Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

XP Security Center "Leftovers"


  • Please log in to reply
7 replies to this topic

#1 wmcot

wmcot

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Salt Lake City, Utah
  • Local time:04:55 AM

Posted 16 January 2012 - 11:55 PM

I was bitten by the fake 2012 Windows XP Security Center bug a few days ago. I used Malwarbytes Anti-malware to get rid of it followed up by running Spybot and a full Avira scan with no errors. I used UnHide.exe and Doug Knox's EXE File Associations Fix to get my associations back.

Things are pretty much back to normal - No detections on MBAM, TDSSKiller, Rkil, SpyBot or Avira Antivir.

I do have a few "leftovers" such as occasional text blurring or writing over itself, see-through slots in window where text should be (especially in Process Explorer) and locked up screens with half the text missing when I come out of my screensaver at times.

I was getting script errors in Firefox pages, but updating Java seemed to help that.

Any other ideas of where to look next?

This is an annoying little bug!

Oh yeah - Running Window XP Pro SP3

Edited by wmcot, 16 January 2012 - 11:58 PM.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,912 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:55 AM

Posted 17 January 2012 - 04:48 PM

Hello. lets run 3 items.
1>>Run TFC by OT (Temp File Cleaner)
Please download TFC by Old Timer and save it to your desktop.
alternate download link

Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

2>> Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices
  • List Users, Partitions and Memory size.
  • List Minidump Files
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.


3>> I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Under scan settings, check Posted Image and check Remove found threats
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NOTE: In some instances if no malware is found there will be no log produced.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 wmcot

wmcot
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Salt Lake City, Utah
  • Local time:04:55 AM

Posted 17 January 2012 - 11:44 PM

Thanks for the help.

I ran TFC with no problem. Ran MiniToolBox with the following results (I will run ESET next since it will take awhile.):

MiniToolBox by Farbar Version: 18-01-2012
Ran by wmcot (administrator) on 17-01-2012 at 20:45:52
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================


Windows IP Configuration



Successfully flushed the DNS Resolver Cache.


========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================


127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 www.123topsearch.com
127.0.0.1 123topsearch.com

There are 15071 more lines starting with "127.0.0.1"

========================= IP Configuration: ================================

1394 Net Adapter = 1394 Connection (Connected)
Realtek PCIe GBE Family Controller = Local Area Connection 2 (Connected)


# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection 2"

set address name="Local Area Connection 2" source=static addr=192.168.0.64 mask=255.255.255.0
set address name="Local Area Connection 2" gateway=192.168.0.1 gwmetric=0
set dns name="Local Area Connection 2" source=static addr=192.168.0.1 register=PRIMARY
add dns name="Local Area Connection 2" addr=192.168.0.16 index=2
set wins name="Local Area Connection 2" source=static addr=none


popd
# End of interface IP configuration




Windows IP Configuration



Host Name . . . . . . . . . . . . : wmcot-2z7933yg4

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Broadcast

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No



Ethernet adapter Local Area Connection 2:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller

Physical Address. . . . . . . . . : 00-17-31-7B-71-2A

Dhcp Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.0.64

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1

192.168.0.16

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.0.1

Name: google.com
Addresses: 74.125.224.84, 74.125.224.80, 74.125.224.81, 74.125.224.82
74.125.224.83



Pinging google.com [74.125.224.82] with 32 bytes of data:



Reply from 74.125.224.82: bytes=32 time=68ms TTL=56

Reply from 74.125.224.82: bytes=32 time=68ms TTL=56



Ping statistics for 74.125.224.82:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 68ms, Maximum = 68ms, Average = 68ms

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.0.1

Name: yahoo.com
Addresses: 98.139.180.149, 209.191.122.70, 72.30.2.43, 98.137.149.56



Pinging yahoo.com [209.191.122.70] with 32 bytes of data:



Reply from 209.191.122.70: bytes=32 time=76ms TTL=55

Reply from 209.191.122.70: bytes=32 time=79ms TTL=55



Ping statistics for 209.191.122.70:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 76ms, Maximum = 79ms, Average = 77ms

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.0.1

Name: bleepingcomputer.com
Address: 208.43.87.2



Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:



Reply from 208.43.87.2: Destination host unreachable.

Reply from 208.43.87.2: Destination host unreachable.



