Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Unable to launch anything, Windows Vista 64bit

  • This topic is locked This topic is locked
57 replies to this topic

#1 tallguynscc


  • Members
  • 31 posts
  • Local time:10:17 PM

Posted 26 October 2011 - 05:53 PM

Previous topic, in 'Am I Infected?'

About a week ago this issue started happening. Working on the family computer, I mistyped an address for work, and brought me to one with a popup (the usual saying You Won! etc and so forth.... After closing that down, and trying to restart Firefox, it would open but not connect to the network. After doing the basic troubleshooting, and eventually restarting the computer, I was unable to open anything.

When attempting to open anything on the desktop, it would show the loading circle for a few moments (as always) but no window would ever come up. Checking the task manager, no programs were shown to be running. I am also having issues even opening up the start menu (clicking it, windows key, nothing works). When clicking the start menu, the same loading circle comes up and stays for awhile and after about 2+ minutes loads, but doesn't show any of the programs/search bar/etc that you would normally see.

If I attempt to double-click anything else while loading circle is up, the entire desktop fades (such as a window would when it goes to Not Responding). I can't even right click on the desktop without the loading circle coming up.

I am able to start the computer in safe mode, and can connect/browse the network with no problems. Programs open fine in safe mode, start menu is good, etc.

I've ran a few anti-virus programs (Malwarebytes, Avira, and Microsoft Security Essentials), but out of the 3 full scans the only one that found something was Avira.
It found TR/Agent.118784.CN Trojan located in C:\Program Files (x86)\GameBox\Uninstall.exe. After attempting to quaratine, and rebooting the computer, still unable to do anything on normal mode for the computer.

There is one other odd thing I noticed, when right clicking a normal program (say Malwarebytes) in safe mode or normal mode, I see an odd option. There's a fourth option that says start, in all lower case. The options when right-clicking are: Open, Open file location, Run as administrator, and then start. Perhaps I've never noticied it before, but it definitely stood out when right clicking the program.

Studio XPS 435 MT
Windows Vista 64-bit, SP2

If there's anything else, or something needs to be more descriptive, just ask and I'll do my best to figure it out.

Thanks a bunch.


DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Mom at 17:24:24 on 2011-10-26
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6134.5171 [GMT -5:00]
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
============== Running Processes ===============
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://google.com/
uWindow Title = Windows Internet Explorer provided by Comcast
mStart Page = hxxp://www.comcast.net/
mWindow Title = Windows Internet Explorer provided by Comcast
mWinlogon: Userinit=userinit.exe,
BHO: GameBox Toolbar: {0fef2d2c-cda6-45e4-b2ed-9df7c50c95ff} - C:\Program Files (x86)\GameBox\gamebox_toolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Comcast Toolbar: {79ceea4e-c231-4614-9e3b-53b2a02f39b7} - C:\Program Files (x86)\comcasttb\comcastdx.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Comcast Toolbar: {79ceea4e-c231-4614-9e3b-53b2a02f39b7} - C:\Program Files (x86)\comcasttb\comcastdx.dll
TB: GameBox Toolbar: {0fef2d2c-cda6-45e4-b2ed-9df7c50c95ff} - C:\Program Files (x86)\GameBox\gamebox_toolbar.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Steam] "C:\Program Files (x86)\Valve\Steam\steam.exe" -silent
uRun: [ComcastAntispyClient] "C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
mRun: [Conime] %windir%\system32\conime.exe
mRun: [<NO NAME>]
mRun: [ATICustomerCare] "c:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" 1 v1.1.4322 GAC + NI NID
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - C:\Program Files (x86)\Bonjour\ExplorerPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
Trusted Zone: facebook.com\www
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {B20D9D6A-0DEC-4D76-9BEF-175896006B4A} - hxxps://prodwebreports.mis.vanderbilt.edu/wijsp65/distribution/RptVieweren.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
TCP: DhcpNameServer =
TCP: Interfaces\{A1E1578A-2B42-4CCA-8988-BA94CFA2F637} : DhcpNameServer =
Handler: gameboxchrome - {494D4E3B-FA53-4487-8AF6-3F50FE1167A9} - C:\Program Files (x86)\GameBox\gamebox_toolbar.dll
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
Handler: x-owacid - {0215258f-f0a8-49de-bf1b-0ff02eda8807} - C:\Program Files (x86)\Microsoft\Outlook Web Access SMIME Client\mimectl.dll
BHO-X64: GameBox Toolbar: {0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF} - C:\Program Files (x86)\GameBox\gamebox_toolbar.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO-X64: Search Helper - No File
BHO-X64: Comcast Toolbar: {79CEEA4E-C231-4614-9E3B-53B2A02F39B7} - C:\Program Files (x86)\comcasttb\comcastdx.dll
BHO-X64: Comcast Toolbar - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Comcast Toolbar: {79CEEA4E-C231-4614-9E3B-53B2A02F39B7} - C:\Program Files (x86)\comcasttb\comcastdx.dll
TB-X64: GameBox Toolbar: {0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF} - C:\Program Files (x86)\GameBox\gamebox_toolbar.dll
TB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun-x64: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun-x64: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
mRun-x64: [Conime] %windir%\system32\conime.exe
mRun-x64: [(Default)]
mRun-x64: [ATICustomerCare] "c:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" 1 v1.1.4322 GAC + NI NID
IE-X64: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
================= FIREFOX ===================
FF - ProfilePath - C:\Users\Mom\AppData\Roaming\Mozilla\Firefox\Profiles\vufvo9ig.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.comcast.net
