- c:\users\Sam\AppData\Roaming\vlc
2010-08-17 15:25 . 2009-09-20 17:15 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-08-15 21:24 . 2009-11-08 19:30 -------- d-----w- c:\users\Sam\AppData\Roaming\FileZilla
2010-08-12 17:06 . 2008-09-04 12:14 86168 ----a-w- c:\users\Sam\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-12 16:45 . 2008-10-02 16:11 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-12 12:00 . 2008-09-06 23:39 -------- d-----w- c:\users\Sam\AppData\Roaming\Azureus
2010-08-12 11:53 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-08-11 22:09 . 2009-11-17 21:33 -------- d-----w- c:\users\Sam\AppData\Roaming\Research In Motion
2010-08-11 21:54 . 2009-11-17 21:29 -------- d-----w- c:\program files\Common Files\Research In Motion
2010-08-11 21:53 . 2009-11-17 21:48 -------- d-----w- c:\programdata\Roxio
2010-08-11 21:53 . 2008-09-01 21:33 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-11 21:52 . 2009-11-17 21:29 -------- d-----w- c:\program files\Common Files\Roxio Shared
2010-08-11 21:42 . 2009-11-17 21:29 -------- d-----w- c:\program files\Research In Motion
2010-08-04 14:44 . 2008-09-01 21:33 -------- d-----w- c:\program files\Common Files\Java
2010-08-04 14:41 . 2008-09-01 21:33 -------- d-----w- c:\program files\Java
2010-07-20 17:37 . 2010-06-22 11:25 -------- d-----w- c:\program files\iTunes
2010-07-20 17:36 . 2010-07-20 17:36 -------- d-----w- c:\program files\iPod
2010-07-20 17:36 . 2008-09-04 14:13 -------- d-----w- c:\program files\Common Files\Apple
2010-07-17 04:00 . 2010-06-05 18:59 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-14 22:16 . 2008-11-08 19:19 -------- d-----w- c:\users\Sam\AppData\Roaming\gtk-2.0
2010-06-29 17:47 . 2008-11-19 18:07 -------- d-----w- c:\program files\VstPlugins
2010-06-29 17:42 . 2009-05-30 15:53 -------- d-----w- c:\program files\Native Instruments
2010-06-26 06:05 . 2010-08-12 10:18 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-12 10:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-12 10:18 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-12 10:18 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-25 13:07 . 2008-09-23 08:08 -------- d-----w- c:\program files\Microsoft.NET
2010-06-21 13:37 . 2010-08-12 10:18 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-06-18 17:31 . 2010-08-12 10:18 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-06-18 15:04 . 2010-08-12 10:18 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-18 15:04 . 2010-08-12 10:18 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-16 16:04 . 2010-08-12 10:18 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-11 16:16 . 2010-08-12 10:18 274944 ----a-w- c:\windows\system32\schannel.dll
2010-05-27 20:08 . 2010-08-12 10:18 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-05-26 17:06 . 2010-06-11 11:59 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-11 11:59 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-08-20 11:15 . 2009-12-17 19:58 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
2008-09-01 21:47 . 2008-09-01 21:47 74 --sh--r- c:\windows\CT4CET.bin
2008-09-02 06:13 . 2008-09-02 06:13 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-16 483428]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2008-01-14 132392]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"Hercules DJ Series"="c:\program files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe" [2009-05-20 501032]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-20 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-03-12 3563520]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-06-30 196608]

c:\users\Sam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-5-2 1211472]
VPNGuardUI.lnk - c:\program files\opswat\VPNGuard\VPNGuardUI.exe [2007-10-23 98304]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4oD]
2007-04-23 11:23 1032640 ----a-w- c:\program files\Kontiki\KHost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-17 06:24 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-03-16 20:58 47392 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Webcam Central]
2008-06-03 14:54 446635 ------w- c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX5000 Series]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBVE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX5000 Series (Copy 1)]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBVE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-09-04 16:25 133104 ----atw- c:\users\Sam\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-16 06:41 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx]
2007-04-23 11:23 1032640 ----a-w- c:\program files\Kontiki\KHost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 10:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 20:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SightSpeed]
2008-06-13 02:56 4758904 ----a-w- c:\program files\Dell Video Chat\DellVideoChat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-05-27 20:24 1238352 ----a-w- c:\program files\Valve\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-09-01 21:42 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-06 22:09 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):ef,72,af,28,d6,0b,ca,01

