HighlyFavored1

December 14, 2012

I will follow all of your advice in post #14 above.

Again, thank you so much screen317!!!! I really appreciate all that you did to help me clean this machine up.

Hope you have a Merry Christmas!!!

-HighlyFavored1

December 11, 2012

screen317,

It is running just fine. I thank you so much for your time and assistance with the cleaning of my machine. I greatly appreciate it. I will uninstall adwcleaner.exe and get defraggler and run the defragmentation.

Thanks again for everything!

-HighlyFavored1

December 6, 2012

Hi,

Screen317, should I replace the Windows defragmenter with the Defraggler? I it is check to replace it during the install process. Should I leave it checked to replace the Windows Defragmenter?

Everything else is done

December 6, 2012

Hi,

Here is the logfile with the results of the AdwCleaner after clicking delete:

# AdwCleaner v2.011 - Logfile created 12/06/2012 at 07:44:05

# Updated 02/12/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : Troy - GEORGE

# Boot Mode : Normal

# Running from : C:\Documents and Settings\Troy\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt

Folder Deleted : C:\Documents and Settings\All Users\Application Data\Trymedia

Folder Deleted : C:\Program Files\Common Files\Software Update Utility

Folder Deleted : C:\Program Files\PlaySushi

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{E89A07B5-BD7A-43F9-BDA4-0DAA48AC4FA5}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

Key Deleted : HKLM\SOFTWARE\Classes\AppID\PSText.DLL

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Key Deleted : HKLM\SOFTWARE\FCTB000060231

Key Deleted : HKLM\Software\Freeze.com

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mywebsearch bar uninstall

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PlaySushi

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

Key Deleted : HKLM\Software\TENCENT

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [5069 octets] - [01/12/2012 20:15:54]

AdwCleaner[R2].txt - [4800 octets] - [06/12/2012 07:42:59]

AdwCleaner[s1].txt - [4837 octets] - [06/12/2012 07:44:05]

########## EOF - C:\AdwCleaner[s1].txt - [4897 octets] ##########

I will complete the last things listed in your post (#9):

Uninstalling ComboFix components as well as SecurityCheck and TDSSKiller.

Then I will uninstall Java 6 Update 21, Adobe Flash Player 10, Adobe Reader XI and Adobe Reader 8.

Restart laptop.

Then install the latest versions of Java, Adobe Reader and Adobe Flash Player

Reboot and then defrag the system with Defraggler.

I will also delete that profile (Sonja) after saving anything of importance in it.

Thank you for all of your assistance and help with this matter Screen317. Please let me know if I need to do anything further after this post.

-HighlyFavored1

December 2, 2012

Screen317

I received this laptop from my sister (Sonja) which was the only user profile on the laptop when I received it. All of the issues appear to be associated with that profile.

I could only run MBAM logged on that user profile in normal log on. DDS.txt and Attach.txt I could not download using that profile in normal mode. I had to log in "safe mode" to download DDS.

I recently created the user profile Troy to attempt the scans and logs that you last asked for. In normal mode the only thing I could not download was ESET. I went into "safe mode" to download but logged in normal mode to run the scan. Other than that everything else worked in normal mode.

After posting the logs you last requested, I logged in normally as the user profile "Sonja" and the attached screen shot appears at every attempt to open Internet Explorer.

The internet appears to work fine with the new user profile "Troy". If need be, I can delete the user profile "Sonja". Unless after completion of the cleaning you are assisting me with fixes that user profile.

I just wanted to advise you of this but as I said in the previous post, I will await further instructions from you. Thanks again.

December 2, 2012

Hi,
Run TFC by OldTimer to clear temporary files:

Please download TFC from here and save it to your desktop.
Close any open programs and Internet browsers.
Double click TFC.exe to run it and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your Desktop or save it for later use for the cleaning of temporary files.

