levers Posted December 12, 2011 ID:504281 Share Posted December 12, 2011 Hello, I'm trying to help a colleague that is having a problem with search engine result links redirecting to various incorrect pages, some of which Malwarebytes blocks as being malicious.Here is his MBAM log:Malwarebytes' Anti-Malware 1.51.2.1300www.malwarebytes.orgDatabase version: 8358Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.1870212/12/2011 2:50:59 PMmbam-log-2011-12-12 (14-50-59).txtScan type: Quick scanObjects scanned: 193862Time elapsed: 8 minute(s), 5 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\WINDOWS\system32\fsquirt.exe (Trojan.Dropper.BCM) -> Quarantined and deleted successfully.And DDS logs:.DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702Run by Monte at 16:53:54 on 2011-12-12Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2013.1232 [GMT -6:00].AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}.============== Running Processes ===============.C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\system32\svchost.exe -k WudfServiceGroupsvchost.exesvchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\rundll32.exesvchost.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\microsoft outlook\Business Contact Manager\BcmSqlStartupSvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\WINDOWS\system32\svchost.exe -k hpdevmgmtC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\WINDOWS\System32\svchost.exe -k HPZ12C:\WINDOWS\System32\svchost.exe -k HPZ12C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\WINDOWS\system32\SearchIndexer.exeC:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exeC:\Program Files\ParetoLogic\FileCure\FileCure.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\RTHDCPL.EXEC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exeC:\Program Files\Citrix\ICA Client\concentr.exeC:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exeC:\Program Files\Citrix\ICA Client\wfcrun32.exeC:\Program Files\SelectRebates\SelectRebates.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Windows Desktop Search\WindowsSearch.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exeC:\Program Files\HP\Digital Imaging\bin\hpqbam08.exeC:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exeC:\Program Files\Common Files\Java\Java Update\jucheck.exeC:\WINDOWS\explorer.exeC:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\WINDOWS\system32\SearchProtocolHost.exe.============== Pseudo HJT Report ===============.uSearch Page = hxxp://www.google.comuSearch Bar = hxxp://www.google.com/ieuInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%smSearchAssistant = hxxp://www.google.com/ieuURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dllBHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dllBHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7018.1622\swg.dllBHO: MSN Toolbar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\4.0.0379.0\npwinext.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: ShopAtHomeIEHelper Class: {e8daaa30-6caa-4b58-9603-8e54238219e2} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dllBHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dllTB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dllTB: MSN Toolbar: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\4.0.0379.0\npwinext.dllTB: ShopAtHome Toolbar: {98279c38-de4b-4bcf-93c9-8ec26069d6f4} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dllEB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dlluRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"mRun: [RTHDCPL] RTHDCPL.EXEmRun: [Alcmtr] ALCMTR.EXEmRun: [igfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [Persistence] c:\windows\system32\igfxpers.exemRun: [iAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exemRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startupmRun: [MSN Toolbar] "c:\program files\msn toolbar\platform\4.0.0379.0\mswinext.exe"mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resumemRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottimemRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exemRun: [selectRebates] c:\program files\selectrebates\SelectRebates.exemRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttraymRunServices: [knockout] c:\docume~1\montel~1\locals~1\temp\knockout.exemRunServices: [WizardShell] c:\program files\intel\intel matrix storage manager\nld\raidwizmmodify.exemRunServices: [informationTechnology5.50.50727.198] c:\program files\common files\microsoft shared\help\microsoftrlibrary.exemRunServices: [settingsDefault18562] c:\program files\corel\corel graphics 11\custom data\preflight styles\defaultsettings1916.exemRunServices: [MonitorRAID] c:\program files\intel\intel matrix storage manager\nld\raidwizmmodify.