Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HJT Log (for another computer with problems)


  • This topic is locked This topic is locked
7 replies to this topic

#1 mmmartie

mmmartie

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:03:07 AM

Posted 03 December 2008 - 11:40 PM

Got some great help here last time, so I'm back.

Dad's computer has been slow & freezing up lately. It's got XP SP3 Media Center Edition and McAfee Total Protection. Threatfire is also installed as extra precaution. I downloaded Malware Bytes and SuperAntiSpyware. They didn't turn up anything horrible except a ton of cookies and Zango adware. The Zango appears to be gone. I deleted all temp internet files, history, & cookies. Ran Dell Diagnostics, checked hardware for errors, & defragmented. Also got rid of some programs that were not being used. I haven't tried a system restore because I don't know how long it's been acting up for (I think it's been awhile).

Today the computer has been worse than ever. Can't do much of anything with IE, it freezes up & sometimes opens up multiple windows, then freezes up. Often it just opens up a blank white window with the toolbars at the top (blank address bar). I can't uninstall or fix IE and I can't upgrade to the new beta.

If I click on various icons on the desktop (even if I right click on them) Nuance PDF installation starts. So something strange is definitely going on. Apparently Tool-NirCmd PUP was blocked & quarantined by both Threatfire & McAfee today.

Thanks for any help,
Lisa


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:09 AM, on 12/4/2008
Platform: Windows XP SP3, v.3244 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.3244)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Nuance\PDF Professional 5\PDFProFiltSrv.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Nuance\PDF Professional 5\pdfpro5hook.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06c\BrStDvPt.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE"
O4 - HKLM\..\Run: [PDFHook] C:\Program Files\Nuance\PDF Professional 5\pdfpro5hook.exe
O4 - HKLM\..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Professional 5\RegistryController.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [Nuance PDF Professional 5-reminder] "C:\Program Files\Nuance\PDF Professional 5\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\Nuance\PDF Professional 5\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Create PDF file - res://C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
O8 - Extra context menu item: Create PDF file from the content of the link - res://C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
O8 - Extra context menu item: Create PDF files from the selected links - res://C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open with Nuance PDF Converter 5.0 - res://C:\Program Files\Nuance\PDF Professional 5\cnvres_eng.dll /100
O8 - Extra context menu item: Open with Scansoft PDF Converter 3.0 - res://C:\Program Files\ScanSoft\PDF Professional 3.0\IEShellExt.dll /100
O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1187903625285
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1187903736988
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PDFProFiltSrv - Nuance Communications, Inc. - C:\Program Files\Nuance\PDF Professional 5\PDFProFiltSrv.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

--
End of file - 12844 bytes

BC AdBot (Login to Remove)

 


#2 Tomk_

Tomk_

    Malware Eradicator


  • Malware Response Team
  • 686 posts
  • OFFLINE
  •  
  • Local time:11:07 PM

Posted 10 December 2008 - 08:09 PM

Hi mmmartie,

Welcome to Bleeping Computers

My name is Tomk_. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, feel free to create a new one.
I apologize for the delay in response. We get overwhelmed at times but we are trying our best to keep up.

Nothing is showing. Let's get an online scan. It takes a couple hours to run so be prepared.

Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.

Posted Image

#3 mmmartie

mmmartie
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:03:07 AM

Posted 11 December 2008 - 03:12 AM

Thank you for taking the time to help me.

Like several other scanners, Kaspersky detected no malware! There was nothing in the report.

I just don't understand...I thought something would show up somewhere. I don't know what else would cause some of the problems that have been happening.

#4 Tomk_

Tomk_

    Malware Eradicator


  • Malware Response Team
  • 686 posts
  • OFFLINE
  •  
  • Local time:11:07 PM

Posted 11 December 2008 - 11:52 AM

mmmartie,

Let's run another scan (much quicker than Kaspersky). Once in awhile it picks up an oddball.

