Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google results redirected


  • Please log in to reply
7 replies to this topic

#1 sosumql

sosumql

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:01 PM

Posted 06 July 2011 - 08:27 PM

Hi,

I'm having Google search results redirected, after stupidly allowing a unknown program run. That program was at the temp directory and I ran it thinking it was either Flash or Google Toolbar update. The request for permission to run did pop up unexpectedly.

My computer is Win 7 Home Premium, using IE 9 and Firefox 5, Norton Antivirus.

I've ran:
1. Norton Antivirus, which returns nothing
2. Norton Power Eraser, which actually removed "c:\windows\syswow64\api-ms-win-core-misc-|1-1-032.dll", "c:\windows\syswow64\api-ms-win-core-misc-|1-1-032.exe", and "c:\windows\syswow64\dpwsockx32.exe"
3. RKill, which closed a program called "c:\windows\syswow64\grpconv.exe" besides itself
4. Malwarebytes' Anti-Malware, deleted these: "C:\Users\William\AppData\Local\Temp\0.4857966491254463.exe", "C:\Users\William\AppData\Local\Temp\0.6898134147286739.exe", and "C:\Users\William\AppData\Local\Temp\msiexec.exe"

Am I still infected?

Thanks!

BC AdBot (Login to Remove)

 


#2 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:05:01 PM

Posted 09 July 2011 - 03:58 PM

Hi sosumql,

:welcome: to BleepingComputer.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

My name is Jason and I'll be helping you with your computer problems. You can call me by my screename jntkwx or Jason is fine.

Some things to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • Please do not attach logs or put logs in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can also help.
  • Do not run anything while running a fix.
  • If you don't understand a step, please ask for clarification before continuing with any future steps.

Click on the Watch Topic button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

:step1: Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt.
  • Please post the contents of that document.

:step2: Please download MiniToolBox by Farbar and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List last 10 Event Viewer log
  • List Users, Partitions and Memory size
Click Go and post the result.

:step3: Let's try rebooting into Safe Mode.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu with several options. Press the down arrow key on your keyboard until Safe Mode with Networking is selected. Press Enter. Please see here for additional details.

:step4: Once in Safe Mode with Networking, download Rkill (Rkill is updated frequently, so this may be a new version from the one you previously downloaded).

Run Rkill (renamed iExplore.exe).

Please be patient while Rkill looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If it appears like Rkill did not stop the malware from running, please try running RKill again until the malware is no longer running.

If you are unable to download or run rkill from the main download, try these alternate download locations:

1. http://download.bleepingcomputer.com/grinler/rkill.com
2. http://download.bleepingcomputer.com/grinler/rkill.pif
3. http://download.bleepingcomputer.com/grinler/rkill.scr
4. http://download.bleepingcomputer.com/grinler/eXplorer.exe
5. http://download.bleepingcomputer.com/grinler/iExplore.exe
6. http://download.bleepingcomputer.com/grinler/uSeRiNiT.exe
7. http://download.bleepingcomputer.com/grinler/WiNlOgOn.exe
8. http://www.boredomsoft.org/hosted/rkill.exe
9. http://www.boredomsoft.org/hosted/rkill.com
10. http://www.boredomsoft.org/hosted/rkill.scr
11. http://www.boredomsoft.org/hosted/eXplorer.exe
12. http://www.boredomsoft.org/hosted/iExplore.exe


Do not reboot your computer after running RKill as the malware programs will start again!

:step5: Still in Safe Mode with Networking, open Malwarebytes and click on the Update tab, then click on the Check for Updates button.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware


:step6: Reboot into Normal mode. Next run Superantisypware (SAS):

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from http://www.superantispyware.com/downloads/SASDEFINITIONS.EXE (copy and paste that website address) and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a USB drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.

:step7: Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.


In your next reply, please include:
  • SecurityCheck's checkup.txt file
  • MiniToolbox's Result.txt file
  • Malwarebytes' log file
  • SuperAntiSpyware log file
  • GMER log file
  • How's the computer running now? Please include a detailed description of anything out of the ordinary, including any error messages.

Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#3 sosumql

sosumql
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:01 PM

Posted 11 July 2011 - 07:49 PM

Sorry for the late reply. I was running the things over the weekend

Here's the logs:
--------Security Check ---------------------------------

Results of screen317's Security Check version 0.99.17
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
Java™ 6 Update 20
Out of date Java installed!
Adobe Flash Player 10.3.181.26
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent

Norton ccSvcHst.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
``````````End of Log````````````

--------------------------------------------------------------------------------------------
-------------Mini Tool Bar ----------------------------------------------------------------
MiniToolBox by Farbar
Ran by William (administrator) on 10-07-2011 at 18:14:39
Windows 7 Home Premium (X64)

***************************************************************************


========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= End of IE Proxy Settings ========================
=============== Hosts content: ============================================

# Copyright © 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
127.0.0.1 localhost
=============== End of Hosts ==============================================

================= IP Configuration: =======================================

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : Dragoon
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : charter.com

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter #2
Physical Address. . . . . . . . . : 00-27-10-07-43-61
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
Physical Address. . . . . . . . . : 00-27-10-07-43-61
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : charter.com
Description . . . . . . . . . . . : Intel® Centrino® Advanced-N 6200 AGN
Physical Address. . . . . . . . . : 00-27-10-07-43-60
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::4c5f:134:6028:4b2d%12(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.103(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Sunday, July 10, 2011 5:51:52 PM
Lease Expires . . . . . . . . . . : Monday, July 11, 2011 5:51:51 PM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 218113808
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-D9-E1-B0-00-23-18-02-CC-86
DNS Servers . . . . . . . . . . . : 71.9.127.107
68.190.192.35
68.116.46.115
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : charter.com
Description . . . . . . . . . . . : Intel® 82577LC Gigabit Network Connection
Physical Address. . . . . . . . . : 00-23-18-02-CC-86
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.charter.com:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : charter.com
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{59384D8F-3779-4934-AFA6-0410F0CE598C}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{70AE577E-5772-41F4-94B2-74B9A2AA1AF7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:3cce:333:9ea5:7d86(Preferred)
Link-local IPv6 Address . . . . . : fe80::3cce:333:9ea5:7d86%15(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled
Server: vip01mtpkca.mtpk.ca.charter.com
Address: 71.9.127.107

Name: google.com
Addresses: 74.125.224.145
74.125.224.146
74.125.224.144
74.125.224.148
74.125.224.147


Pinging google.com [74.125.224.148] with 32 bytes of data:
Reply from 74.125.224.148: bytes=32 time=24ms TTL=50
Reply from 74.125.224.148: bytes=32 time=22ms TTL=50

Ping statistics for 74.125.224.148:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 22ms, Maximum = 24ms, Average = 23ms
Server: vip01mtpkca.mtpk.ca.charter.com
Address: 71.9.127.107

Name: yahoo.com
Addresses: 69.147.125.65
72.30.2.43
98.137.149.56
209.191.122.70
67.195.160.76


Pinging yahoo.com [209.191.122.70] with 32 bytes of data:
Reply from 209.191.122.70: bytes=32 time=49ms TTL=50
Reply from 209.191.122.70: bytes=32 time=49ms TTL=50

Ping statistics for 209.191.122.70:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 49ms, Maximum = 49ms, Average = 49ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time=3ms TTL=128
Reply from 127.0.0.1: bytes=32 time=2ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 3ms, Average = 2ms
===========================================================================
Interface List
14...00 27 10 07 43 61 ......Microsoft Virtual WiFi Miniport Adapter #2
13...00 27 10 07 43 61 ......Microsoft Virtual WiFi Miniport Adapter
12...00 27 10 07 43 60 ......Intel® Centrino® Advanced-N 6200 AGN
11...00 23 18 02 cc 86 ......Intel® 82577LC Gigabit Network Connection
1...........................Software Loopback Interface 1
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.103 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.103 281
192.168.1.103 255.255.255.255 On-link 192.168.1.103 281
192.168.1.255 255.255.255.255 On-link 192.168.1.103 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.103 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.103 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
15 58 ::/0 On-link
1 306 ::1/128 On-link
15 58 2001::/32 On-link
15 306 2001:0:4137:9e76:3cce:333:9ea5:7d86/128
On-link
12 281 fe80::/64 On-link
15 306 fe80::/64 On-link
15 306 fe80::3cce:333:9ea5:7d86/128
On-link
12 281 fe80::4c5f:134:6028:4b2d/128
On-link
1 306 ff00::/8 On-link
15 306 ff00::/8 On-link
12 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

================= End of IP Configuration =================================

========================= Event log errors: ===============================

Application errors:
==================
Error: (07/09/2011 10:44:34 PM) (Source: Application Error) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7600.16768, time stamp: 0x4d688122
Faulting module name: DUI70.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdf25
Exception code: 0xc0000005
Fault offset: 0x0000000000001134
Faulting process id: 0xe48
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3

Error: (07/07/2011 11:55:30 PM) (Source: TabletServicePen) (User: )
Description: Could not init tablet driver

Error: (07/06/2011 08:24:21 AM) (Source: Application Error) (User: )
Description: Windows cannot access the file D:\NPE.exe for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Norton Power Eraser because of this error.

Program: Norton Power Eraser
File: D:\NPE.exe

The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.

Additional Data
Error value: C000009C
Disk type: 5

Error: (07/06/2011 08:24:21 AM) (Source: Application Error) (User: )
