Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


IE 8 and firefox crash after 5 sec.

  • This topic is locked This topic is locked
2 replies to this topic

#1 fnbisson


  • Members
  • 1 posts
  • Local time:09:27 PM

Posted 09 December 2010 - 12:02 PM

Greetings, I scanned my computer with malwarebytes and superantispyware. I deleted the detected spyware but I still have trouble to open IE 8 and Firefox. The application crash after 5 seconds and I ahve an event ID 1000 in my event log isn't saying much more.

Can you help me out with this ? Thanks

This is the malwarebytes log:

Malwarebytes' Anti-Malware 1.50

Version de la base de donnÈes: 5263

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

07/12/10 5:16:40 PM
mbam-log-2010-12-07 (17-16-40).txt

Type d'examen: Examen complet (C:\|)
ElÈment(s) analysÈ(s): 237649
Temps ÈcoulÈ: 1 heure(s), 31 minute(s), 17 seconde(s)

Processus mÈmoire infectÈ(s): 0
Module(s) mÈmoire infectÈ(s): 0
ClÈ(s) du Registre infectÈe(s): 0
Valeur(s) du Registre infectÈe(s): 0
ElÈment(s) de donnÈes du Registre infectÈ(s): 1
Dossier(s) infectÈ(s): 0
Fichier(s) infectÈ(s): 0

Processus mÈmoire infectÈ(s):
(Aucun ÈlÈment nuisible dÈtectÈ)

Module(s) mÈmoire infectÈ(s):
(Aucun ÈlÈment nuisible dÈtectÈ)

ClÈ(s) du Registre infectÈe(s):
(Aucun ÈlÈment nuisible dÈtectÈ)

Valeur(s) du Registre infectÈe(s):
(Aucun ÈlÈment nuisible dÈtectÈ)

ElÈment(s) de donnÈes du Registre infectÈ(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn (PUM.Hijack.Desktop) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infectÈ(s):
(Aucun ÈlÈment nuisible dÈtectÈ)

Fichier(s) infectÈ(s):
(Aucun ÈlÈment nuisible dÈtectÈ)

There is my Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:39:02 AM, on 09/12/10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files\Galileo\SSL\SSLClientService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com...DT/040C/bl8.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKLM\..\Run: [KAVWks50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 5.0 for Windows Workstations\kav.exe" /minimize /chkas
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE R…SEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Focalpoint.lnk = C:\FP\SWDIR\Fplogon.exe
O4 - Global Startup: Print Manager.lnk = C:\My Documents\Focalpoint PM\Host.gsa
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124714701203
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.ado...obat/nos/gp.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://rbcinsurance...ent/ieatgpc.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://walmart.pnime...upv2.0.0.9.cab?
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = voyagesparadis.int
O17 - HKLM\Software\..\Telephony: DomainName = voyagesparadis.int
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = voyagesparadis.int
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = voyagesparadis.int
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: AutorunsDisabled - Invalid registry found
O22 - SharedTaskScheduler: PrÈ-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: DÈmon de cache des catÈgories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des ÈvÈnements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: Galileo SSL Tunnel - Galileo International - C:\Program Files\Galileo\SSL\SSLClientService.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 5.0 for Windows Workstations\kavsvc.exe
O23 - Service: Partage de Bureau ‡ distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau ‡ distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte ‡ puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: ClichÈ instantanÈ de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O24 - Desktop Component 0: Voyages Paradis ñ croisiËres, destinations soleil, europe de líest, voyages de groupes, autocar - http://www.voyagesparadis.com/

End of file - 6509 bytes


DDS (Ver_10-12-05.01) - NTFSx86
Run by mjparadis at 9:52:17.48 on 09/12/10
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1015.505 [GMT -5:00]