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXEStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exeIE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLLIE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dllTrusted Zone: ab-sales.comTrusted Zone: ab-sales.com\secureTrusted Zone: ab-sales.com\wwwTrusted Zone: abmarketing.com\wwwTrusted Zone: budnet.com\wwwTrusted Zone: internetTrusted Zone: passion4hunting.com\eylwewanDPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cabDPF: {315581D7-2DE9-4685-A31D-FDE263FF2FB5} - hxxp://24.220.180.70/template/pWebView1.cabDPF: {37D01D1F-7F85-4455-88DA-6328863886E8} - hxxps://secure.ab-sales.com/echannelcg_enu/19234/applets/SiebelAx_HI_Client.cabDPF: {63F5866B-A7C5-40B4-9A89-0CCA99726C8D} - hxxps://secure.logmeinrescue.com/Customer/x86/RescueDownloader.cabDPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - hxxps://secure.ab-sales.com/echannelcg_enu/19251/applets/SiebelAx_Desktop_Integration.cabDPF: {B66D7C9D-905F-4A8E-A919-F6190334B9D0} - hxxps://secure.ab-sales.com/echannelcg_enu/19251/applets/SiebelAx_HI_Client.cabDPF: {C1FC96DA-81BE-4836-B3A5-958F55E56E8E} - hxxps://secure.ab-sales.com/echannelcg_enu/19251/applets/SiebelAx_OutBound_mail.cabDPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://wholesalerrouting.webex.com/client/T27LB/event/ieatgpc.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabDPF: {E4F2DB99-72F9-40CE-8B98-AF9615C99CEE} - hxxps://secure.ab-sales.com/echannelcg_enu/19234/applets/SiebelAx_Calendar.cabDPF: {EAE0D004-1B84-4F67-AA92-35B3A0B4F045} - hxxps://secure.ab-sales.com/echannelcg_enu/19234/applets/SiebelAx_OutBound_mail.cabTCP: DhcpNameServer = 64.251.160.2 64.251.173.40TCP: Interfaces\{ECB4A38B-54BB-490A-80C1-294B18B0ACDE} : DhcpNameServer = 64.251.160.2 64.251.173.40Notify: igfxcui - igfxdev.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll.============= SERVICES / DRIVERS ===============.R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [2009-9-8 65584]R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 151216]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-9-21 366152]R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [2009-11-20 22016]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-9-21 22216]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-19 135664]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-19 135664]S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [2009-11-20 28800]S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [2009-11-20 17536].=============== Created Last 30 ================.2011-12-01 17:45:13 -------- d-----w- C:\2012 Corona2011-11-22 19:36:56 -------- d-----w- C:\2012 Monster.==================== Find3M ====================.2011-12-06 14:21:18 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl.============= FINISH: 16:54:20.17 ===============Attach.txt:.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-08-26.01).Microsoft Windows XP ProfessionalBoot Device: \Device\HarddiskVolume2Install Date: 12/21/2009 2:14:57 PMSystem Uptime: 12/12/2011 2:51:46 PM (2 hours ago).Motherboard: Dell Inc. | | 0CKCXHProcessor: Pentium® Dual-Core CPU E5300 @ 2.60GHz | Socket 775 | 2593/200mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 233 GiB total, 207.385 GiB free.D: is CDROM ()G: is NetworkDisk (NTFS) - 1397 GiB total, 1269.765 GiB free..==== Disabled Device Manager Items =============.