Description: Faulting application name: NPE.exe, version: 2.0.0.52, time stamp: 0x4de6af83
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000006
Fault offset: 0x000b0f2f
Faulting process id: 0x14b4
Faulting application start time: 0xNPE.exe0
Faulting application path: NPE.exe1
Faulting module path: NPE.exe2
Report Id: NPE.exe3

Error: (07/06/2011 08:22:55 AM) (Source: Application Error) (User: )
Description: Windows cannot access the file D:\NPE.exe for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Norton Power Eraser because of this error.

Program: Norton Power Eraser
File: D:\NPE.exe

The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.

Additional Data
Error value: C000009C
Disk type: 5

Error: (07/06/2011 08:22:55 AM) (Source: Application Error) (User: )
Description: Faulting application name: NPE.exe, version: 2.0.0.52, time stamp: 0x4de6af83
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000006
Fault offset: 0x00160f2f
Faulting process id: 0x1624
Faulting application start time: 0xNPE.exe0
Faulting application path: NPE.exe1
Faulting module path: NPE.exe2
Report Id: NPE.exe3

Error: (06/02/2011 07:53:39 PM) (Source: Application Error) (User: )
Description: Faulting application name: gimp-2.6.exe, version: 0.0.0.0, time stamp: 0x4caa3d66
Faulting module name: libgdk-win32-2.0-0.dll, version: 2.16.6.0, time stamp: 0x4b6f2327
Exception code: 0xc0000005
Fault offset: 0x00039ab6
Faulting process id: 0x1f50
Faulting application start time: 0xgimp-2.6.exe0
Faulting application path: gimp-2.6.exe1
Faulting module path: gimp-2.6.exe2
Report Id: gimp-2.6.exe3

Error: (05/18/2011 10:41:30 AM) (Source: Windows Search Service) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Context: Application, SystemIndex Catalog

Error: (04/22/2011 03:34:48 PM) (Source: Application Error) (User: )
Description: Faulting application name: gimp-2.6.exe, version: 0.0.0.0, time stamp: 0x4caa3d66
Faulting module name: libgdk-win32-2.0-0.dll, version: 2.16.6.0, time stamp: 0x4b6f2327
Exception code: 0xc0000005
Fault offset: 0x00039ab6
Faulting process id: 0x1558
Faulting application start time: 0xgimp-2.6.exe0
Faulting application path: gimp-2.6.exe1
Faulting module path: gimp-2.6.exe2
Report Id: gimp-2.6.exe3

Error: (04/22/2011 00:39:02 PM) (Source: Windows Search Service) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Context: Application, SystemIndex Catalog


System errors:
=============
Error: (07/06/2011 08:54:27 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: SYSTEM)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\windows\System32\IWMSSvc.dll

Error: (07/06/2011 08:36:10 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:36:08 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:36:05 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:36:01 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:35:59 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:35:56 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:35:54 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:35:47 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (07/06/2011 08:35:43 AM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.


Microsoft Office Sessions:
=========================

========================= End of Event log errors =========================

========================= Memory info: ====================================

Percentage of memory in use: 48%
Total physical RAM: 3824.43 MB
Available physical RAM: 1956.68 MB
Total Pagefile: 7647 MB
Available Pagefile: 5616.9 MB
Total Virtual: 4095.88 MB
Available Virtual: 3970.46 MB

======================= Partitions: =======================================

1 Drive c: (TI105872W0F) (Fixed) (Total:455.04 GB) (Free:301.33 GB) NTFS
2 Drive d: (Jul 06 2011) (CDROM) (Total:0.01 GB) (Free:0 GB) UDF

================= Users: ==================================================

User accounts for \\DRAGOON

-------------------------------------------------------------------------------
Administrator Guest Joshua Times
William
The command completed successfully.

================= End of Users ============================================

-----------------------------------------------------------------------------------
-------------rkill ---------------------------------------------------------------
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 0/2011 Sun at 18:28:30.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:



Rkill completed on 0/2011 Sun at 18:28:32.

-------------------------------------------------------------------------------------
-------Anti-Malware -----------------------------------------------------------------
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7068

Windows 6.1.7600 (Safe Mode)
Internet Explorer 9.0.8112.16421

7/10/2011 6:31:52 PM
mbam-log-2011-07-10 (18-31-52).txt

Scan type: Quick scan
Objects scanned: 181146
Time elapsed: 1 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
--------------------------------------------------------------------------
---------SUPERAntiSpyware -----------------------------------------------
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/10/2011 at 07:31 PM

Application Version : 4.55.1000

Core Rules Database Version : 7392
Trace Rules Database Version: 5204

Scan type : Complete Scan
Total Scan Time : 00:48:25

Memory items scanned : 414
Memory threats detected : 0
Registry items scanned : 14570
Registry threats detected : 0
File items scanned : 39793
File threats detected : 10

Trojan.Agent/Gen-IExplorer[Fake]
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX0\NIRD\IEXPLORE.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX1\NIRD\IEXPLORE.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX2\NIRD\IEXPLORE.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX3\NIRD\IEXPLORE.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX4\NIRD\IEXPLORE.EXE

Trojan.Agent/Gen-PEC
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX0\PROCS\EXPLORER.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX1\PROCS\EXPLORER.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX2\PROCS\EXPLORER.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX3\PROCS\EXPLORER.EXE
C:\USERS\WILLIAM\APPDATA\LOCAL\TEMP\RARSFX4\PROCS\EXPLORER.EXE
-----------------------------------------------------------------------------------
GMER cannot find anything so no log is produced

As for how things are now, somehow things felt a little faster. Before I had to wait a minute or two to be able to start the browser. But now things felt a little faster. And Google results are not forwarding to other sites.

Thanks!