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;C:\Windows\system32\DRIVERS\e1y60x64.sys --> C:\Windows\system32\DRIVERS\e1y60x64.sys [?]
S1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
S2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-6-26 88576]
S2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
S2 AntiSpywareService;Comcast AntiSpyware;C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe [2009-6-17 616408]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-12 136360]
S2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-10-12 269480]
S2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 dlbk_device;dlbk_device;C:\Windows\system32\dlbkcoms.exe -service --> C:\Windows\system32\dlbkcoms.exe -service [?]
S2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;C:\Program Files (x86)\Kodak\AiO\Center\ekdiscovery.exe [2010-9-13 308656]
S2 LinksysUpdater;Linksys Updater;C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-11-13 204800]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-5-5 366152]
S3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
S3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdLH6.sys --> C:\Windows\system32\drivers\AtihdLH6.sys [?]
S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-7-11 89920]
=============== File Associations ===============
JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
=============== Created Last 30 ================
2011-10-25 01:04:42 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DB20E958-2660-45D8-8BC6-F119E0DC82B6}\offreg.dll
2011-10-21 00:07:41 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DB20E958-2660-45D8-8BC6-F119E0DC82B6}\mpengine.dll
2011-10-20 15:00:40 332288 ----a-w- C:\Windows\System32\oleacc.dll
2011-10-20 15:00:39 847360 ----a-w- C:\Windows\System32\oleaut32.dll
2011-10-20 15:00:39 735744 ----a-w- C:\Windows\System32\UIAutomationCore.dll
2011-10-20 15:00:39 563712 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2011-10-20 15:00:39 555520 ----a-w- C:\Windows\SysWow64\UIAutomationCore.dll
2011-10-20 15:00:39 4096 ----a-w- C:\Windows\SysWow64\oleaccrc.dll
2011-10-20 15:00:39 4096 ----a-w- C:\Windows\System32\oleaccrc.dll
2011-10-20 15:00:39 238080 ----a-w- C:\Windows\SysWow64\oleacc.dll
2011-10-20 14:59:43 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2011-10-20 14:59:43 2409784 ----a-w- C:\Program Files (x86)\Windows Mail\OESpamFilter.dat
2011-10-20 14:50:18 375808 ----a-w- C:\Windows\System32\psisdecd.dll
2011-10-20 14:50:18 293376 ----a-w- C:\Windows\SysWow64\psisdecd.dll
2011-10-20 14:50:18 289792 ----a-w- C:\Windows\System32\psisrndr.ax
2011-10-20 14:50:18 217088 ----a-w- C:\Windows\SysWow64\psisrndr.ax
2011-10-20 14:50:18 100352 ----a-w- C:\Windows\System32\Mpeg2Data.ax
2011-10-20 14:50:17 73216 ----a-w- C:\Windows\System32\MSDvbNP.ax
2011-10-20 14:50:17 69632 ----a-w- C:\Windows\SysWow64\Mpeg2Data.ax
2011-10-20 14:50:17 57856 ----a-w- C:\Windows\SysWow64\MSDvbNP.ax
2011-10-16 00:32:51 -------- d-----w- C:\Users\Mom\AppData\Local\ElevatedDiagnostics
2011-10-16 00:06:47 -------- d-----w- C:\d645f65d72a52db3a2a789b8d4b993
2011-10-13 04:32:16 -------- d-----w- C:\ProgramData\Kaspersky Lab
2011-10-12 23:07:57 88288 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2011-10-12 12:13:38 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6F0C74B9-50FA-4626-A0D3-3BFFC4191997}\gapaengine.dll
2011-10-12 12:09:29 -------- d-----w- C:\Users\Mom\AppData\Local\{0BA68F5E-1389-451C-9839-511F121EAE07}
2011-10-12 12:09:17 -------- d-----w- C:\Users\Mom\AppData\Local\{B2CC5C60-D4A3-45C7-A90B-45AC6D94F9B5}