Download the file TDSSKiller.zip and extract it into a folder on the infected PC.
Execute the file TDSSKiller.exe by double-clicking on it.
Wait for the scan and disinfection process to be over.
When its work is over, the utility prompts for a reboot to complete the disinfection.
By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).
The log is like UtilityName.Version_Date_Time_log.txt.
for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.
Please post that log here.
17:31:37.0859 3912 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
17:31:38.0375 3912 ============================================================
17:31:38.0375 3912 Current date / time: 2012/12/01 17:31:38.0375
17:31:38.0375 3912 SystemInfo:
17:31:38.0375 3912
17:31:38.0375 3912 OS Version: 5.1.2600 ServicePack: 3.0
17:31:38.0375 3912 Product type: Workstation
17:31:38.0375 3912 ComputerName: GEORGE
17:31:38.0375 3912 UserName: Troy
17:31:38.0375 3912 Windows directory: C:\WINDOWS
17:31:38.0375 3912 System windows directory: C:\WINDOWS
17:31:38.0375 3912 Processor architecture: Intel x86
17:31:38.0375 3912 Number of processors: 1
17:31:38.0375 3912 Page size: 0x1000
17:31:38.0375 3912 Boot type: Normal boot
17:31:38.0375 3912 ============================================================
17:31:40.0328 3912 Drive \Device\Harddisk0\DR0 - Size: 0x950A60000 (37.26 Gb), SectorSize: 0x200, Cylinders: 0x1300, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:31:40.0328 3912 ============================================================
17:31:40.0328 3912 \Device\Harddisk0\DR0:
17:31:40.0328 3912 MBR partitions:
17:31:40.0328 3912 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x5DA43D, BlocksNum 0x44A7002
17:31:40.0328 3912 ============================================================
17:31:40.0328 3912 Initialize success
17:31:40.0328 3912 ============================================================
17:31:42.0062 2516 ============================================================
17:31:42.0062 2516 Scan started
17:31:42.0062 2516 Mode: Manual;
17:31:42.0062 2516 ============================================================
17:31:43.0109 2516 ================ Scan system memory ========================
17:31:43.0109 2516 System memory - ok
17:31:43.0109 2516 ================ Scan services =============================
17:31:43.0171 2516 Abiosdsk - ok
17:31:43.0203 2516 abp480n5 - ok
17:31:43.0218 2516 ACDaemon - ok
17:31:43.0234 2516 ACPI - ok
17:31:43.0265 2516 ACPIEC - ok
17:31:43.0281 2516 adpu160m - ok
17:31:43.0312 2516 aec - ok
17:31:43.0328 2516 AFD - ok
17:31:43.0343 2516 AgereSoftModem - ok
17:31:43.0375 2516 Aha154x - ok
17:31:43.0390 2516 aic78u2 - ok
17:31:43.0421 2516 aic78xx - ok
17:31:43.0421 2516 ALCXWDM - ok
17:31:43.0453 2516 Alerter - ok
17:31:43.0468 2516 ALG - ok
17:31:43.0484 2516 AliIde - ok
17:31:43.0500 2516 AmdK8 - ok
17:31:43.0515 2516 amsint - ok
17:31:43.0531 2516 anbmService - ok
17:31:43.0546 2516 Apple Mobile Device - ok
17:31:43.0578 2516 AppMgmt - ok
17:31:43.0593 2516 asc - ok
17:31:43.0609 2516 asc3350p - ok
17:31:43.0625 2516 asc3550 - ok
17:31:43.0671 2516 aspnet_state - ok
17:31:43.0671 2516 AsyncMac - ok
17:31:43.0687 2516 atapi - ok
17:31:43.0703 2516 Atdisk - ok
17:31:43.0734 2516 Atmarpc - ok
17:31:43.0750 2516 AudioSrv - ok
17:31:43.0765 2516 audstub - ok
17:31:43.0781 2516 BCM43XX - ok
17:31:43.0796 2516 Beep - ok
17:31:43.0828 2516 BITS - ok
17:31:43.0843 2516 Bonjour Service - ok
17:31:43.0859 2516 Browser - ok
17:31:43.0875 2516 catchme - ok
17:31:43.0890 2516 cbidf2k - ok
17:31:43.0906 2516 CCDECODE - ok
17:31:43.0921 2516 cd20xrnt - ok
17:31:43.0937 2516 Cdaudio - ok
17:31:43.0953 2516 Cdfs - ok
17:31:43.0968 2516 Cdrom - ok
17:31:43.0984 2516 Changer - ok
17:31:44.0000 2516 CiSvc - ok
17:31:44.0015 2516 ClipSrv - ok
17:31:44.0031 2516 clr_optimization_v2.0.50727_32 - ok
17:31:44.0062 2516 CmBatt - ok
17:31:44.0078 2516 CmdIde - ok
17:31:44.0093 2516 Compbatt - ok
17:31:44.0109 2516 COMSysApp - ok
17:31:44.0140 2516 Cpqarray - ok
17:31:44.0156 2516 CryptSvc - ok
17:31:44.0171 2516 dac2w2k - ok
17:31:44.0187 2516 dac960nt - ok
17:31:44.0203 2516 DcomLaunch - ok
17:31:44.0218 2516 Dhcp - ok