#4 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:05:01 PM

Posted 11 July 2011 - 09:23 PM

Hi sosumql,

:thumbup2: Looking good so far.

:step1: Let's rerun Malwarebytes' in Normal Mode (not Safe Mode).

Open Malwarebytes, click on the Update tab, and click the Check for Updates button.
Then, click on the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware

:step2: I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image
      icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.

:step3: Your version of Java is out of date.

Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Platform, Standard Edition".
  • Click the "Download JRE" button to the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • From the list, select your OS and Platform (32-bit or 64-bit).
  • If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Posted Image > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u26-windows-i586.exe to install the newest version.
  • If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  • The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:
  • Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  • Click Ok and reboot your computer.

:step4: Your version of Adobe Flash Player is out of date.

Please go here: http://filehippo.com/download_flashplayer/

Download and install both versions, Flash Player 10.3.181.34 (IE) and Flash Player 10.3.181.34 (Non-IE).


To recap, please include in your next reply:
  • Latest Malwarebytes' log
  • ESET log
  • How's your computer running now? Please describe in detail anything out of the ordinary.

Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#5 sosumql

sosumql
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:01 PM

Posted 12 July 2011 - 03:15 PM

Hi,

I've run both scanners and both returns nothing found.

But I was running the ESET scanner over night without Internet Connection, and the computer blue screened. I wonder if something else is going on?

The computer runs as before. Nothing much changed

Thanks!

#6 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:05:01 PM

Posted 12 July 2011 - 03:53 PM

Hi sosumql,

Hmm, that's odd. Has it blue screened recently, or is this something new?

:step1: Open MiniToolBox.
Checkmark following boxes:
  • List last 10 Event Viewer log
Click Go and post the result.

:step2: Rerun Security Check.

:step3: Let's try another online scanner.
Please run the F-Secure Online Scanner
Follow the Instruction here for installation.
Accept the License Agreement.
Once the ActiveX installs,Click Full System Scan
Once the download completes, the scan will begin automatically.
The scan will take some time to finish, so please be patient.
When the scan completes, click the Automatic cleaning (recommended) button.
Click the Show Report button and Copy & Paste the entire report in your next reply.

In your next reply, please include:
  • SecurityCheck's checkup.txt file
  • MiniToolbox's Result.txt file
  • F-Secure's report
  • How's the computer running now?

Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#7 sosumql

sosumql
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:01 PM

Posted 13 July 2011 - 10:52 AM

Hi,

The computer is now running same as before. Except startup is slow, probably because of all the scanners installed...

Here's the logs:

MiniToolBox by Farbar
Ran by William (administrator) on 12-07-2011 at 14:25:52
Windows 7 Home Premium (X64)

***************************************************************************


========================= Event log errors: ===============================

Application errors:
==================
Error: (07/12/2011 09:01:28 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (07/12/2011 09:01:22 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (07/12/2011 08:04:22 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (07/12/2011 08:04:16 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (07/12/2011 03:26:29 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (07/11/2011 11:50:37 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (07/11/2011 11:50:23 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

Error: (07/09/2011 10:44:34 PM) (Source: Application Error) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7600.16768, time stamp: 0x4d688122
Faulting module name: DUI70.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdf25
Exception code: 0xc0000005
Fault offset: 0x0000000000001134
Faulting process id: 0xe48
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3

Error: (07/07/2011 11:55:30 PM) (Source: TabletServicePen) (User: )
Description: Could not init tablet driver

Error: (07/06/2011 08:24:21 AM) (Source: Application Error) (User: )
Description: Windows cannot access the file D:\NPE.exe for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Norton Power Eraser because of this error.

Program: Norton Power Eraser
File: D:\NPE.exe

The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.

Additional Data
Error value: C000009C
Disk type: 5


System errors:
=============
Error: (07/12/2011 06:42:32 AM) (Source: BugCheck) (User: )
Description: 0x0000009f (0x0000000000000003, 0xfffffa8008d13b60, 0xfffff80000b9c518, 0xfffffa80047bc010)C:\windows\MEMORY.DMP071211-23275-01

Error: (07/12/2011 06:42:20 AM) (Source: EventLog) (User: )
Description: The previous system shutdown at 6:29:55 AM on ?7/?12/?2011 was unexpected.

Error: (07/11/2011 05:02:52 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (07/11/2011 04:42:28 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (07/11/2011 04:42:28 PM) (Source: DCOM) (User: )
Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F}

Error: (07/11/2011 04:42:28 PM) (Source: DCOM) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}

Error: (07/11/2011 04:42:15 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (07/11/2011 04:42:15 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (07/11/2011 04:42:15 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (07/11/2011 04:42:15 PM) (Source: Service Control Manager) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068


Microsoft Office Sessions:
=========================

========================= End of Event log errors =========================


Results of screen317's Security Check version 0.99.17
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
ESET Online Scanner v3
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
Java™ 6 Update 20
Out of date Java installed!
Adobe Flash Player 10.3.181.26
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent

Norton ccSvcHst.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
``````````End of Log````````````