Disable resident protections (Antivirus...); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Posted Image

#5 mmmartie

mmmartie
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:03:07 AM

Posted 11 December 2008 - 01:42 PM

--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3, v.3244
X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A04
USER : John ( Administrator )
BOOT : Normal boot
Antivirus : McAfee VirusScan (Not Activated)
Firewall : McAfee Personal Firewall (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:144 Go (Free:127 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Thu 12/11/2008|14:17 )

--------------------\\ Listing folders in APPLIC~1

[04/13/2008|10:22] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> AVG7
[04/13/2008|05:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Grisoft
[08/16/2005|06:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Identities
[03/12/2006|01:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Macromedia
[11/13/2008|05:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Malwarebytes
[04/13/2008|10:34] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Microsoft
[03/12/2006|01:36] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Sun
[12/03/2008|01:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> SUPERAntiSpyware.com
[03/12/2006|01:42] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> You've Got Pictures Screensaver

[05/30/2008|09:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe
[08/22/2007|09:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> AOL
[04/13/2008|10:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> avg7
[07/07/2008|03:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Borland
[01/30/2008|11:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Brother
[07/07/2008|03:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Corel
[02/25/2008|10:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Dell
[08/16/2005|10:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> DIGStream
[03/24/2008|03:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Google
[11/13/2008|12:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Google Updater
[04/13/2008|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Grisoft
[03/12/2006|01:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> GTek
[03/12/2006|01:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> InstallShield
[09/20/2008|05:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Lavasoft
[11/12/2008|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes
[10/01/2008|06:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> McAfee
[08/23/2007|09:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> McAfee.com
[05/30/2008|09:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft
[12/11/2008|04:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft Help
[07/07/2008|03:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Nuance
[10/16/2008|02:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PC Tools
[08/25/2007|07:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> QuickTime
[07/07/2008|03:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> ScanSoft
[10/01/2008|06:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SiteAdvisor
[03/12/2006|01:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Sonic
[11/12/2008|09:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SUPERAntiSpyware.com
[12/28/2007|02:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SupportSoft
[12/11/2008|02:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TEMP
[08/23/2007|05:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage
[08/23/2007|06:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Live Toolbar
[01/27/2008|03:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> zeon

[08/16/2005|06:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Identities
[03/12/2006|01:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Macromedia
[03/12/2006|01:42] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft
[03/12/2006|01:36] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Sun
[03/12/2006|01:42] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> You've Got Pictures Screensaver

[02/21/2008|12:16] C:\DOCUME~1\John\APPLIC~1\<DIR> Adobe
[08/31/2007|11:28] C:\DOCUME~1\John\APPLIC~1\<DIR> AdobeUM
[03/31/2008|11:03] C:\DOCUME~1\John\APPLIC~1\<DIR> Brother
[07/14/2008|09:43] C:\DOCUME~1\John\APPLIC~1\<DIR> Corel
[03/17/2008|08:33] C:\DOCUME~1\John\APPLIC~1\<DIR> Google
[05/30/2008|06:07] C:\DOCUME~1\John\APPLIC~1\<DIR> Grisoft
[08/23/2007|07:19] C:\DOCUME~1\John\APPLIC~1\<DIR> Gtek
[12/04/2008|12:00] C:\DOCUME~1\John\APPLIC~1\<DIR> Help
[08/16/2005|06:50] C:\DOCUME~1\John\APPLIC~1\<DIR> Identities
[08/23/2007|08:56] C:\DOCUME~1\John\APPLIC~1\<DIR> Jasc Software Inc
[03/12/2006|01:47] C:\DOCUME~1\John\APPLIC~1\<DIR> Macromedia
[11/13/2008|03:37] C:\DOCUME~1\John\APPLIC~1\<DIR> Malwarebytes
[08/23/2007|07:19] C:\DOCUME~1\John\APPLIC~1\<DIR> McAfee
[04/13/2008|10:34] C:\DOCUME~1\John\APPLIC~1\<DIR> Microsoft
[02/03/2008|03:04] C:\DOCUME~1\John\APPLIC~1\<DIR> Microsoft Web Folders
[11/13/2008|02:12] C:\DOCUME~1\John\APPLIC~1\<DIR> Mozilla
[03/01/2008|12:35] C:\DOCUME~1\John\APPLIC~1\<DIR> PC-FAX TX
[10/30/2008|08:38] C:\DOCUME~1\John\APPLIC~1\<DIR> Real
[03/12/2006|01:36] C:\DOCUME~1\John\APPLIC~1\<DIR> Sun
[11/18/2008|09:56] C:\DOCUME~1\John\APPLIC~1\<DIR> SUPERAntiSpyware.com
[12/06/2008|03:18] C:\DOCUME~1\John\APPLIC~1\<DIR> U3
[03/12/2006|01:42] C:\DOCUME~1\John\APPLIC~1\<DIR> You've Got Pictures Screensaver
[02/15/2008|03:40] C:\DOCUME~1\John\APPLIC~1\<DIR> Zeon