17:31:44.0234 2516 Disk - ok
17:31:44.0250 2516 DKbFltr - ok
17:31:44.0265 2516 dmadmin - ok
17:31:44.0281 2516 dmboot - ok
17:31:44.0312 2516 dmio - ok
17:31:44.0328 2516 dmload - ok
17:31:44.0343 2516 dmserver - ok
17:31:44.0359 2516 DMusic - ok
17:31:44.0375 2516 Dnscache - ok
17:31:44.0390 2516 Dot3svc - ok
17:31:44.0406 2516 dpti2o - ok
17:31:44.0421 2516 drmkaud - ok
17:31:44.0437 2516 drvmcdb - ok
17:31:44.0453 2516 drvnddm - ok
17:31:44.0484 2516 EapHost - ok
17:31:44.0500 2516 ERSvc - ok
17:31:44.0515 2516 Eventlog - ok
17:31:44.0531 2516 EventSystem - ok
17:31:44.0546 2516 Fastfat - ok
17:31:44.0562 2516 FastUserSwitchingCompatibility - ok
17:31:44.0578 2516 Fax - ok
17:31:44.0593 2516 Fdc - ok
17:31:44.0609 2516 Fips - ok
17:31:44.0640 2516 Flpydisk - ok
17:31:44.0656 2516 FltMgr - ok
17:31:44.0671 2516 FontCache3.0.0.0 - ok
17:31:44.0687 2516 Fs_Rec - ok
17:31:44.0687 2516 Ftdisk - ok
17:31:44.0718 2516 gagp30kx - ok
17:31:44.0734 2516 GEARAspiWDM - ok
17:31:44.0750 2516 Gpc - ok
17:31:44.0765 2516 gupdate - ok
17:31:44.0781 2516 gupdatem - ok
17:31:44.0796 2516 gusvc - ok
17:31:44.0812 2516 helpsvc - ok
17:31:44.0828 2516 HidServ - ok
17:31:44.0843 2516 HidUsb - ok
17:31:44.0875 2516 hkmsvc - ok
17:31:44.0890 2516 hpn - ok
17:31:44.0906 2516 HPZid412 - ok
17:31:44.0921 2516 HPZipr12 - ok
17:31:44.0937 2516 HPZius12 - ok
17:31:44.0953 2516 HTTP - ok
17:31:44.0968 2516 HTTPFilter - ok
17:31:44.0984 2516 i2omgmt - ok
17:31:45.0000 2516 i2omp - ok
17:31:45.0015 2516 i8042prt - ok
17:31:45.0031 2516 ICAM5USB - ok
17:31:45.0046 2516 IDriverT - ok
17:31:45.0062 2516 idsvc - ok
17:31:45.0656 2516 Imapi - ok
17:31:45.0671 2516 ImapiService - ok
17:31:45.0703 2516 ini910u - ok
17:31:45.0734 2516 int15.sys - ok
17:31:45.0750 2516 IntelIde - ok
17:31:45.0765 2516 Ip6Fw - ok
17:31:45.0796 2516 IpFilterDriver - ok
17:31:45.0812 2516 IpInIp - ok
17:31:45.0843 2516 IpNat - ok
17:31:45.0859 2516 IPSec - ok
17:31:45.0875 2516 IRENUM - ok
17:31:45.0906 2516 isapnp - ok
17:31:45.0921 2516 JavaQuickStarterService - ok
17:31:45.0937 2516 Kbdclass - ok
17:31:45.0953 2516 kbdhid - ok
17:31:45.0953 2516 kmixer - ok
17:31:45.0984 2516 KSecDD - ok
17:31:46.0000 2516 lanmanserver - ok
17:31:46.0015 2516 lanmanworkstation - ok
17:31:46.0031 2516 lbrtfdc - ok
17:31:46.0062 2516 LmHosts - ok
17:31:46.0093 2516 LMIInfo - ok
17:31:46.0109 2516 LMIMaint - ok
17:31:46.0125 2516 lmimirr - ok
17:31:46.0140 2516 LMIRfsClientNP - ok
17:31:46.0156 2516 LMIRfsDriver - ok
17:31:46.0171 2516 LogMeIn - ok
17:31:46.0187 2516 LVUSBSta - ok
17:31:46.0203 2516 MCSTRM - ok
17:31:46.0218 2516 Messenger - ok
17:31:46.0234 2516 mnmdd - ok
17:31:46.0250 2516 mnmsrvc - ok
17:31:46.0265 2516 Modem - ok
17:31:46.0281 2516 Mouclass - ok
17:31:46.0296 2516 mouhid - ok
17:31:46.0312 2516 MountMgr - ok
17:31:46.0343 2516 mraid35x - ok
17:31:46.0359 2516 MREMPR5 - ok
17:31:46.0375 2516 MRENDIS5 - ok
17:31:46.0390 2516 MRxDAV - ok
17:31:46.0406 2516 MRxSmb - ok
17:31:46.0421 2516 MSDTC - ok
17:31:46.0453 2516 Msfs - ok
17:31:46.0468 2516 MSIServer - ok
17:31:46.0468 2516 MSKSSRV - ok
17:31:46.0484 2516 MSPCLOCK - ok
17:31:46.0515 2516 MSPQM - ok
17:31:46.0531 2516 mssmbios - ok
17:31:46.0546 2516 MSTEE - ok
17:31:46.0562 2516 Mup - ok
17:31:46.0578 2516 NABTSFEC - ok
17:31:46.0593 2516 napagent - ok
17:31:46.0609 2516 NDIS - ok
17:31:46.0625 2516 NdisIP - ok
17:31:46.0640 2516 NdisTapi - ok
17:31:46.0671 2516 Ndisuio - ok
17:31:46.0687 2516 NdisWan - ok
17:31:46.0703 2516 NDProxy - ok
17:31:46.0718 2516 NetBIOS - ok
17:31:46.0718 2516 NetBT - ok
17:31:46.0734 2516 NetDDE - ok
17:31:46.0765 2516 NetDDEdsdm - ok
17:31:46.0781 2516 Netlogon - ok
17:31:46.0796 2516 Netman - ok
17:31:46.0812 2516 NetTcpPortSharing - ok
17:31:46.0828 2516 Nla - ok
17:31:46.0843 2516 Npfs - ok
17:31:46.0859 2516 Ntfs - ok
17:31:46.0875 2516 NTIDrvr - ok
17:31:46.0890 2516 NtLmSsp - ok
17:31:46.0906 2516 NtmsSvc - ok
17:31:46.0937 2516 NuidFltr - ok
17:31:46.0953 2516 Null - ok
17:31:46.0968 2516 NwlnkFlt - ok
17:31:46.0984 2516 NwlnkFwd - ok
17:31:46.0984 2516 osaio - ok
17:31:47.0000 2516 osanbm - ok
17:31:47.0031 2516 ose - ok
17:31:47.0046 2516 Parport - ok