---------------------------------------------------------------------------------------
Scanning Report
Wednesday, July 13, 2011 00:43:04 - 08:46:21
Computer name: DRAGOON
Scanning type: Scan system for malware, spyware and rootkits
Target: C:\


--------------------------------------------------------------------------------

17 malware found
TrackingCookie.Questionmarket (spyware)
System (Disinfected)
TrackingCookie.Adinterax (spyware)
System (Disinfected)
TrackingCookie.2o7 (spyware)
System (Disinfected)
TrackingCookie.Advertising (spyware)
System (Disinfected)
TrackingCookie.Atdmt (spyware)
System (Disinfected)
TrackingCookie.Doubleclick (spyware)
System (Disinfected)
TrackingCookie.Revsci (spyware)
System (Disinfected)
TrackingCookie.WebTrendsLive (spyware)
System (Disinfected)
TrackingCookie.Fastclick (spyware)
System (Disinfected)
TrackingCookie.Adbrite (spyware)
System (Disinfected)
TrackingCookie.Xiti (spyware)
System (Disinfected)
TrackingCookie.Webtrends (spyware)
System (Disinfected)
TrackingCookie.Mediaplex (spyware)
System (Disinfected)
TrackingCookie.Liveperson (spyware)
System (Disinfected)
TrackingCookie.Statcounter (spyware)
System (Disinfected)
TrackingCookie.Atwola (spyware)
System (Disinfected)
TrackingCookie.Yieldmanager (spyware)
System (Disinfected)