==== System Restore Points ===================.RP117: 9/18/2011 8:06:10 PM - System CheckpointRP118: 9/21/2011 1:14:56 PM - System CheckpointRP119: 9/23/2011 8:19:40 AM - System CheckpointRP120: 9/26/2011 7:59:21 AM - System CheckpointRP121: 9/27/2011 9:04:17 AM - System CheckpointRP122: 9/28/2011 11:45:04 AM - System CheckpointRP123: 9/29/2011 12:13:23 PM - System CheckpointRP124: 9/30/2011 3:37:58 PM - System CheckpointRP125: 10/2/2011 12:38:30 PM - System CheckpointRP126: 10/4/2011 9:21:02 PM - System CheckpointRP127: 10/6/2011 8:06:53 AM - System CheckpointRP128: 10/7/2011 8:10:52 AM - System CheckpointRP129: 10/10/2011 3:42:38 PM - System CheckpointRP130: 10/11/2011 4:23:15 PM - System CheckpointRP131: 10/12/2011 4:39:37 PM - System CheckpointRP132: 10/13/2011 5:06:10 PM - System CheckpointRP133: 10/14/2011 5:06:57 PM - System CheckpointRP134: 10/17/2011 12:44:24 PM - System CheckpointRP135: 10/18/2011 4:12:30 PM - System CheckpointRP136: 10/19/2011 5:10:41 PM - System CheckpointRP137: 10/24/2011 8:18:11 AM - System CheckpointRP138: 10/25/2011 3:59:20 PM - System CheckpointRP139: 10/26/2011 4:13:51 PM - System CheckpointRP140: 10/27/2011 4:19:48 PM - System CheckpointRP141: 10/29/2011 11:36:14 AM - System CheckpointRP142: 10/31/2011 12:09:00 PM - System CheckpointRP143: 11/1/2011 12:13:52 PM - System CheckpointRP144: 11/2/2011 4:01:07 PM - System CheckpointRP145: 11/3/2011 4:58:55 PM - System CheckpointRP146: 11/10/2011 8:31:49 AM - System CheckpointRP147: 11/11/2011 1:26:24 PM - System CheckpointRP148: 11/14/2011 11:27:08 AM - System CheckpointRP149: 11/15/2011 12:22:55 PM - System CheckpointRP150: 11/21/2011 12:04:34 PM - System CheckpointRP151: 11/22/2011 12:16:48 PM - System CheckpointRP152: 11/23/2011 12:49:41 PM - System CheckpointRP153: 11/28/2011 12:36:45 PM - System CheckpointRP154: 11/29/2011 7:49:57 PM - System CheckpointRP155: 12/1/2011 8:08:46 AM - System CheckpointRP156: 12/2/2011 8:59:14 AM - System CheckpointRP157: 12/5/2011 12:22:02 PM - System CheckpointRP158: 12/6/2011 12:33:51 PM - System CheckpointRP159: 12/9/2011 7:36:58 AM - System CheckpointRP160: 12/10/2011 10:37:01 AM - System CheckpointRP161: 12/11/2011 3:25:01 PM - System Checkpoint.==== Installed Programs ======================.32 Bit HP CIO Components InstallerAcrobat.comAdobe AIRAdobe Flash Player 11 ActiveXAdobe Reader 9.4.6Apple Application SupportApple Mobile Device SupportApple Software UpdateBonjourBufferChmBusiness Contact Manager for Outlook 2007 SP2C4400C4400_HelpCards_Calendar_OrderGift_DoMorePlugoutCitrix online plug-in - webCitrix online plug-in (DV)Citrix online plug-in (HDX)Citrix online plug-in (USB)Citrix online plug-in (Web)Compatibility Pack for the 2007 Office systemCompetitiveCodeBookCopyCorelDRAW 11 SACorelDRAW Graphics Suite X4CorelDRAW Graphics Suite X4 - CaptureCorelDRAW Graphics Suite X4 - ContentCorelDRAW Graphics Suite X4 - DrawCorelDRAW Graphics Suite X4 - FiltersCorelDRAW Graphics Suite X4 - FontNavCorelDRAW Graphics SUite X4 - ICACorelDRAW Graphics Suite X4 - IPMCorelDRAW Graphics Suite X4 - Lang BRCorelDRAW Graphics Suite X4 - Lang ENCorelDRAW Graphics Suite X4 - Lang ESCorelDRAW Graphics Suite X4 - Lang FRCorelDRAW Graphics Suite X4 - PPCorelDRAW Graphics Suite X4 - VBACorelDRAW SA 11CorelDRAW® Graphics Suite X4CorelDRAW® Graphics Suite X4 - Windows Shell ExtensionCustomerResearchQFolderDell Backup and Recovery ManagerDestination ComponentDeviceDiscoveryDeviceManagementQFolderDiagnostic UtilityDocProcDocProcQFoldereSupportQFolderGDR 4053 for SQL Server Database Services 2005 ENU (KB970892)Google Toolbar for Internet ExplorerGoogle Update HelperGoToMeeting 4.1.0.366GPBaseServiceGPBaseService2Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)Hotfix for Windows Media Format 11 SDK (KB929399)Hotfix for Windows Media Player 11 (KB939683)Hotfix for Windows XP (KB915800-v4)Hotfix for Windows XP (KB932716-v2)Hotfix for Windows XP (KB952287)Hotfix for Windows XP (KB953955)Hotfix for Windows XP (KB954434)Hotfix for Windows XP (KB954550-v5)Hotfix for Windows XP (KB958347)Hotfix for Windows XP (KB959252)Hotfix for Windows XP (KB961118)Hotfix for Windows XP (KB968764)Hotfix for Windows XP (KB976098-v2)Hotfix for Windows XP (KB979306)Hotfix for Windows XP (KB981793)HP Customer Participation Program 10.0HP Imaging Device Functions 10.0HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3HP Photosmart Essential 3.5HP