17:31:47.0062 2516 PartMgr - ok
17:31:47.0078 2516 ParVdm - ok
17:31:47.0109 2516 PCI - ok
17:31:47.0125 2516 PCIDump - ok
17:31:47.0140 2516 PCIIde - ok
17:31:47.0156 2516 Pcmcia - ok
17:31:47.0171 2516 pcouffin - ok
17:31:47.0187 2516 PDCOMP - ok
17:31:47.0203 2516 PDFRAME - ok
17:31:47.0218 2516 PDRELI - ok
17:31:47.0234 2516 PDRFRAME - ok
17:31:47.0250 2516 pepifilter - ok
17:31:47.0265 2516 perc2 - ok
17:31:47.0281 2516 perc2hib - ok
17:31:47.0328 2516 pfc - ok
17:31:47.0343 2516 PID_PEPI - ok
17:31:47.0375 2516 PlugPlay - ok
17:31:47.0390 2516 Pml Driver HPZ12 - ok
17:31:47.0406 2516 PolicyAgent - ok
17:31:47.0421 2516 PptpMiniport - ok
17:31:47.0437 2516 ProtectedStorage - ok
17:31:47.0453 2516 PSched - ok
17:31:47.0468 2516 Ptilink - ok
17:31:47.0484 2516 ql1080 - ok
17:31:47.0500 2516 Ql10wnt - ok
17:31:47.0515 2516 ql12160 - ok
17:31:47.0531 2516 ql1240 - ok
17:31:47.0546 2516 ql1280 - ok
17:31:47.0562 2516 RasAcd - ok
17:31:47.0578 2516 RasAuto - ok
17:31:47.0593 2516 Rasl2tp - ok
17:31:47.0625 2516 RasMan - ok
17:31:47.0640 2516 RasPppoe - ok
17:31:47.0656 2516 Raspti - ok
17:31:47.0671 2516 Rdbss - ok
17:31:47.0687 2516 RDPCDD - ok
17:31:47.0718 2516 RDPWD - ok
17:31:47.0734 2516 RDSessMgr - ok
17:31:47.0750 2516 redbook - ok
17:31:47.0765 2516 RemoteAccess - ok
17:31:47.0796 2516 RpcLocator - ok
17:31:47.0812 2516 RpcSs - ok
17:31:47.0828 2516 RSVP - ok
17:31:47.0843 2516 SamSs - ok
17:31:47.0859 2516 SCardSvr - ok
17:31:47.0875 2516 Schedule - ok
17:31:47.0906 2516 Secdrv - ok
17:31:47.0921 2516 seclogon - ok
17:31:47.0937 2516 SENS - ok
17:31:47.0953 2516 Serial - ok
17:31:48.0000 2516 Sfloppy - ok
17:31:48.0015 2516 SharedAccess - ok
17:31:48.0015 2516 ShellHWDetection - ok
17:31:48.0031 2516 Simbad - ok
17:31:48.0046 2516 SiS315 - ok
17:31:48.0078 2516 SISAGP - ok
17:31:48.0093 2516 SiSide - ok
17:31:48.0109 2516 sisidex - ok
17:31:48.0125 2516 SiSkp - ok
17:31:48.0140 2516 SISNICXP - ok
17:31:48.0156 2516 sisperf - ok
17:31:48.0171 2516 SLIP - ok
17:31:48.0203 2516 Sparrow - ok
17:31:48.0218 2516 SPDISK - ok
17:31:48.0234 2516 splitter - ok
17:31:48.0250 2516 Spooler - ok
17:31:48.0265 2516 sr - ok
17:31:48.0281 2516 srservice - ok
17:31:48.0296 2516 Srv - ok
17:31:48.0312 2516 sscdbhk5 - ok
17:31:48.0328 2516 SSDPSRV - ok
17:31:48.0343 2516 ssrtln - ok
17:31:48.0359 2516 stisvc - ok
17:31:48.0375 2516 streamip - ok
17:31:48.0390 2516 swenum - ok
17:31:48.0421 2516 swmidi - ok
17:31:48.0437 2516 SwPrv - ok
17:31:48.0453 2516 symc810 - ok
17:31:48.0468 2516 symc8xx - ok
17:31:48.0500 2516 SymIM - ok
17:31:48.0515 2516 SymIMMP - ok
17:31:48.0531 2516 sym_hi - ok
17:31:48.0531 2516 sym_u3 - ok
17:31:48.0546 2516 SynTP - ok
17:31:48.0578 2516 sysaudio - ok
17:31:48.0593 2516 SysmonLog - ok
17:31:48.0609 2516 TapiSrv - ok
17:31:48.0625 2516 Tcpip - ok
17:31:48.0640 2516 TDPIPE - ok
17:31:48.0656 2516 TDTCP - ok
17:31:48.0671 2516 TermDD - ok
17:31:48.0687 2516 TermService - ok
17:31:48.0703 2516 tfsnboio - ok
17:31:48.0718 2516 tfsncofs - ok
17:31:48.0750 2516 tfsndrct - ok
17:31:48.0765 2516 tfsndres - ok
17:31:48.0781 2516 tfsnifs - ok
17:31:48.0781 2516 tfsnopio - ok
17:31:48.0796 2516 tfsnpool - ok
17:31:48.0828 2516 tfsnudf - ok
17:31:48.0843 2516 tfsnudfa - ok
17:31:48.0859 2516 Themes - ok
17:31:48.0875 2516 TosIde - ok
17:31:48.0890 2516 TrkWks - ok
17:31:48.0921 2516 TVICHW32 - ok
17:31:48.0937 2516 UBHelper - ok
17:31:48.0953 2516 Udfs - ok
17:31:48.0968 2516 ultra - ok
17:31:48.0984 2516 Update - ok
17:31:49.0015 2516 upnphost - ok
17:31:49.0031 2516 UPS - ok
17:31:49.0046 2516 USBAAPL - ok
17:31:49.0062 2516 usbaudio - ok
17:31:49.0078 2516 usbccgp - ok
17:31:49.0093 2516 usbehci - ok
17:31:49.0109 2516 usbhub - ok
17:31:49.0125 2516 usbohci - ok
17:31:49.0140 2516 usbprint - ok
17:31:49.0156 2516 usbscan - ok
17:31:49.0187 2516 USBSTOR - ok
17:31:49.0203 2516 VgaSave - ok
17:31:49.0218 2516 ViaIde - ok
17:31:49.0234 2516 VolSnap - ok
17:31:49.0250 2516 VSS - ok
17:31:49.0281 2516 W32Time - ok
17:31:49.0296 2516 Wanarp - ok
17:31:49.0312 2516 Wdf01000 - ok
17:31:49.0328 2516 WDICA - ok
17:31:49.0343 2516 wdmaud - ok
17:31:49.0359 2516 WebClient - ok
17:31:49.0390 2516 winmgmt - ok