Ping statistics for 208.43.87.2:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 17 31 7b 71 2a ...... Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.64 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.64 192.168.0.64 20
192.168.0.64 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.0.255 255.255.255.255 192.168.0.64 192.168.0.64 20
224.0.0.0 240.0.0.0 192.168.0.64 192.168.0.64 20
255.255.255.255 255.255.255.255 192.168.0.64 192.168.0.64 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog5 02 C:\Windows\System32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Catalog9 01 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 02 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 03 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 04 C:\Windows\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 05 C:\Windows\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 06 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 07 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 08 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 09 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 10 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 11 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 12 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 13 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 14 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 15 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 16 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 17 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 18 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 19 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (01/17/2012 08:33:09 PM) (Source: Userenv) (User: SYSTEM)SYSTEM
Description: Windows cannot unload your registry file. The memory used by the registry has not been freed. This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account. If this problem persists, contact your administrator.


DETAIL - Insufficient system resources exist to complete the requested service.

Error: (01/17/2012 00:20:00 AM) (Source: COM+) (User: )
Description: The run-time environment was unable to initialize for transactions required to support transactional components. Make sure that MS-DTC is running. (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (01/16/2012 11:21:08 PM) (Source: COM+) (User: )
Description: The run-time environment was unable to initialize for transactions required to support transactional components. Make sure that MS-DTC is running. (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (01/16/2012 10:35:12 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422].

Error: (01/16/2012 10:25:16 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422].

Error: (01/16/2012 10:22:19 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422].

Error: (01/16/2012 10:22:16 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422].

Error: (01/16/2012 10:22:12 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422].

Error: (01/16/2012 10:21:40 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422].

Error: (01/16/2012 10:20:53 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422].


System errors:
=============
Error: (01/17/2012 08:43:25 PM) (Source: Service Control Manager) (User: )
Description: The TuneUp Utilities Service service terminated unexpectedly. It has done this 1 time(s).

Error: (01/17/2012 08:43:25 PM) (Source: Service Control Manager) (User: )
Description: The NVIDIA Driver Helper Service service terminated unexpectedly. It has done this 1 time(s).

Error: (01/17/2012 08:34:12 PM) (Source: Service Control Manager) (User: )
Description: The Sansa Updater Service service failed to start due to the following error:
%%2

Error: (01/17/2012 08:34:12 PM) (Source: Service Control Manager) (User: )
Description: The HID Input Service service terminated with the following error:
%%2

Error: (01/17/2012 08:34:12 PM) (Source: Service Control Manager) (User: )
Description: The adfs service failed to start due to the following error:
%%2

Error: (01/17/2012 00:13:25 AM) (Source: Service Control Manager) (User: )
Description: The Sansa Updater Service service failed to start due to the following error:
%%2

Error: (01/17/2012 00:13:25 AM) (Source: Service Control Manager) (User: )
Description: The HID Input Service service terminated with the following error:
%%2

Error: (01/17/2012 00:13:25 AM) (Source: Service Control Manager) (User: )
Description: The adfs service failed to start due to the following error:
%%2

Error: (01/16/2012 10:35:12 PM) (Source: DCOM) (User: SYSTEM)
Description: DCOM got error "%%1058" attempting to start the service SwPrv with arguments ""
in order to run the server:
{65EE1DBA-8FF4-4A58-AC1C-3470EE2F376A}

Error: (01/16/2012 10:25:16 PM) (Source: DCOM) (User: SYSTEM)
Description: DCOM got error "%%1058" attempting to start the service SwPrv with arguments ""
in order to run the server:
{65EE1DBA-8FF4-4A58-AC1C-3470EE2F376A}


Microsoft Office Sessions:
=========================
Error: (01/17/2012 08:33:09 PM) (Source: Userenv)(User: SYSTEM)SYSTEM
Description: Insufficient system resources exist to complete the requested service.