R2 gupdate1c9865d669d927e;Google Update Service (gupdate1c9865d669d927e);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 133104]
R2 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [2007-11-21 17408]
R2 SIMUL8Parallel;SIMUL8 Parallel Processor;c:\progra~1\SIMUL8\SIMUL8_ParallelSVC.exe [2007-03-29 502272]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-20 30192]
R3 HDJCtrl;Hercules DJ Control MP3 Service;c:\windows\system32\Drivers\HDJCtrl.sys [2009-05-20 24064]
R3 HDJMidi;Hercules DJ Control MP3 MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys [2009-05-20 122368]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-04-05 1029456]
R3 P0630VID;Creative WebCam Live!;c:\windows\system32\DRIVERS\P0630Vid.sys [2004-04-14 91797]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2008-09-06 717296]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-06-05 64160]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [2009-03-16 81920]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2010-03-08 62496]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-03-13 203264]
S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\DRIVERS\OA001Ufd.sys [2009-03-06 133632]
S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\DRIVERS\OA001Vid.sys [2009-03-08 280096]
S3 VPNGuardService;VPNGuardService;c:\program files\OPSWAT\VPNGuard\VPNGuardService.exe [2007-10-23 299008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-08-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 12:11]

2010-08-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-01 15:05]

2010-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb0ceb245f0d00.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 00:13]

2010-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 00:13]

2010-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1596938837-54953107-2832527327-1000Core.job
- c:\users\Sam\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-04 16:25]

2010-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1596938837-54953107-2832527327-1000UA.job
- c:\users\Sam\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-04 16:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/home.php
uInternet Settings,ProxyOverride = <local>;*.local
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
FF - ProfilePath - c:\users\Sam\AppData\Roaming\Mozilla\Firefox\Profiles\0a3jjibc.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-Wdf01000.sys

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-21 20:05
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1596938837-54953107-2832527327-1000\Software\G*e*n*i*e*"!\FM Genie Scout 2009 XE]
"GameDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009\\games"
"ShortlistDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009\\shortlists"
"ScreenshotsDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009"
"SaveDir"="c:\\Users\\Sam\\Documents\\Sports Interactive\\Football Manager 2009\\"
"HistoryDir"="c:\\Users\\Sam\\Desktop\\fm_genie_scout_2009_xe\\FM Genie Scout 2009 XE\\History Points"
"LangDB"=""
"LastSaveGame"=""
"Language"="English"
"LoadLangDB"=dword:00000000
"CompressHistoryPoints"=dword:00000000
"HighlightedAttributes"=dword:00000000
"MinCondition"=dword:00000050
"SkinName"="Champions League"
"LastUpdateCheck"=dword:00000000
"HighQualityGUI"=dword:00000001
"AutomaticallyUpdateCheck"=dword:00000001
"AdvancedGeneration"=dword:00000000
"TranslateStaffSkills"=dword:00000001
"TranslatePlayerSkills"=dword:00000001
"TranslatePositions"=dword:00000001
"ShowHistory"=dword:00000001
"Version"=dword:00000066
"UniqueID"="B5-A280-E07F"
"Currency"=dword:00000056
"UseProxy"=dword:00000000
"ProxyHost"=""
"ProxyPort"=""
"UseAuthentication"=dword:00000000
"UserName"=""
"UserPassword"=""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Kontiki\KService.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\ehome\ehmsas.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\HidFind.exe
c:\program files\DellTPad\Apntex.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-08-21 20:20:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-21 19:20
ComboFix2.txt 2010-08-20 21:16

Pre-Run: 100,562,534,400 bytes free
Post-Run: 100,381,708,288 bytes free

- - End Of File - - F83008A7FBBABA59E03331216A7EB905

Jacee · Aug 22, 2010

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says "Java Runtime Environment (JRE) 6u21 allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u21-windows-i586-p.exe to install the newest version.

After you have done this, please run an online scan with Kaspersky. (works only
with MS Internet Explorer ).
http://www.kaspersky.com/kos/english/kavwebscan.html
1. click the "Accept" button to
accept the user agreement, install the ActiveX control, and download the
program.
2. When you get the Windows dialog asking if you want to install this
software, click the "Install" button.
3. When the "Update progress" line changes to "Ready" and the
"NEXT ->" button lights up with a
green arrow, click it.
4. Click on the "Scan Settings" button, and in the next window
select the "extended" database, and click Ok.
5. Under "Please select a target to scan:", click My Computer
to start the scan.
6. When the scan is finished, click the "Save as .txt" button, and
save the file as kavscan.txt to your Desktop, close the Kaspersky On-line
Scanner window, and post the text in kavscan.txt in your next reply.
Please restart your system, and post the log from Kaspersky's on-line virus scan.

shug99 · Aug 22, 2010

I have updated java as told to but i cant run kaspersky online scanner as it won't update itself. I get an error saying "Update process FAILED! No further antivirus actions can be performed!
Attention, you must be online to activate Kasperky On-line Scanner..." It also ends with "[ERROR: Key is expired" which seems odd to me.
As it stands, my computers performance is still not improved. Do you still think its malware related or something like that?