17:31:49.0468 2516 winusb - ok
17:31:49.0484 2516 WmdmPmSN - ok
17:31:49.0515 2516 WmiApSrv - ok
17:31:49.0531 2516 WMPNetworkSvc - ok
17:31:49.0546 2516 WpdUsb - ok
17:31:49.0562 2516 WS2IFSL - ok
17:31:49.0578 2516 wscsvc - ok
17:31:49.0593 2516 WSTCODEC - ok
17:31:49.0609 2516 wuauserv - ok
17:31:49.0625 2516 WudfPf - ok
17:31:49.0640 2516 WudfRd - ok
17:31:49.0656 2516 WudfSvc - ok
17:31:49.0671 2516 WZCSVC - ok
17:31:49.0703 2516 xmlprov - ok
17:31:49.0734 2516 ================ Scan global ===============================
17:31:49.0734 2516 [Global] - ok
17:31:49.0750 2516 ================ Scan MBR ==================================
17:31:49.0765 2516 [ 99852D5C3A78447C3D6D82B6155FE848 ] \Device\Harddisk0\DR0
17:31:53.0296 2516 \Device\Harddisk0\DR0 - ok
17:31:53.0296 2516 ================ Scan VBR ==================================
17:31:53.0312 2516 [ 0AF962E960F5C7ECDF322C209A98EDD1 ] \Device\Harddisk0\DR0\Partition1
17:31:53.0312 2516 \Device\Harddisk0\DR0\Partition1 - ok
17:31:53.0312 2516 ============================================================
17:31:53.0312 2516 Scan finished
17:31:53.0312 2516 ============================================================
17:31:53.0343 0760 Detected object count: 0
17:31:53.0343 0760 Actual detected object count: 0
17:31:57.0578 2184 Deinitialize success
Next, please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Export the threats found (if any), and post them here.
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1646\A0332875.dll Win32/Adware.Gamevance application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1646\A0332876.exe a variant of Win32/Adware.Gamevance.AE application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1646\A0332877.scr Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1646\A0332878.DLL probably a variant of Win32/Toolbar.MyWay application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1646\A0332879.DLL a variant of Win32/Toolbar.MyWebSearch.K application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333087.EXE Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333088.EXE Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333089.DLL Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333090.DLL Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333091.DLL Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333092.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333093.DLL Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333094.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333095.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333096.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333097.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333098.DLL Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333099.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333100.DLL Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333101.DLL Win32/Toolbar.MyWebSearch.J application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333102.dll Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333103.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333104.SCR Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333105.DLL Win32/Toolbar.MyWebSearch.G application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333106.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333107.EXE Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333108.DLL Win32/FunWeb application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333109.DLL Win32/Toolbar.MyWebSearch.H application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333113.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333114.EXE Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333117.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333118.EXE Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333119.EXE Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333120.EXE Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333121.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP1648\A0333122.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
Next, please download AdwCleaner by Xplode onto your Desktop.