Error: (01/17/2012 00:20:00 AM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (01/16/2012 11:21:08 PM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (01/16/2012 10:35:12 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422

Error: (01/16/2012 10:25:16 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422

Error: (01/16/2012 10:22:19 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422

Error: (01/16/2012 10:22:16 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422

Error: (01/16/2012 10:22:12 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422

Error: (01/16/2012 10:21:40 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422

Error: (01/16/2012 10:20:53 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422


=========================== Installed Programs ============================

32 Bit HP CIO Components Installer (Version: 6.1.1)
ACDSee Pro 2.5 (Version: 2.5.363)
ACDSee RAW Image Decoder Plug-In Update 4.0 (Version: 4.0.70)
Actiontec Gateway
Adobe Flash Player 10 ActiveX (Version: 10.1.53.64)
Adobe Flash Player 11 Plugin (Version: 11.0.1.152)
Adobe Reader X (10.1.1) (Version: 10.1.1)
Adobe Shockwave Player 11.5 (Version: 11.5.9.615)
Apple Application Support (Version: 1.4.1)
Apple Mobile Device Support (Version: 3.3.0.69)
Apple Software Update (Version: 2.1.3.127)
Arts & Letters EXPRESS Home
ASUS nVidia Driver (Version: 1.00.0000)
ATI Display Driver (Version: 8.152-050629m-025707C-Asus)
Audacity 1.2.6
Avery DesignPro
Avery Wizard 3.1 (Version: 3.1.5)
Avira Free Antivirus (Version: 12.0.0.872)
Azureus (Version: 2.5.0.4)
Bonjour (Version: 2.0.4.0)
CCleaner (Version: 3.14)
ClearType Tuning Control Panel Applet (Version: 1.01.0000)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
CompuPic
ConvertXtoDVD 3.7.3.190b (Version: 3.7.3.190b)
Coupon Printer for Windows (Version: 5.0.0.0)
D5100_Help (Version: 70.0.260.000)
DAZzle
DIGOpt (Version: 9.0.0917.2)
Driver Detective (Version: 6.0.0.0)
DVD Shrink 3.2
ESPN Java Check
exPressit S.E. 2.1
EZ Vinyl/Tape Converter 1.5.2.0 by MixMeister
HiJackThis (Version: 1.0.0)
HijackThis 1.98.2 (Version: 1.98.2)
HP Photosmart C4600 All-In-One Driver 13.0 Rel .5 (Version: 13.0)
hph_readme (Version: 70.0.260.000)
hph_software_req (Version: 70.0.260.000)
HPPhotoSmartExpress (Version: 70.0.170.000)
iTunes (Version: 10.1.1.4)
Java Auto Updater (Version: 2.0.6.1)
Java™ 6 Update 30 (Version: 6.0.300)
LAME v3.98.3 for Audacity
LG ODD Auto Firmware Update (Version: 1.01.0412.01)
LightScribe System Software (Version: 1.18.19.1)
LightScribe Template Labeler (Version: 1.18.15.1)
Logitech Webcam Software (Version: 12.10.1113)
Malwarebytes Anti-Malware version 1.60.0.1800 (Version: 1.60.0.1800)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 9.0.1 (x86 en-US) (Version: 9.0.1)
Mozilla Thunderbird (3.1.10) (Version: 3.1.10 (en-US))
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
Nero 7 Ultra Edition (Version: 7.00.2028)
NVIDIA Control Panel 280.26 (Version: 280.26)
NVIDIA Display Control Panel (Version: 6.14.11.9745)
NVIDIA Graphics Driver 280.26 (Version: 280.26)
NVIDIA HD Audio Driver 1.2.23.3 (Version: 1.2.23.3)
NVIDIA Install Application (Version: 2.1000.25.170)
NVIDIA nView 135.94 (Version: 135.94)
NVIDIA nView Desktop Manager (Version: 6.14.10.13594)
NVIDIA PhysX (Version: 9.10.0514)
NVIDIA PhysX System Software 9.10.0514 (Version: 9.10.0514)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PC Probe II (Version: 1.01.10)
Pdf995 (installed by H&R Block)
Personal Ancestral File 5
Portrait Professional Max 6.3 (Version: 6.3)
ProShow Gold
PS_AIO_05_C4600_Software_Min (Version: 130.0.425.000)
QuickConnect (Version: 3.2)
QuickConnect (Version: 3.8)
QuickTime (Version: 7.69.80.9)
Qwest eChat Support Tools (Version: 4)
Qwest Quickcare 2.7 (Version: 2.7.1002.1512)
REALTEK GbE & FE Ethernet PCI-E NIC Driver (Version: 1.29.0000)
Sansa Updater
Scan (Version: 13.0.0.0)
ScenalyzerLive (remove)
Segoe UI (Version: 14.0.4327.805)
Sonic Foundry DVD Architect 1.0c (Version: 1.0.203)
Sonic Foundry Vegas 4.0d (Version: 4.0.205)
SoundMAX (Version: 5.10.01.6310)
Spybot - Search & Destroy (Version: 1.6.2)
System Requirements Lab
Toolbox (Version: 130.0.648.000)
Toolbox (Version: 70.0.170.000)
TuneUp Utilities 2012 (Version: 12.0.2160.13)
TuneUp Utilities Language Pack (en-US) (Version: 10.0.4410.11)
TuneUp Utilities Language Pack (en-US) (Version: 12.0.2160.13)
TuneUp Utilities Language Pack (en-US) (Version: 9.0.4700.23)
ubCore (Version: 4.0)
ULi M5288 SATA Controller Driver
ULi Sata Driver (Version: 1.0.5.8)
ULi USB2.0 Controller Driver
Unload (Version: 7.0.0)
USB Video Driver (Version: 1.00)
VLC media player 1.1.11 (Version: 1.1.11)
Vuze
WebFldrs XP (Version: 9.50.6513)
Windows Driver Package - Advanced Micro Devices, Inc. (USB28xxBGA) Media (04/27/2007 5.7.0427.0) (Version: 04/27/2007 5.7.0427.0)
Windows Driver Package - eMPIA Technology Inc, (emAudio) MEDIA (04/27/2007 5.7.0427.0) (Version: 04/27/2007 5.7.0427.0)
Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows Movie Maker 2.0 (Version: 2.0.0000)
WinRAR archiver