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 98574
System: 6547
Not scanned: 151
Actions:
Disinfected: 17
Renamed: 0
Deleted: 0
Not cleaned: 0
Submitted: 0
Files not scanned:
C:\HIBERFIL.SYS
C:\PAGEFILE.SYS
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM
C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB
C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB
C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\ROAMING\PEERNETWORKING\B93891FAE15DCC6F3DC27AFC36F5614B4E6F5A76.HOMEGROUPCLASSIFIER\761DE954B8EE8DA18C872016B62E7812\GROUPING\DB.MDB
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_ICFMGR_{F34173A0-C9EA-45AB-B832-29D35E6D04EC}G
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_ISDATAPR_{E8EFD4CD-DE52-4444-9511-EFF3B158724B}1
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_ISDATAPR_{FF9AC67A-E394-46AE-B150-B3365343F166}G
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_NPC.TRAY.{1AFE47BB-FCF1-4096-9039-1FEBC9A0CCCF}1
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_UI.HOST.{1AFE47BB-FCF1-4096-9039-1FEBC9A0CCCF}1
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_{4E9CB39A-5F78-4887-A3D6-2790DE9DDE11}1
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_{869594F6-6511-4780-AD37-49B479DA2A4F}1
C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\CMNCLNT\_LCK\_AVPAPP_{BB639333-810A-4BF8-85F5-C537857F55FC}1
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0374BD449AEA172DA8BBAC132FB902B4_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\03C33A8F1C3B3657DC4B6F198F3D5149_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\03943624C39B101F52B486298097D506_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0788692DEC4F0D20AACC0E948BAC5313_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\07AD272548EBD2B08E8CF95A9BC1B3C8_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0812B172DEE394D919692D730E0CEF42_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\00F386968846B9B135838D37CD4AC804_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\151D06A4C39CBE428A648731F2022CD9_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1667E9E1263DBA5AA2E1D4FCA7D38A8C_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\158FAB1B0CA8604AF749D7D7490DBC2F_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0B28605779FF9E1CFD861FFE58C60420_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\182FD302FBC9B3E534432FD61EB46AD9_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0F6A1302A58A506F813E18000703D619_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\19FEEF69C1A94AF425A9B6195164DCF5_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1B63A8BEB1B0375CA3FBE06F5511049E_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2541E1B675DE62508DD610B43367CE39_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\25600A7D91A60182E7004ABBD56B2BEA_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\27C1D98246C6E4A021539A2BB8BF79D7_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2C58FEE3744EAE04B73F4A1394EECE68_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2ED5D55CAFF711B7355EABDF32A2623E_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2A3BF5EB25896711D64C089FEF1C574B_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1BDE0C8930D8AAC00FB3269FA102229C_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3264BDEEA9BD0FE005F2841A0E4DEF32_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3BBAC240CC24B6C6CDE6E7AD111CB63A_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\399AC9B1B8C4F1A213ED262160ED8447_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\0F2DC03652CB422C7297A78B4D9B36F1_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4267D84B592CF411282B5A685A64C8AC_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\44A41DE26C652CEFDA7691B7A57F7E71_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3FA887546D646B63E15DE28D492B63F0_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4EE367656D1B7161872F531834E3207F_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4B204B22684E59326BCCFFAB2F9D9EAC_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4AE7663A150F6690417B39C2B3C65A2A_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4FC355FA9213A11A595855B37D111396_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\588EA790A1D787576FE922BE5601E167_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\58F002C27A8E98A28ACBA49D7DE5618D_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\53BB20BD7AC178486A85A08AC2825615_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5DD6E41F15CC24C37B2B20BE2A2F6C27_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5A5C5CAE570C84D4ED458D44C67AE326_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5238E84DA7500196572ABC1C3658B711_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\612D64254F50D877CDD4D46033BD7523_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\640C09CC76358837C6E105C4119FA975_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6063205CD8211F0399D1AC297314E2A5_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\65CB3AEF1958A9A42F4A49291A620016_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6E6C3CB24F8885D4D9048AB8A6BFAA70_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\718FC34C2CDC43F71B6E3C2C1EE11A89_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\68FE8598779E967A45423AAB341FE9C2_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\719C207E3D862C716BBDB4797FDB0542_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6EB80829AB7BF913D1432CCAE1E7FE47_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\716021FFF00DDA13054D69771785CBEF_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\73D66E89FFD6091F1E8C32012D7FD899_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\725CFC4FD2300E65A2864377D65FD426_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\742E8EBB39DFEE1C1FCDE55AD79A4806_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\756396BE08AED782B0CB8EE1B917A4EA_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\795B960D31202DAABF9CDA581F231AE0_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\75D0E32A1E07BB09E35EA8F2D835E3F3_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7D6C71850AFC31F505186FF83BFDA8F4_