Double click on AdwCleaner.exe to run the tool.
Click on Search.
A logfile will automatically open after the scan has finished.
Please post the content of that logfile in your reply.
You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.
# AdwCleaner v2.010 - Logfile created 12/01/2012 at 20:15:54
# Updated 29/11/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Troy - GEORGE
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Troy\Desktop\adwcleaner.exe
# Option [search]
***** [services] *****
***** [Files / Folders] *****
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt
Folder Found : C:\Documents and Settings\All Users\Application Data\Trymedia
Folder Found : C:\Program Files\Common Files\Software Update Utility
Folder Found : C:\Program Files\PlaySushi
***** [Registry] *****
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{E89A07B5-BD7A-43F9-BDA4-0DAA48AC4FA5}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\PSText.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
Key Found : HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
Key Found : HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Key Found : HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
Key Found : HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\FCTB000060231
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mywebsearch bar uninstall
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PlaySushi
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\Software\TENCENT
Key Found : HKU\S-1-5-21-3222023231-2948638799-1041803130-1010\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
***** [internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18702
[OK] Registry is clean.
*************************
AdwCleaner[R1].txt - [4940 octets] - [01/12/2012 20:15:54]
########## EOF - C:\AdwCleaner[R1].txt - [5000 octets] ##########
Next, download my Security Check from here.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Results of screen317's Security Check version 0.99.56
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
ESET Online Scanner v3
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.1.1000
Java 6 Update 21
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader 8 Adobe Reader out of Date!
Adobe Reader XI (KB403742..)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 49% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
Let me know how things are running now and what issues remain.
-screen317