========================= Devices: ================================


========================= Memory info: ===================================

Percentage of memory in use: 39%
Total physical RAM: 959.23 MB
Available physical RAM: 584.6 MB
Total Pagefile: 2313.63 MB
Available Pagefile: 2001.76 MB
Total Virtual: 2047.88 MB
Available Virtual: 1969.76 MB

========================= Partitions: =====================================

2 Drive c: () (Fixed) (Total:19.17 GB) (Free:3.82 GB) NTFS
3 Drive d: (New Volume) (Fixed) (Total:128 GB) (Free:92.11 GB) NTFS
4 Drive e: (PART2) (Fixed) (Total:19.16 GB) (Free:12.49 GB) FAT32
5 Drive f: (New Volume) (Fixed) (Total:58.31 GB) (Free:37.36 GB) NTFS

========================= Users: ========================================

User accounts for \\WMCOT-2Z7933YG4

Administrator ASPNET Guest
HelpAssistant SUPPORT_388945a0 UpdatusUser
wmcot

========================= Minidump Files ==================================

No minidump file found

**** End of log ****

#4 wmcot

wmcot
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Salt Lake City, Utah
  • Local time:04:55 AM

Posted 18 January 2012 - 01:03 AM

No detections in ESET.

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,912 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:55 AM

Posted 18 January 2012 - 02:46 PM

Hello, Perhaps there are a couple corrupt files,if yhis don;t work we'll need to open a new topic in XP up top.


Please run SFC (System File Checker)
Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files

NOTE for Vista/WIN 7 users..The command needs to be run from an Elevated Command Prompt.Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the CD when asked.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 wmcot

wmcot
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Salt Lake City, Utah
  • Local time:04:55 AM

Posted 18 January 2012 - 09:39 PM

I wondered if there were still some hidden files so I tried running Unhide.exe again. Apparently it didn't complete when I ran it originally but this time it went through all my partitions and everything seems to be back to normal now.

I guess there were still some files hidden deep within my system.

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,912 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:55 AM

Posted 18 January 2012 - 10:09 PM

OK, great! If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Tips to protect yourself against malware and reduce the potential for re-infection:Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read:
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 wmcot

wmcot
  • Topic Starter

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Salt Lake City, Utah
  • Local time:04:55 AM

Posted 18 January 2012 - 10:39 PM

Thanks. I disabled system restore when I began the process of cleaning the computer. I am running a final Malwarbytes scan now and I will create a system restore point as soon as it finishes.

I normally use CCleaner to cleanup my disk and TuneUp Utilities 2012 to delete old restore points and clean the registry.

The weird thing about this infection is that I was only on for a few minutes and I went to a few auto racing and news websites that I frequent. Nothing out of the ordinary.


Anyway, thanks for all the help and the great tools! Your site rocks!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users