Jacee · Aug 22, 2010

Some people have a problem running Kaspersky, I don't know why.

Let's see if you can run Eset Free ESET Online Antivirus Scanner
Be sure to save the log and post the results back here.

shug99 · Aug 23, 2010

Right, I have tried ESET Scanner, but it hangs when it runs. Tried it twice now and made sure that no other anti virus programs etc are running at the same time and both times have made my computer fully freeze and had to do a manual restart.

Is there a third online scanner i can try?

Jacee · Aug 23, 2010

Try Panda FREE ANTIVIRUS Online - Download ActiveScan 2.0 and clean your PC - PANDA SECURITY?

shug99 · Aug 24, 2010

Hi, right im having some real problems with running PANDA online scanner. I have ran it twice now (maybe even 3 times) as a full scan and once a quick scan. Quick scan completed and found nothing. However The full scan does find infections, 6 as i count but the full scan never finishes. Every time i have tried it it eventually freezes my computer, first of all leaving me with the use of the mouse but not being able to do anything at all, and then after a while the mouse freezes as well, leaving me with no choice but to manually restart.

I have no idea what is causing this as nothing else is even running when the scan is. All i can gather is that the panda scan is finding infections that my AVIRA full scan doesnt but i can never get as far as being given the log in order to find out what files are causing the 6 infections. This is maybe a help as it proves that their are infections but im stuck as how to know where they are.

Is downloading a different free anti virus something worth doing and seeing if that will pick up the infections that PANDA is able to? On the same note, do the members on this forum favour a particular free anti-virus which i should try?

Cheers, and thanks for all your helps so far. This is a great forum.

elton-77 · Aug 25, 2010

I know you have Avast antivirus but it is not the current version 5.0.594. Maybe you could try downloading the latest and run a boot time scan with that.

shug99 · Aug 25, 2010

I currently have AVIRA, not Avast. Should I give Avast or AVG a try?

I also have Ad-Aware. Does anyone favour an alternative that i should try instead of that?

elton-77 · Aug 25, 2010

Oh sorry, I had searched the thread and saw a reference to AVAST in one of your scans [reply #64] so assumed you had it.

I have found Avast to be brilliant [no doubt others may disagree] so it may be worth a go.

shug99 · Aug 25, 2010

So i have tried Avast. Was having problems yet again in running scans and the computer freezing so went for a boot scan. This took aaaaaaaages and I mean ages. Probably close to 6 or more hours and it found only one thing which i do not believe to have caused any problems. Once that started up i am getting text in the bottom right of my screen which says:

"Windows Vista
Build 6002
This Copy of windows is not genuine"

My copy of vista is 100% legit and one thread on this forum said its likely to be caused by malware.

A virus or malware must be the issue. Can anyone shed any light on how to get rid of whatever it is.

So far:

Avira - made no difference using any scan
Avast - not made any difference using the boot scan
Malwarebytes - not found much and certainly hasnt fixed the problem
PANDA online scanner - found around 6 infections but was never able to complete the scan to let me know what the infections were.
Various programs recommended in this thread - used all of them as directed yet problem still persists

Nothing as of yet has worked and problem of reduced performance still exists.

Thanks, however for all the help i have been given so far.

Jacee · Aug 25, 2010

Have you tried a repair install or startup repair?

Repair Install:
http://www.vistax64.com/tutorials/88236-repair-install-vista.html

Startup repair:
http://www.vistax64.com/tutorials/91467-startup-repair.html?ltr=S

shug99 · Aug 26, 2010

I havent no, which of the 2 should i try?

Jacee · Aug 26, 2010

Try the startup repair first.

shug99 · Aug 26, 2010

Strangely, my computer has been running fine today. Ram seems high a little but from what iv gathered its not a problem and in terms of how its been running, its been great today.

I will hold off on doing anything else for now.

Once again guys, thanks very much for all your help with this matter. If any problems happen over the next week, I shall post. Otherwise, I would assume the problem has gone.

Computer not been right since Windows update

Banned

My Computer

My Computer

Security

My Computer

My Computer

Security

My Computer

My Computer

Security

My Computer

My Computer

Security

My Computer

My Computer

Security

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

Security

My Computer

My Computer

Security

My Computer

My Computer