Screen317

I hope I did this right by using the quote and posting the logs where they are. If not please let me know and I redo or whatever you need me to do.

The machine appears to be running great at this time. I will await further instructions from you. Again, Thank you so much for assisting in the cleaning of this machine.

-HighlyFavored1

November 28, 2012

Here are the logs for ComboFix and the new DDS as you requested. Please advise if you need anything else.

Thanks!

ComboFix 12-11-27.01 - Troy 11/27/2012 22:22:12.2.1 - x86 NETWORK

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.702.549 [GMT -6:00]

Running from: c:\documents and settings\Troy\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-28 )))))))))))))))))))))))))))))))

.

2012-11-24 06:01 . 2012-11-24 06:01 -------- d-----w- c:\windows\LastGood.Tmp

2012-11-24 05:39 . 2012-11-24 06:07 -------- d-----w- c:\documents and settings\Troy

2012-11-08 18:19 . 2012-11-08 18:19 -------- d-----w- c:\documents and settings\Owner.GEORGE\Local Settings\Application Data\PCHealth

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-30 00:54 . 2012-09-29 21:18 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SiSPower"="SiSPower.dll" [2005-02-26 49152]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]

"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-01-27 274608]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2008-6-22 217088]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2007-11-16 02:46 87352 ----a-w- c:\windows\system32\LMIinit.dll

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk

backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk

backup=c:\windows\pss\Utility Tray.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^George Hocker^Start Menu^Programs^Startup^Anapod Manager.lnk]

path=c:\documents and settings\George Hocker\Start Menu\Programs\Startup\Anapod Manager.lnk

backup=c:\windows\pss\Anapod Manager.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]

Alaunch [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]

2004-10-08 02:50 88363 -c--a-w- c:\windows\AGRSMMSG.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 -c--a-w- c:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]

2005-05-31 12:33 122941 -c--a-w- c:\windows\system32\dla\tfswctrl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2006-03-21 01:34 86960 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

2005-10-12 22:16 315392 -c--a-w- c:\program files\Launch Manager\QtZgAcer.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]

2007-08-03 23:09 63048 -c--a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Windows KeyHook]

2005-03-04 20:13 32768 -c--a-w- c:\windows\system32\Keyhook.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSPower]

2005-02-26 02:35 49152 -c----w- c:\windows\system32\SiSPower.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

2005-02-24 01:13 77824 -c--a-w- c:\windows\SOUNDMAN.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2004-10-08 06:43 688218 -c--a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]

2004-10-08 06:44 98394 -c--a-w- c:\program files\Synaptics\SynTP\SynTPLpr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

.

S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/3/2007 5:09 PM 12992]

S2 SPDISK;SPDISK;c:\windows\system32\drivers\spdisk.sys [1/2/2007 4:16 AM 48294]

S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [12/13/2006 8:24 PM 47360]

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-17 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]

.

2012-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-27 20:25]

.

2012-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-27 20:25]

.

2012-11-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3222023231-2948638799-1041803130-1009.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 19:33]

.

2012-11-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3222023231-2948638799-1041803130-1009.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 19:33]

.

2012-11-24 c:\windows\Tasks\User_Feed_Synchronization-{D7EBC81C-50ED-4530-8677-59A34A4DBDEE}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://global.acer.com

IE: {{5CFA5B80-01F4-420F-B18B-545712C8A1C8} - http://www.playsushi.com/About.ps?l=6&t=nBnuqYynS

TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

Name-Space Handler: ftp\DLA.IEClickMon - {A5A08E80-B472-11D2-89D1-0080C8C12A3A} -

Name-Space Handler: http\DLA.IEClickMon - {A5A08E80-B472-11D2-89D1-0080C8C12A3A} -

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} - hxxp://www.iolo.com/app/ocx/UpgradeVerify.ocx

.

------- File Associations -------

.

JSEFile=NOTEPAD.EXE %1

.