[08/23/2007|07:55] C:\DOCUME~1\Linda\APPLIC~1\<DIR> GTek
[03/12/2006|01:47] C:\DOCUME~1\Linda\APPLIC~1\<DIR> Macromedia
[08/23/2007|09:01] C:\DOCUME~1\Linda\APPLIC~1\<DIR> Microsoft

[04/27/2008|11:18] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Adobe
[04/23/2008|07:44] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Brother
[11/18/2007|08:17] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Corel Photo Album
[03/14/2008|10:53] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Google
[08/25/2007|09:34] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> GTek
[08/16/2005|06:50] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Identities
[03/12/2006|01:47] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Macromedia
[12/01/2008|09:27] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Malwarebytes
[04/13/2008|10:34] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Microsoft
[11/02/2008|10:59] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Real
[03/12/2006|01:36] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Sun
[11/18/2008|12:56] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> SUPERAntiSpyware.com
[03/12/2006|01:42] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> You've Got Pictures Screensaver
[05/16/2008|08:14] C:\DOCUME~1\LINDA~1.DEL\APPLIC~1\<DIR> Zeon

[03/30/2008|11:53] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Adobe
[04/13/2008|10:31] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> AVG7
[01/31/2008|12:09] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Brother
[07/07/2008|03:21] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Corel
[10/27/2007|04:49] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Corel Photo Album
[03/24/2008|03:03] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Google
[08/23/2007|05:51] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Gtek
[08/16/2005|06:50] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Identities
[08/22/2007|09:42] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Leadertech
[08/23/2007|09:01] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Macromedia
[11/12/2008|09:51] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Malwarebytes
[04/01/2008|11:56] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> McAfee
[07/07/2008|03:30] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Microsoft
[11/12/2008|09:10] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Move Networks
[11/13/2008|12:23] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Mozilla
[11/12/2008|09:56] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> MSNInstaller
[01/30/2008|11:50] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> PC-FAX TX
[11/12/2008|09:04] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Real
[08/22/2007|09:42] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Sonic
[03/12/2006|01:36] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Sun
[11/12/2008|09:59] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> SUPERAntiSpyware.com
[04/13/2008|04:17] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> U3
[03/12/2006|01:42] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> You've Got Pictures Screensaver
[02/15/2008|03:23] C:\DOCUME~1\Lisa\APPLIC~1\<DIR> Zeon

[04/13/2008|10:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> AVG7
[09/17/2007|12:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Help
[11/19/2007|02:11] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Macromedia
[04/13/2008|10:34] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft
[11/30/2008|12:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> SACore