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7DDFD484F121A18C8AD2E40E1428BB20_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7A910B6B3BBFA9EE7AB3C1F4C7A3CE18_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\804A6C8F63A73A89D02490EE95B6F925_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\888D7701890211CD0BAD075F980AC9C9_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8A1215209310A1DC49FF989088F4EDD3_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8C346E7FF274C7D73365A6DCF41C906E_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7D0D02CF424A12EAEF6DEF14E94361ED_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8BD4847A1ED1195ECA54551EA70DB9D8_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8FBE391223A1319114F17C8E0F599B12_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8E3891A6B50563D949835B5517DB5C22_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\98354B3C7AEF6AD7F490D29C89DBC233_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8D49F5B5C2556F625F9A823CA4908087_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\988E873F10755279B7AD1CBD911E18FB_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\98E4AC054EFD490131829C4AB1A13111_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9B6CB0246337E1C03CF327BE29824994_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9C02A5AB4303304E133B8E2AD70BF87D_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9D2D09C0F2817E93FAC3A6E33439A6AC_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\91B662940F21A90EB593B646511944BA_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9B3B2EAF8FADC12A797F4F6C2F9B4332_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A093EF94C5E4DC6DF345FE25E34490B3_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A6478C626762839FFE27383F0ACC2293_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9D65718D357795FDFB20CF72D3E90CB1_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A181E05B8D98AFBAF0C836086DAF4F39_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A6C19BDD4E0E0D86A1B678136CFC55A5_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A66DFCC0D669E0D90051D2C688054A8E_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A86621D7A421A36B2413AAEB3F6C72B8_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AEC11CACCE75AF83B27CEC38367B3412_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AFC6BE01659F9F6E598B09C027385910_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A7294F465D89F9A64201374EB12D7659_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B0DEB1EAA061E739C05798FB99853F1B_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B0E5E728A580BB4CC5BD69C899E3CDEF_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B407264C0E509FEC605723A58903422B_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B168A770C53CDE7A9EB3E4B3B1DD64E2_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\AB958DF17D51B1F4CE1C75F0BD28F997_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B6E7FE8918D089A81BDB0FCEC32EF233_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B4A09A2F21480F7DD017F7B2F68D590B_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B49E97C680AC1A177A3FB5DFAE57A0AD_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B8067BE4498A45AA67CE6E60A6F420A8_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BA572B5A9C39189A9D252B86CBC66661_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BB4FF9C4D0EF28C24783F4ED848F7399_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BE925F8CF2F4591D07AFA8533A8125F6_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C093E6E1F8AFF7D9DE953DA8D46562C3_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BF6431D1129578E26CAC7B2E5779E786_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C42F7DB561603B65E756BE05E7FFBC05_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C4747E2856382007D0A1E40C47614801_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C2153D52017335AE0BB9F4F739365674_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CB93C24A9F547898438E271DBD8A40E8_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CC1E2D15BE84A01E3B1EFDF2CA2E4FEE_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CCBA56B5D8203F1F8C0AC948BF92D442_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D0601E1D044C5292753D0A8DCCCBADD0_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D0F5628C27B8AA1FB2B938F11FFB0C98_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D1007443307821E26957A002888A840A_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D587635F95977FC00CD65EABA2040E89_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D58CCD90747D1F66A5B1408B3009655A_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D64F5BC9CC5B38CAE382265AF100D72B_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C52CB71C017BB665ECB85067A06D6C8D_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BF5623BDB217BFD36B3AF192C68C9CE6_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DD8F2FDAB2A02A342F525F4ECE8C278A_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D8A83B2ED7FB48D2826FF746E3C7B48B_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E042EA187355D42ED8256146469512F6_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\E98120B4C3E162D1FF8D9C07864F1058_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EAB04C303DAD781993DE53E024CABD89_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EB0C7B7F01DC612A0CF628FD896FBA29_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DFCDEB0D14947AB4E42B5DC65FC63AF3_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D998381C83964B05E21387449CF609F4_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\ED0E19C1735C4E99BF288D15B17B9F47_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F636D46835ED77628FFEC77217E5E29D_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F532E748B07DCA58C13A1320DC02CFD3_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F2F5C04ED69596A490441920A9843965_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FAF748E7DA73BC19E87A0EADED9B664F_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FF741AD23322620EB34DE1252CA35A48_E3379D62-B39A-4D39-86E5-576334794F2C
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F9029D08246678AAD1D7F6906B453FE6_E3379D62-B39A-4D39-86E5-576334794F2C

