petronella

I hope my husband did not change the bios, we shall see. I know how to change the boot sequence in bios. Ok, I'll have to get to work on it a bit later as I am not at home atm. We will not be reinstalling XP on the box, we will be installing Vista. Not as good as 7 but better than XP. I am glad my husband pulled the Cat6 cord from the back of the computer as soon as he got hit. Hopefully this will minimize the damage until password resets. Any other information that may assist? Anything special about installing Vista over XP?? Your assistance has been appreciated. Petro

If the above is correct I need assistance to get into the regular mode of the computer so I can start the process. I am uncomfortable running Format C:/ from Safe mode.

Ok I just read all of this and you are saying the only recourse we have is: 1. Change sensitive data passwords at a different computer 2. Format C:/ and reinstall OS? Please let me know if I am correct.

Need to get my many posts cleared. When I was trying to post the logs I kept getting a time out error. I did not check the main forums, because the error msg stated I had to wait. Now I have like 6 or so posts. I am so sorry, but the wording on the timeout message was not clear to me, I thought the logs had not loaded. Could someone please delete all except the last one? I am so sorry about this. Petro

Good Day, Thank you for the information. All files/logs are pulled and available, however I cannot start a new post in "Malware Removal help" states I need to wait another 42-50 seconds b4 starting another thread. I have tried 3X 5 min apart for each try. ANy suggestions.