[04/13/2008|05:06] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> AVG7
[04/13/2008|10:34] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[10/15/2008 12:00 AM][--a------] C:\WINDOWS\tasks\McDefragTask.job
[09/01/2008 12:00 AM][--a------] C:\WINDOWS\tasks\McQcTask.job
[12/11/2008 02:08 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT
[08/10/2004 07:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[09/01/2008|02:40] C:\Program Files\<DIR> Adobe
[12/06/2008|03:45] C:\Program Files\<DIR> ATI Technologies
[01/30/2008|11:18] C:\Program Files\<DIR> Brother
[01/30/2008|11:12] C:\Program Files\<DIR> BrotherFax2480
[12/03/2008|02:19] C:\Program Files\<DIR> Common Files
[03/12/2006|01:25] C:\Program Files\<DIR> CONEXANT
[07/07/2008|03:07] C:\Program Files\<DIR> Corel
[08/22/2007|09:23] C:\Program Files\<DIR> Dell
[08/23/2007|08:53] C:\Program Files\<DIR> Dell AIO 810
[12/28/2007|02:12] C:\Program Files\<DIR> Dell Support Center
[08/23/2007|05:27] C:\Program Files\<DIR> DellSupport
[01/28/2008|04:08] C:\Program Files\<DIR> DIFX
[03/12/2006|01:41] C:\Program Files\<DIR> Digital Line Detect
[11/28/2008|01:07] C:\Program Files\<DIR> Dl_cats
[08/16/2005|10:54] C:\Program Files\<DIR> ESPNMotion
[12/06/2008|03:45] C:\Program Files\<DIR> InstallShield Installation Information
[03/12/2006|01:40] C:\Program Files\<DIR> Intel
[12/02/2008|03:06] C:\Program Files\<DIR> Internet Explorer
[12/03/2008|12:21] C:\Program Files\<DIR> Java
[12/03/2008|12:47] C:\Program Files\<DIR> Lavasoft
[11/12/2008|09:51] C:\Program Files\<DIR> Malwarebytes' Anti-Malware
[12/10/2008|11:38] C:\Program Files\<DIR> McAfee
[08/23/2007|09:37] C:\Program Files\<DIR> McAfee.com
[12/03/2008|01:25] C:\Program Files\<DIR> Messenger
[01/28/2008|02:09] C:\Program Files\<DIR> Microsoft ActiveSync
[03/12/2006|01:47] C:\Program Files\<DIR> Microsoft Digital Image 2006
[08/16/2005|06:43] C:\Program Files\<DIR> microsoft frontpage
[04/13/2008|04:49] C:\Program Files\<DIR> Microsoft Malware Removal
[02/15/2008|03:33] C:\Program Files\<DIR> Microsoft Office
[03/12/2006|01:43] C:\Program Files\<DIR> Microsoft Plus! Digital Media Edition
[12/03/2008|01:29] C:\Program Files\<DIR> Microsoft Silverlight
[02/15/2008|02:49] C:\Program Files\<DIR> Microsoft Visual Studio
[05/30/2008|08:59] C:\Program Files\<DIR> Microsoft Works
[03/12/2006|01:45] C:\Program Files\<DIR> Microsoft Works Suite 2006
[02/15/2008|02:47] C:\Program Files\<DIR> Microsoft.NET
[12/06/2008|03:47] C:\Program Files\<DIR> Modem Helper
[12/02/2008|03:06] C:\Program Files\<DIR> Movie Maker
[12/11/2008|02:11] C:\Program Files\<DIR> Mozilla Firefox
[01/27/2008|02:44] C:\Program Files\<DIR> MSBuild
[08/16/2005|06:37] C:\Program Files\<DIR> MSN Gaming Zone
[02/01/2008|08:38] C:\Program Files\<DIR> MSN Messenger
[08/23/2007|06:23] C:\Program Files\<DIR> MSXML 4.0
[02/01/2008|08:17] C:\Program Files\<DIR> NetMeeting
[03/12/2006|01:41] C:\Program Files\<DIR> NetWaiting
[07/07/2008|03:33] C:\Program Files\<DIR> Nuance
[08/16/2005|06:38] C:\Program Files\<DIR> Online Services
[02/01/2008|08:17] C:\Program Files\<DIR> Outlook Express
[12/05/2008|04:01] C:\Program Files\<DIR> Panda Security
[03/12/2006|01:42] C:\Program Files\<DIR> QuickTime
[03/12/2006|01:41] C:\Program Files\<DIR> Real
[01/28/2008|03:22] C:\Program Files\<DIR> RGB
[03/12/2006|01:50] C:\Program Files\<DIR> Roxio
[01/27/2008|03:45] C:\Program Files\<DIR> ScanSoft
[03/12/2006|01:39] C:\Program Files\<DIR> Sigmatel
[03/12/2006|01:50] C:\Program Files\<DIR> Sonic
[11/12/2008|09:59] C:\Program Files\<DIR> SUPERAntiSpyware
[08/23/2007|08:19] C:\Program Files\<DIR> The Weather Channel FW
[08/23/2007|07:12] C:\Program Files\<DIR> TheWeatherNetwork
[11/26/2008|02:58] C:\Program Files\<DIR> ThreatFire
[12/02/2008|03:28] C:\Program Files\<DIR> Trend Micro
[08/23/2007|06:36] C:\Program Files\<DIR> Uninstall Information
[03/12/2006|01:44] C:\Program Files\<DIR> WebCyberCoach
[08/23/2007|07:07] C:\Program Files\<DIR> Windows Live Toolbar
[12/02/2008|03:17] C:\Program Files\<DIR> Windows Media Connect 2
[12/02/2008|12:38] C:\Program Files\<DIR> Windows Media Player
[02/01/2008|08:17] C:\Program Files\<DIR> Windows NT
[08/16/2005|06:37] C:\Program Files\<DIR> Windows Plus
[08/16/2005|06:43] C:\Program Files\<DIR> xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[03/24/2008|03:10] C:\Program Files\Common Files\<DIR> Adobe
[08/22/2007|09:23] C:\Program Files\Common Files\<DIR> AOL
[07/07/2008|03:02] C:\Program Files\Common Files\<DIR> Borland Shared
[07/07/2008|03:01] C:\Program Files\Common Files\<DIR> Corel
[01/28/2008|02:09] C:\Program Files\Common Files\<DIR> Designer
[01/30/2008|11:18] C:\Program Files\Common Files\<DIR> InstallShield
[08/23/2007|08:55] C:\Program Files\Common Files\<DIR> Jasc Software Inc
[03/12/2006|01:35] C:\Program Files\Common Files\<DIR> Java
[02/23/2008|09:48] C:\Program Files\Common Files\<DIR> McAfee
[07/07/2008|03:32] C:\Program Files\Common Files\<DIR> Microsoft Shared
[08/16/2005|06:40] C:\Program Files\Common Files\<DIR> MSSoap
[03/12/2006|01:42] C:\Program Files\Common Files\<DIR> Nullsoft
[09/06/2007|05:54] C:\Program Files\Common Files\<DIR> ODBC
[07/07/2008|03:05] C:\Program Files\Common Files\<DIR> Protexis
[01/27/2008|05:32] C:\Program Files\Common Files\<DIR> Pure Networks Shared
[11/13/2008|12:29] C:\Program Files\Common Files\<DIR> Real
[03/12/2006|01:40] C:\Program Files\Common Files\<DIR> Roxio Shared
[07/07/2008|03:35] C:\Program Files\Common Files\<DIR> ScanSoft Shared
[08/16/2005|06:40] C:\Program Files\Common Files\<DIR> Services
[10/19/2007|08:18] C:\Program Files\Common Files\<DIR> Sonic Shared
[08/16/2005|06:33] C:\Program Files\Common Files\<DIR> SpeechEngines
[12/28/2007|02:11] C:\Program Files\Common Files\<DIR> supportsoft
[02/15/2008|03:33] C:\Program Files\Common Files\<DIR> System
[03/12/2006|01:50] C:\Program Files\Common Files\<DIR> TiVo Shared
[12/03/2008|12:47] C:\Program Files\Common Files\<DIR> Wise Installation Wizard
[10/30/2008|08:03] C:\Program Files\Common Files\<DIR> xing shared