--------------------------------------------------------------------------------

Options
Scanning engines:
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
Use advanced heuristics

--------------------------------------------------------------------------------

Copyright © 1998-2009 Product support | Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name. This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

#8 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:05:01 PM

Posted 13 July 2011 - 11:33 AM

Hi sosumql,

I noticed you didn't completely follow my previous instructions. It is important to update Java and Adobe Flash to their latest versions, as older versions have vulnerabilities in them that malware can use to reinfect your computer.

:step1: Your version of Java is out of date.

Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Platform, Standard Edition".
  • Click the "Download JRE" button to the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • From the list, select your OS and Platform (32-bit or 64-bit).
  • If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Posted Image > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u26-windows-i586.exe to install the newest version.
  • If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  • The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:
  • Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  • Click Ok and reboot your computer.


:step2: Your version of Adobe Flash Player is out of date.

Please go here: http://filehippo.com/download_flashplayer/

Download and install both versions, Flash Player 10.3.181.34 (IE) and Flash Player 10.3.181.34 (Non-IE).


:step3: Download Temp File Cleaner (TFC)
Make sure you save all your work and close any open program.
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer. Please do restart.


:step4: Take a look at Slow Computer/browser? Check Here First; It May Not Be Malware. There are several good suggestions there to troubleshoot a slow computer that is not infected by malware. Also, if you want, you can go into the Control Panel then Programs and Features, and uninstall both F-Secure and ESET.
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users