***NOTE - NO files in any report have been deleted/removed**** Malwarebytes Anti-Malware 1.75.0.1300www.malwarebytes.org Database version: v2013.04.04.07 Windows XP Service Pack 3 x86 NTFS (Safe Mode)Internet Explorer 8.0.6001.18702Jerry :: JEROME [administrator] 7/28/2013 8:26:01 AMMBAM-log-2013-07-28 (08-50-21).txt Scan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 287258Time elapsed: 21 minute(s), 51 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 3HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D1ECD019-8423-43DE-98D1-7892AF2DA309} (Adware.GameVance) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1ECD019-8423-43DE-98D1-7892AF2DA309} (Adware.GameVance) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EE146ACC-D881-1414-2148-B1D008B47ADB} (PUP.ShopToWin) -> No action taken. Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 3HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. Folders Detected: 0(No malicious items detected) Files Detected: 1C:\Documents and Settings\Jerry.JEROME\My Documents\Downloads\winzip setup (1).exe (PUP.AdBundle) -> No action taken. (end)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ attach.txt.==== Installed Programs ======================.Adobe Digital EditionsAdobe Flash Player 10 PluginAdobe Flash Player 11 ActiveXAdobe Reader X (10.1.3)Advanced SystemCare 6AGEIA PhysX v7.05.06AiO_Scan_CDAAiOSoftwareNPIAMD APP SDK RuntimeAMD Catalyst Install ManagerAMD USB Filter DriverAsmedia ASM104x USB 3.0 Host Controller DriverAvira Free AntivirusBE Downloadable EditionBejeweled 2 Deluxe 1.1BIOScreenBiosNoticeBufferChmC6100c6100_HelpCatalyst Control CenterCatalyst Control Center - BrandingCatalyst Control Center Graphics Previews CommonCatalyst Control Center InstallProxyCatalyst Control Center Localization Allccc-utilityCCC Help Chinese StandardCCC Help Chinese TraditionalCCC Help CzechCCC Help DanishCCC Help DutchCCC Help EnglishCCC Help FinnishCCC Help FrenchCCC Help GermanCCC Help GreekCCC Help HungarianCCC Help ItalianCCC Help JapaneseCCC Help KoreanCCC Help NorwegianCCC Help PolishCCC Help PortugueseCCC Help RussianCCC Help SpanishCCC Help SwedishCCC Help ThaiCCC Help TurkishCompatibility Pack for the 2007 Office systemCP_CalendarTemplates1cp_OnlineProjectsConfigCP_Package_Basic1CP_Panorama1Configcp_PosterPrintConfigCueTourCustomerResearchQFolderDestinationsDeviceManagementQFolderDigital Photo Navigator 1.5DivX SetupDocProcDocProcQFolderDocumentViewerDocumentViewerQFoldererLTeSupportQFolderEverQuestFax_CDAFullDPAppQFolderGame Booster 3Google ChromeGoogle Update HelperHeavyMetal AeroHeavyMetal PlusHigh Definition Audio Driver Package - KB888111Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)Hotfix for Windows Media Format 11 SDK (KB929399)Hotfix for Windows Media Player 11 (KB939683)Hotfix for Windows XP (KB2633952)Hotfix for Windows XP (KB952287)Hotfix for Windows XP (KB954550-v5)Hotfix for Windows XP (KB961118)HP Customer Participation Program 7.0HP Document Viewer 7.0HP Imaging Device Functions 7.0HP Photosmart Premier Software 6.5HP Photosmart, Officejet and Deskjet 7.0.AHP Product DetectionHP Software UpdateHP Solution Center 7.0HPPhotoSmartExpressHPProductAssistantInstantShareDevicesInstantShareDevicesMFCIObit Malware FighterJava Auto UpdaterJava 6 Update 31Java 7 Update 5JavaFX 2.1.1Legends of NorrathLogitech SetPoint 5.20Malwarebytes Anti-Malware version 1.75.0.1300MarketResearchMicrosoft .NET Framework 1.1Microsoft .NET Framework 1.1 Security Update (KB2656353)Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5 SP1Microsoft .NET Framework 4 Client ProfileMicrosoft Application Error ReportingMicrosoft Base Smart Card Cryptographic Service Provider PackageMicrosoft Compression Client Pack 1.0 for Windows XPMicrosoft Internationalized Domain Names Mitigation APIsMicrosoft Kernel-Mode Driver Framework Feature Pack 1.5Microsoft National Language Support Downlevel APIsMicrosoft Office 2000 Disc 2Microsoft Office 2000 ProfessionalMicrosoft SilverlightMicrosoft User-Mode Driver Framework Feature Pack 1.0Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219Mozilla Firefox (3.6.13)MSXML 6.0 Parser (KB933579)NeverwinterNewCopy_CDAOCR Software by I.R.I.S 7.0Octoshape add-in for Adobe Flash PlayerPanoStandAlonePhotoGalleryPowerCinema NE for EverioPowerDirector ExpressPowerProducerProductContextNPIRandMapReadmeREALTEK GbE & FE Ethernet PCI-E NIC DriverRealtek High Definition Audio DriverScanScannerCopySecurity Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)Security Update for Microsoft Windows (KB2564958)Security Update for Windows Internet Explorer 8 (KB2510531)Security Update for Windows Internet Explorer 8 (KB2544521)Security Update for Windows Internet Explorer 8 (KB2647516)Security Update for Windows Internet Explorer 8 (KB2675157)Security Update for Windows Internet Explorer 8 (KB982381)Security Update for Windows Media Player (KB2378111)Security Update for Windows Media Player (KB952069)Security Update for Windows Media Player (KB954155)Security Update for Windows Media Player (KB973540)Security Update for Windows Media Player (KB975558)Security Update for Windows Media Player (KB978695)Security Update for Windows Media Player 11 (KB954154)Security Update for Windows XP (KB2079403)Security Update for Windows XP (KB2115168)Security Update for Windows XP (KB2229593)Security Update for Windows XP (KB2296011)Security Update for Windows XP (KB2347290)Security Update for Windows XP (KB2360937)Security Update for Windows XP (KB2387149)Security Update for Windows XP (KB2393802)Security Update for Windows XP (KB2412687)Security Update for Windows XP (KB2419632)Security Update for Windows XP (KB2423089)Security Update for Windows XP (KB2440591)Security Update for Windows XP (KB2443105)Security Update for Windows XP (KB2476490)Security Update for Windows XP (KB2478960)Security Update for Windows XP (KB2478971)Security Update for Windows XP (KB2479943)Security Update for Windows XP (KB2481109)Security Update for Windows XP (KB2483185)Security Update for Windows XP (KB2485663)Security Update for Windows XP (KB2506212)Security Update for Windows XP (KB2507618)Security Update for Windows XP (KB2507938)Security Update for Windows XP (KB2508429)Security Update for Windows XP (KB2509553)Security Update for Windows XP (KB2535512)Security Update for Windows XP (KB2536276-v2)Security Update for Windows XP (KB2544893-v2)Security Update for Windows XP (KB2566454)Security Update for Windows XP (KB2570947)Security Update for Windows XP (KB2584146)Security Update for Windows XP (KB2585542)Security Update for Windows XP (KB2592799)Security Update for Windows XP (KB2598479)Security Update for Windows XP (KB2603381)Security Update for Windows XP (KB2618451)Security Update for Windows XP (KB2619339)Security Update for Windows XP (KB2620712)Security Update for Windows XP (KB2621440)Security Update for Windows XP (KB2624667)Security Update for Windows XP (KB2631813)Security Update for Windows XP (KB2633171)Security Update for Windows XP (KB2641653)Security Update for Windows XP (KB2646524)Security Update for Windows XP (KB2647518)Security Update for Windows XP (KB2653956)Security Update for Windows XP (KB2661637)Security Update for Windows XP (KB923561)Security Update for Windows XP (KB941569)Security Update for Windows XP (KB946648)Security Update for Windows XP (KB950762)Security Update for Windows XP (KB950974)Security Update for Windows XP (KB951376-v2)Security Update for Windows XP (KB952004)Security Update for Windows XP (KB952954)Security Update for Windows XP (KB954459)Security Update for Windows XP (KB956572)Security Update for Windows XP (KB956744)Security Update for Windows XP (KB956802)Security Update for Windows XP (KB956844)Security Update for Windows XP (KB958644)Security Update for Windows XP (KB959426)Security Update for Windows XP (KB960803)Security Update for Windows XP (KB960859)Security Update for Windows XP (KB961501)Security Update for Windows XP (KB969059)Security Update for Windows XP (KB970430)Security Update for Windows XP (KB971657)Security Update for Windows XP (KB972270)Security Update for Windows XP (KB973507)Security Update for Windows XP (KB973869)Security Update for Windows XP (KB973904)Security Update for Windows XP (KB974112)Security Update for Windows XP (KB974318)Security Update for Windows XP (KB974392)Security Update for Windows XP (KB974571)Security Update for Windows XP (KB975025)Security Update for Windows XP (KB975467)Security Update for Windows XP (KB975560)Security Update for Windows XP (KB975713)Security Update for Windows XP (KB977816)Security Update for Windows XP (KB977914)Security Update for Windows XP (KB978338)Security Update for Windows XP (KB978542)Security Update for Windows XP (KB978706)Security Update for Windows XP (KB979309)Security Update for Windows XP (KB979482)Security Update for Windows XP (KB979687)Security Update for Windows XP (KB980195)Security Update for Windows XP (KB981322)Security Update for Windows XP (KB981997)Security Update for Windows XP (KB982132)Security Update for Windows XP (KB982381)Security Update for Windows XP (KB982665)SkinsHP1SlideShowSmart Defrag 2SolutionCenterSonic_PrimoSDKStatusToolboxTrayAppTwo WorldsUnloadUpdate for Microsoft .NET Framework 3.5 SP1 (KB963707)Update for Microsoft .NET Framework 4 Client Profile (KB2468871)Update for Microsoft .NET Framework 4 Client Profile (KB2533523)Update for Microsoft .NET Framework 4 Client Profile (KB2600217)Update for Microsoft Windows (KB971513)Update for Windows Internet Explorer 8 (KB2598845)Update for Windows Internet Explorer 8 (KB2632503)Update for Windows XP (KB2345886)Update for Windows XP (KB2492386)Update for Windows XP (KB2641690)Update for Windows XP (KB951978)Update for Windows XP (KB968389)Update for Windows XP (KB971029)Update for Windows XP (KB973687)Update for Windows XP (KB973815)User's GuidesVC80CRTRedist - 8.0.50727.6195WeatherBugWebFldrs XPWebRegWindows Essentials Media Codec Pack 4.0 [32-Bit]Windows Genuine Advantage Notifications (KB905474)Windows Genuine Advantage Validation Tool (KB892130)Windows Imaging ComponentWindows Internet Explorer 8Windows Management Framework CoreWindows Media Format 11 runtimeWindows Media Player 11Windows XP Service Pack 3WinRAR 4.20 (32-bit)Zuma Deluxe 1.0.==== End Of File ===========================~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~DDS (Ver_2012-11-20.01) - NTFS_x86 MINIMALInternet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.5.1Run by Jerry at 8:50:50 on 2013-07-28.============== Running Processes ================.C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\WINDOWS\notepad.exeC:\WINDOWS\System32\svchost.exe -k netsvcs.