2011-10-12 02:29:02 -------- d-----w- C:\Users\Mom\AppData\Roaming\Avira
2011-10-12 02:27:56 -------- d-----w- C:\ProgramData\Avira
2011-10-12 02:27:56 -------- d-----w- C:\Program Files (x86)\Avira
2011-10-12 01:54:18 -------- d--h--w- C:\ProgramData\Common Files
2011-10-12 01:36:44 -------- d-----w- C:\ProgramData\MFAData
2011-10-11 00:47:51 -------- d-----w- C:\Users\Mom\AppData\Local\{D66C7311-2DD1-45DB-BF06-33616E5533AA}
2011-10-11 00:47:39 -------- d-----w- C:\Users\Mom\AppData\Local\{52B1A956-384E-447B-9079-8E2CA805B996}
2011-10-09 19:54:04 -------- d-----w- C:\Users\Mom\AppData\Roaming\Logishrd
2011-10-09 18:01:21 -------- d-----w- C:\Users\Mom\AppData\Local\{D2CBA54B-37C0-4313-AAE3-0BE2BBDA47D2}
2011-10-09 18:01:09 -------- d-----w- C:\Users\Mom\AppData\Local\{E7FB1C5D-971A-4D5B-B5EC-F69C373138EE}
2011-10-08 14:07:53 -------- d-----w- C:\Users\Mom\AppData\Local\{77DB186A-CF2A-4354-9C10-3205E9F76335}
2011-10-08 14:07:41 -------- d-----w- C:\Users\Mom\AppData\Local\{CC3B861D-2615-4CD6-B97D-5FD7F7694438}
2011-10-07 01:13:47 -------- d-----w- C:\Users\Mom\AppData\Local\{41F1AC37-B318-4073-9709-3F7C5B3893F2}
2011-10-07 01:13:36 -------- d-----w- C:\Users\Mom\AppData\Local\{8FED6D50-2A94-482F-91CA-19FAB132DEA5}
2011-10-07 01:05:44 -------- d-----w- C:\Users\Mom\AppData\Local\{B8E7A940-ED4B-4858-9396-341F0FE235A3}
2011-10-07 01:05:33 -------- d-----w- C:\Users\Mom\AppData\Local\{728004EA-1678-4F83-834D-98689A22E713}
2011-10-04 22:26:31 -------- d-----w- C:\Users\Mom\AppData\Local\{02DAF25A-FA71-4CBF-82AA-E26F2C9F6178}
2011-10-04 22:26:19 -------- d-----w- C:\Users\Mom\AppData\Local\{00A79CED-EBD5-4134-B087-8CBF4D6B0CA5}
2011-10-03 19:28:55 -------- d-----w- C:\Users\Mom\AppData\Local\{0482A58E-2C26-431E-87E3-1AEF933F3E41}
2011-10-03 19:28:44 -------- d-----w- C:\Users\Mom\AppData\Local\{66806FA5-9B5F-491D-A062-5E85D4E11CC8}
2011-10-03 00:53:40 -------- d-----w- C:\Users\Mom\AppData\Local\{09F1FEEB-89FA-445D-A54D-5E126A3376D5}
2011-10-03 00:53:31 -------- d-----w- C:\Users\Mom\AppData\Local\{037B057C-BE7A-40F0-ABB0-E9BBBBA2B3D4}
2011-10-02 14:54:10 -------- d-----w- C:\Users\Mom\AppData\Local\{4BB92619-E4D4-4C22-8E19-A52436BE6DD5}
2011-10-02 14:53:57 -------- d-----w- C:\Users\Mom\AppData\Local\{4B6388AB-F902-44E5-8FEF-8E8D1D524623}
2011-10-01 15:24:27 -------- d-----w- C:\Users\Mom\AppData\Local\{21068ABA-F025-42F3-B8E4-BACBBDDF505A}
2011-09-30 19:28:44 -------- d-----w- C:\Users\Mom\AppData\Local\{68361E94-37D1-4B73-B6A9-E28056EFAC70}
2011-09-30 19:28:30 -------- d-----w- C:\Users\Mom\AppData\Local\{4E4C82B9-230A-4C4C-BCF1-C53B6B49B171}
2011-09-29 22:55:13 -------- d-sh--w- C:\ProgramData\DSS
2011-09-29 21:10:24 -------- d-----w- C:\Users\Mom\AppData\Roaming\Lionhead Studios
2011-09-29 21:06:31 -------- d-----w- C:\Windows\SysWow64\xlive
2011-09-29 21:06:31 -------- d-----w- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2011-09-29 20:52:54 -------- d-----w- C:\Program Files (x86)\Microsoft Games
2011-09-29 20:50:50 -------- d-----w- C:\Users\Mom\AppData\Local\{A4CE0874-7FE7-4B8A-80B1-3F75B4BDE5DD}
2011-09-27 15:13:26 -------- d-----w- C:\Users\Mom\AppData\Local\{9E421231-DC90-473D-8787-BDAC635D3369}
==================== Find3M ====================
2011-10-16 16:55:49 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll
2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll
2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-08-31 22:00:50 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys
============= FINISH: 17:27:34.20 ===============