AV: Kaspersky Anti-Virus for Windows Workstations *On-access scanning enabled* (Updated) {816CD617-99F4-4B18-828E-80582E4B044D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Galileo\SSL\SSLClientService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\mjparadis\Bureau\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mSearch Bar = hxxp://go.compaq.com/1Q00CDT/040C/bl8.asp
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: AutorunsDisabled - No File
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [KAVWks50] "c:\program files\kaspersky lab\kaspersky anti-virus 5.0 for windows workstations\kav.exe" /minimize /chkas
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menudm~1\progra~1\dmarra~1\focalp~1.lnk - c:\fp\swdir\Fplogon.exe
StartupFolder: c:\docume~1\alluse~1\menudm~1\progra~1\dmarra~1\printm~1.lnk - c:\my documents\focalpoint pm\Host.gsa
uPolicies-system: Wallpaper = \\srv-w2k3\gpstuff$\logo_vp.gif
uPolicies-system: WallpaperStyle = 0
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
Trusted Zone: go.com\disneyworld.disney
Trusted Zone: softvoyage.com\secured
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124714701203
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://rbcinsurance.webex.com/client/T25L/event/ieatgpc.cab
DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} - hxxp://walmart.pnimedia.com/upload/activex/v2_0_0_9/PCAXSetupv2.0.0.9.cab?
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AutorunsDisabled igfxsrvc.dll - PCANotify.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\mjpara~1\applic~1\mozilla\firefox\profiles\snsjj4ul.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://WWW.VOYAGESPARADIS.COM
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 klif;KLIF driver;c:\windows\system32\drivers\klif.sys [2006-7-12 139024]
R1 klmc;KLMC driver;c:\windows\system32\drivers\klmc.sys [2006-7-12 14803]
R2 Galileo SSL Tunnel;Galileo SSL Tunnel;c:\program files\galileo\ssl\SSLClientService.exe [2010-4-23 24576]
R2 kavsvc;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky anti-virus 5.0 for windows workstations\kavsvc.exe [2006-7-12 1138794]
S4 gupdate;Service Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-20 135664]
S4 mv2;mv2;c:\windows\system32\drivers\mv2.sys [2009-12-2 10688]
S4 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
S4 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
S4 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-11-4 6016]

=============== Created Last 30 ================

2010-12-09 14:26:28 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-12-09 13:55:55 -------- dc-h--w- c:\windows\ie8
2010-12-09 13:48:21 388096 ----a-r- c:\docume~1\mjpara~1\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2010-12-09 13:48:21 -------- d-----w- c:\program files\Trend Micro
2010-12-08 16:31:58 -------- d-----w- c:\docume~1\mjpara~1\applic~1\SUPERAntiSpyware.com
2010-12-08 16:31:58 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-12-08 16:31:28 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-12-07 19:20:09 -------- d-----w- c:\docume~1\mjpara~1\applic~1\Malwarebytes
2010-12-07 19:19:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-07 19:19:58 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-12-07 19:19:54 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-07 19:19:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-03 19:35:53 -------- d-----w- c:\program files\RealVNC
2010-11-23 20:26:14 -------- d-----w- c:\docume~1\mjpara~1\locals~1\applic~1\mciMapmon2
2010-11-16 17:05:15 -------- d-----w- c:\docume~1\mjpara~1\applic~1\gnupg
2010-11-16 17:04:05 -------- d-----w- C:\GnuPG

==================== Find3M ====================

2010-09-18 16:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53:24 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53:24 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53:24 953856 ----a-w- c:\windows\system32\mfc40u.dll

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST340014A rev.8.11 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86328446]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8632e504]; MOV EAX, [0x8632e580]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x86353AB8]
3 CLASSPNP[0xF764AFD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\0000005a[0x863D5258]
5 ACPI[0xF75C0620] -> nt!IofCallDriver[0x804E37D5] -> [0x863E2140]
\Driver\atapi[0x863C9F38] -> IRP_MJ_CREATE -> 0x86328446
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x137; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST340014A_______________________________8.11____#4a354a5835353036202020202020202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x86328292
user != kernel MBR !!!
copy of MBR has been found in sector 2 !
sectors 78165358 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

============= FINISH: 9:53:41.35 ===============

Security check LOG

Results of screen317's Security Check version 0.99.6
Windows XP Service Pack 3
Internet Explorer 8
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Kaspersky Anti-Virus for Windows Workstations
WMI entry may not exist for antivirus; attempting automatic update.
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ SE Runtime Environment 6 Update 1
Java 2 Runtime Environment, SE v1.4.2_01
Adobe Flash Player
Adobe Reader 9.1.3
Out of date Adobe Reader installed!
Mozilla Firefox (1.0.3) Firefox Out of Date!
Process Check:
objlist.exe by Laurent
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

BC AdBot (Login to Remove)


#2 rigacci



  • Members
  • 2,604 posts
  • Gender:Male
  • Local time:10:27 PM

Posted 16 December 2010 - 08:41 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log



#3 thcbytes


  • Malware Response Team
  • 14,790 posts
  • Gender:Male
  • Local time:09:27 PM

Posted 16 April 2011 - 04:35 PM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost!


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users