============== Pseudo HJT Report ===============.uURLSearchHooks: <No Name>: - LocalServer32 - <no file>BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dllBHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dllBHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dllEB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exemRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /minmRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /automRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXEmRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silentuPolicies-Explorer: NoDriveTypeAutoRun = dword:145mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1mPolicies-Explorer: NoDriveTypeAutoRun = dword:145IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe.INFO: HKCU has more than 50 listed domains.If you wish to scan all of them, select the 'Force scan all domains' option..Notify: AtiExtEvent - Ati2evxx.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllmASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\24.0.1312.57\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome.================= FIREFOX ===================.FF - ProfilePath - c:\documents and settings\jerry.jerome\application data\mozilla\firefox\profiles\l5ehyuo8.default\FF - prefs.js: browser.search.selectedEngine - YahooFF - prefs.js: network.proxy.type - 0FF - plugin: c:\documents and settings\jerry.jerome\application data\sony online entertainment\npsoe.dllFF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dllFF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dllFF - plugin: c:\program files\divx\divx plus web player\npdivx32.dllFF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dllFF - plugin: c:\program files\java\jre7\bin\npjpi170_05.dllFF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dllFF - plugin: c:\program files\oracle\javafx 2.1 runtime\bin\plugin2\npjp2.dllFF - plugin: c:\windows\system32\npDeployJava1.dllFF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}FF - Ext: Shop to Win 27: {70a82904-3146-7b54-d1d2-81a0dce450cf} - %profile%\extensions\{70a82904-3146-7b54-d1d2-81a0dce450cf}FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtensionFF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\divx\divx plus web player\firefox\DivXHTML5.---- FIREFOX POLICIES ----FF - user.js: browser.cache.memory.capacity - 65536FF - user.js: browser.chrome.favicons - falseFF - user.js: browser.display.show_image_placeholders - trueFF - user.js: browser.turbo.enabled - trueFF - user.js: browser.urlbar.autocomplete.enabled - trueFF - user.js: browser.urlbar.autofill - trueFF - user.js: browser.xul.error_pages.enabled - trueFF - user.js: content.interrupt.parsing - trueFF - user.js: content.max.tokenizing.time - 2250000FF - user.js: content.maxtextrun - 8191FF - user.js: content.notify.backoffcount - 5FF - user.js: content.notify.interval - 750000FF - user.js: content.notify.ontimer - trueFF - user.js: content.notify.ontimer - trueFF - user.js: content.switch.threshold - 750000FF - user.js: network.http.max-connections - 48FF - user.js: network.http.max-connections-per-server - 16FF - user.js: network.http.max-persistent-connections-per-proxy - 16FF - user.js: network.http.max-persistent-connections-per-server - 8FF - user.js: network.http.pipelining - trueFF - user.js: network.http.pipelining.maxrequests - 8FF - user.js: network.http.proxy.pipelining - trueFF - user.js: network.http.request.max-start-delay - 0FF - user.js: nglayout.initialpaint.delay - 0FF - user.js: plugin.expose_full_path - trueFF - user.js: ui.submenuDelay - 0.============= SERVICES / DRIVERS ===============.R? AdvancedSystemCareService6;Advanced SystemCare Service 6R? Ambfilt;AmbfiltR? AntiVirSchedulerService;Avira SchedulerR? AntiVirService;Avira Realtime ProtectionR? avgntflt;avgntfltR? avkmgr;avkmgrR? BIOS;BIOSR? BS_I2cIo;BS_I2cIoR? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86R? FileMonitor;FileMonitorR? LBeepKE;LBeepKER? MBAMSwissArmy;MBAMSwissArmyR? RegFilter;RegFilterR? UrlFilter;UrlFilterR? WinRM;Windows Remote Management (WS-Management)R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0S? asmthub3;ASMedia USB3 Hub ServiceS? asmtxhci;ASMEDIA XHCI ServiceS? IMFservice;IMF ServiceS? SmartDefragDriver;SmartDefragDriverS? usbfilter;AMD USB Filter Driver.=============== Created Last 30 ================.2013-07-28 14:25:41 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2013-07-28 14:25:40 -------- d-----w- c:\documents and settings\jerry.jerome\application data\Malwarebytes2013-07-28 14:25:20 -------- d-----w- c:\documents and settings\all users.windows\application data\Malwarebytes2013-07-28 14:25:15 22856 ----a-w- c:\windows\system32\drivers\mbam.sys2013-07-22 20:55:57 14776 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys.==================== Find3M ====================..============= FINISH: 8:51:44.48 ===============

I am asking about what u asked me to do. That is all.

dumb question, all of this can be done in Safe Mode?? Not enuf caffeine to get fully functional brain yet. Working on it.

Good Morning All, My husband got hit with this on his computer after being redirected from a "Secure and trusted" web link of his he uses for research. Currently he is in Safe Mode and is Scanning with Advira/IOBIT Malware scanner. Any assistance would be greatly appreciated, before I commit husband-cide. I am using my Windows Vista box to transfer any programs to his XP box. Once this is clear his OS is being upgraded to Vista as I have a current full disk for it. Someone please tell me where to go so I can fix his computer. Thanks a bunch Petro PS have empty 4 GB flash stick available for use :/