--------------------\\ Process

( 63 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN


--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-11 14:22:18
Windows 5.1.2600 Service Pack 3, v.3244 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections


No other infections found !

[F:964][D:14]-> C:\DOCUME~1\John\LOCALS~1\Temp
[F:23][D:0]-> C:\DOCUME~1\John\Cookies
[F:6][D:4]-> C:\DOCUME~1\John\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Thu 12/11/2008|14:24 - Option : [1]

--------------------\\ Scan completed at 14:24:18

#6 Tomk_

Tomk_

    Malware Eradicator


  • Malware Response Team
  • 686 posts
  • OFFLINE
  •  
  • Local time:11:07 PM

Posted 11 December 2008 - 01:55 PM

mmmartie,

It definately seems that something is going on, However, it doesn't appear to be malware related so there isn't really much I can do for you. I suggest you post in the Windows forum and see if a Tech person can do something for you.

A little cleanup. Files aren't "bad" but not needed at startup. Might speed you up a little.
  • Please open HijackThis and run Do a system scan only
  • Check the boxes next to ONLY the entries listed below(if present):
    • R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
      O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06c\BrStDvPt.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
      O4 - HKLM\..\Run: [Nuance PDF Professional 5-reminder] "C:\Program Files\Nuance\PDF Professional 5\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\Nuance\PDF Professional 5\Ereg\Ereg.ini"
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  • Close all programs except for HijackThis.
  • Click on Fix checked
  • A box will pop up asking you if you wish to fix the selected items. Please choose YES.
  • Once it has fixed them, please exit/close HijackThis.
Log looks good :D

You can delete LOP S&D

The following are standard reccomendations. Utilize what you can. Pat yourself on the back for what you're already doing.

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up... button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:
  • From your desktop, right-click on My Computer,
  • click on Properties
  • Select the Automatic Updates tab
  • Click on Automatic
  • Click on Apply button
  • Click on OK to exit.
If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol


Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.


Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Posted Image

#7 mmmartie

mmmartie
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:03:07 AM

Posted 14 December 2008 - 01:24 PM

Thank you for your help. I have printed off your suggestions; the ones that I can't seem to do now, due to this crazy computer, I will do when everything is back to normal. I will post in the Windows forum.

Thanks again!
Lisa

#8 Tomk_

Tomk_

    Malware Eradicator


  • Malware Response Team
  • 686 posts
  • OFFLINE
  •  
  • Local time:11:07 PM

Posted 14 December 2008 - 01:37 PM

mmmartie,

You are very welcome!

Glad we could help.

Have a Merry Christmas Posted Image

Good Luck and Be Well. :thumbsup:

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users