From the other topic:
To repeat from earlier. The GMER scan comes up with "GMER hasn't found any system modification"

Also, after downloading/updating aswMBR I ran it. Within 5 seconds of pressing the scan option I receive a Blue Screen of Death. Tried multiple times, same error/BSoD.

Drive_IRQL_Not_Less or Equal
0x000000D1 (0x0000000000000428 0x0000000000000002 0x0000000000000001 0xFFFFFA60007D8EE8)

ataport.sys_Address FFFFFA6007D8EE8 base at FFFFF16007D000 date stamp 49e02be1.

Attached Files

Edited by tallguynscc, 26 October 2011 - 05:54 PM.

BC AdBot (Login to Remove)


#2 HelpBot


    Bleepin' Binary Bot

  • Bots
  • 12,627 posts
  • Gender:Male
  • Local time:12:17 AM

Posted 31 October 2011 - 05:55 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:


Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/425173 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.


Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.


We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:17 AM

Posted 02 November 2011 - 09:07 PM


Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.
  • Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.

  • Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

  • Please reply to this post so I know you are there.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.


Can you try running MBRCheck

Please download MBRCheck to your desktop.

1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log when you reply.
Posted Image
m0le is a proud member of UNITE

#4 tallguynscc

  • Topic Starter

  • Members
  • 31 posts
  • Local time:10:17 PM

Posted 03 November 2011 - 10:18 AM

Hey m0le,

Attached is the MBR Check log.

However, when turning the computer on this morning it came up normally and everything seemed to be connected. I was able to open (most) items and was connected to the network. I haven't worked on it and nothing's changed from the past week. When loggin on normally, some things are not opening (Firefox, windows side bar, dell dock, I'm unable to upgrade Adobe FLash, and a few other things.) Attached is the popup when attempting to re-download Firefox.

It's not the UAC that normally pops up for Vista, but the Runas window. I'm on the Admin account already, so unsure why that's coming up.


Attached Files

#5 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:17 AM

Posted 03 November 2011 - 07:13 PM

There's nothing there but we can't ignore the rather nasty symptoms on the machine so we'll tread carefully for a bit

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Posted Image
m0le is a proud member of UNITE

#6 tallguynscc

  • Topic Starter

  • Members
  • 31 posts
  • Local time:10:17 PM

Posted 03 November 2011 - 10:09 PM

Alrighty, ran the scan and attached are the two documents.

Attached Files

Edited by tallguynscc, 03 November 2011 - 10:09 PM.

#7 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:17 AM

Posted 04 November 2011 - 02:14 PM

Please run Combofix next

Please download ComboFix from one of these locations:* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe
  • Disable your AntiVirus and AntiSpyware applications including Firewalls, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Comfix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Posted Image
m0le is a proud member of UNITE

#8 tallguynscc

  • Topic Starter

  • Members
  • 31 posts
  • Local time:10:17 PM

Posted 05 November 2011 - 12:23 PM

I was unable to disable Microsoft Security Essentials (shows up as a white blank page when trying to open, and as like Firefox/Adobe Flash previously, unable to re-download it so I could turn it off.)
Tried to end the process in Task Manager, and still came up with the alert that it was still running.

I ran combofix anyway, and attached is the log that came up.

Attached Files

#9 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:17 AM

Posted 05 November 2011 - 12:34 PM

Nothing there either. Please run Unhide

Please download Unhide

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.
Posted Image
m0le is a proud member of UNITE

#10 tallguynscc

  • Topic Starter

  • Members
  • 31 posts
  • Local time:10:17 PM

Posted 05 November 2011 - 03:55 PM

Unhide has ran and completed.
There are/were no files that I've purposely hidden on the computer (to my knowledge).

Should I attempt to download/upgrade anything or is there another scan to run?

Edited by tallguynscc, 05 November 2011 - 04:04 PM.

#11 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:17 AM

Posted 05 November 2011 - 04:49 PM

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Posted Image
m0le is a proud member of UNITE

#12 tallguynscc

  • Topic Starter

  • Members
  • 31 posts
  • Local time:10:17 PM

Posted 06 November 2011 - 01:23 AM

System look scan complete, attached is the log created.

Attached Files

#13 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:17 AM

Posted 06 November 2011 - 02:13 PM

Now please run aswMBR

Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Posted Image
m0le is a proud member of UNITE

#14 tallguynscc

  • Topic Starter

  • Members
  • 31 posts
  • Local time:10:17 PM

Posted 06 November 2011 - 11:26 PM

Attempted to run aswMBR again (first time in original post) and receive another(similar, but not exact) BSoD. Original BSoD is in the first post.
Tried the scan a few times, still get the blue screen.

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6002.
Locale ID: 1033

Additional information about the problem:
BCCode: d1
BCP1: 0000000000000428
BCP2: 0000000000000002
BCP3: 0000000000000001
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1

Files that help describe the problem:

and for the ataport.sys_address it's FFFFFA6000A14EE8 base at FFFFFA6000A0C000 date stamp 49e02be1.

#15 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:17 AM

Posted 07 November 2011 - 06:42 PM

Can you run Gmer but can you post the entire log for me.
Posted Image
m0le is a proud member of UNITE

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users