**************************************************************************

.

disk not found C:\

.

please note that you need administrator rights to perform deep scan

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files:

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(604)

c:\windows\system32\LMIinit.dll

c:\windows\system32\LMIRfsClientNP.dll

.

- - - - - - - > 'explorer.exe'(188)

c:\windows\system32\WININET.dll

.

Completion time: 2012-11-27 22:35:45

ComboFix-quarantined-files.txt 2012-11-28 04:35

ComboFix2.txt 2012-10-31 04:51

.

Pre-Run: 3,953,430,528 bytes free

Post-Run: 4,051,181,568 bytes free

.

- - End Of File - - 0766D3AD4CBF7FB1A99307873A1C2717

DDS LOG

DDS (Ver_2012-11-20.01) - NTFS_x86 NETWORK

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Run by Troy at 22:42:14 on 2012-11-27

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.702.399 [GMT -6:00]

.

============== Running Processes ================

.

C:\WINDOWS\explorer.exe

C:\Program Files\internet explorer\iexplore.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\internet explorer\iexplore.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://global.acer.com

BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: DriveLetterAccess: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\at&tse~1.lnk - c:\program files\sbc self support tool\bin\matcli.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: {5CFA5B80-01F4-420F-B18B-545712C8A1C8} - http://www.playsushi.com/About.ps?l=6&t=nBnuqYynS

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} - hxxp://download.mcafee.com/molbin/Shared/ComCtl32/6,0,80,22/ComCtl32.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab

DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154501112562

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - hxxp://download.abacast.com/download/files/abasetup162.cab

DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab

DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} - hxxp://www.iolo.com/app/ocx/UpgradeVerify.ocx

TCP: NameServer = 68.105.28.11 68.105.29.11 68.105.28.12

TCP: Interfaces\{8E8070A8-8804-4DDC-A8CF-7AD38275EC4C} : DHCPNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

Handler: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - <orphaned>

Name-Space Handler: ftp\DLA.IEClickMon - {A5A08E80-B472-11D2-89D1-0080C8C12A3A} -

Name-Space Handler: http\DLA.IEClickMon - {A5A08E80-B472-11D2-89D1-0080C8C12A3A} -

Notify: LMIinit - LMIinit.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

============= SERVICES / DRIVERS ===============

.

S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2007-8-3 12992]

S2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2007-11-11 46112]

S2 SPDISK;SPDISK;c:\windows\system32\drivers\spdisk.sys [2007-1-2 48294]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== File Associations ===============

.

FileExt: .jse: JSEFile=NOTEPAD.EXE %1

FileExt: .wsf: WSFFile=NOTEPAD.EXE %1

.

=============== Created Last 30 ================

.

2012-11-24 06:07:47 -------- d-sh--w- c:\documents and settings\troy\PrivacIE

2012-11-24 06:01:26 -------- d-----w- c:\windows\LastGood.Tmp

2012-11-24 05:43:46 -------- d-----w- c:\documents and settings\troy\local settings\application data\PCHealth

2012-11-24 05:40:50 -------- d-----w- c:\documents and settings\troy\application data\Malwarebytes

2012-11-24 05:40:36 -------- d-----w- c:\documents and settings\troy\local settings\application data\ArcSoft

2012-11-24 05:40:19 -------- d-sh--w- c:\documents and settings\troy\IETldCache

2012-10-31 04:24:03 -------- d-sha-r- C:\cmdcons

2012-10-31 04:21:51 98816 ----a-w- c:\windows\sed.exe

2012-10-31 04:21:51 256000 ----a-w- c:\windows\PEV.exe

2012-10-31 04:21:51 208896 ----a-w- c:\windows\MBR.exe

.

==================== Find3M ====================

.

2012-09-30 00:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

.

============= FINISH: 22:42:29.57 ===============

November 24, 2012

Hi Screen317,

Sorry for the delay in getting back to you. Here is the MBAM log of quick scan after updating MBAM and the dds.txt & attach.txt logs Please advise if you need any thing else. Thank you in advance for your assistance with the cleaning of my machine.

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Database version: v2012.11.24.03

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Troy :: GEORGE [administrator]

11/23/2012 11:42:13 PM

mbam-log-2012-11-23 (23-42-13).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 295760

Time elapsed: 24 minute(s), 24 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

DDS (Ver_2012-11-20.01) - NTFS_x86 NETWORK

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Run by Troy at 0:18:13 on 2012-11-24

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.702.490 [GMT -6:00]

.

============== Running Processes ================

.

C:\WINDOWS\Explorer.EXE