Smart Web Printing 4.60HP Solution Center 13.0HP UpdateHPPhotoSmartDiscLabelContent1HPPhotosmartEssentialHPPhotoSmartPhotobookWebPack1HPProductAssistantHPSSupplyIntel® Graphics Media Accelerator DriverIntel® Matrix Storage ManageriTunesJava Auto UpdaterJava 6 Update 24Malwarebytes' Anti-Malware version 1.51.2.1300MarketResearchMicro Vane Workstation 5.4Microsoft .NET Framework 1.1Microsoft .NET Framework 1.1 Security Update (KB979906)Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5 SP1Microsoft AntimalwareMicrosoft Compression Client Pack 1.0 for Windows XPMicrosoft Default ManagerMicrosoft Office 2000 PremiumMicrosoft Office 2003 Web ComponentsMicrosoft Office 2007 Primary Interop AssembliesMicrosoft Office 2007 Service Pack 2 (SP2)Microsoft Office Access MUI (English) 2007Microsoft Office Access Setup Metadata MUI (English) 2007Microsoft Office Excel MUI (English) 2007Microsoft Office Home and Student 2007Microsoft Office Live Meeting 2007Microsoft Office OneNote MUI (English) 2007Microsoft Office Outlook MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office PowerPoint Viewer 2007 (English)Microsoft Office Professional 2007Microsoft Office Professional 2007 TrialMicrosoft Office Proof (English) 2007Microsoft Office Proof (French) 2007Microsoft Office Proof (Spanish) 2007Microsoft Office Proofing (English) 2007Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)Microsoft Office Publisher MUI (English) 2007Microsoft Office Shared MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Small Business Connectivity ComponentsMicrosoft Office Standard 2007Microsoft Office Standard 2007 TrialMicrosoft Office Word MUI (English) 2007Microsoft Search Enhancement PackMicrosoft Security EssentialsMicrosoft SilverlightMicrosoft Software Update for Web Folders (English) 12Microsoft SQL Server 2005Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)Microsoft SQL Server Native ClientMicrosoft SQL Server Setup Support Files (English)Microsoft SQL Server VSS WriterMicrosoft UI EngineMicrosoft User-Mode Driver Framework Feature Pack 1.0Microsoft WorksMSN ToolbarMSN Toolbar PlatformMSVCSetupMSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)MSXML 6.0 ParserOCR Software by I.R.I.S. 10.0OGA Notifier 2.0.0048.0PanoStandAloneParetoLogic FileCurePowerDVD DXProfitability CalculatorPS_AIO_03_C4400_ProductContextPS_AIO_03_C4400_SoftwarePS_AIO_03_C4400_Software_MinPSSWCOREQuickTimeRealtek High Definition Audio DriverRoxio Creator AudioRoxio Creator CopyRoxio Creator DataRoxio Creator DE 10.3Roxio Creator ToolsRoxio Express Labeler 3Roxio Update ManagerScanSecurity Update for 2007 Microsoft Office System (KB2277947)Security Update for 2007 Microsoft Office System (KB2288621)Security Update for 2007 Microsoft Office System (KB969559)Security Update for 2007 Microsoft Office System (KB976321)Security Update for 2007 Microsoft Office System (KB982312)Security Update for 2007 Microsoft Office System (KB982331)Security Update for Microsoft Office Access 2007 (KB979440)Security Update for Microsoft Office Excel 2007 (KB982308)Security Update for Microsoft Office InfoPath 2007 (KB979441)Security Update for Microsoft Office Outlook 2007 (KB2288953)Security Update for Microsoft Office PowerPoint 2007 (KB982158)Security Update for Microsoft Office Publisher 2007 (KB982124)Security Update for Microsoft Office system 2007 (972581)Security Update for Microsoft Office system 2007 (KB974234)Security Update for Microsoft Office Visio Viewer 2007 (KB973709)Security Update for Microsoft Office Word 2007 (KB2251419)Security Update for Windows Media Player (KB952069)Security Update for Windows Media Player (KB954155)Security Update for Windows Media Player (KB968816)Security Update for Windows Media Player (KB973540)Security Update for Windows Media Player (KB975558)Security Update for Windows Media Player (KB978695)Security Update for Windows Media Player (KB979402)Security Update for Windows Media Player 11 (KB954154)Security Update for Windows Search 4 - KB963093Security Update for Windows XP (KB2079403)Security Update for Windows XP (KB2115168)Security Update for Windows XP (KB2121546)Security Update for Windows XP (KB2160329)Security Update for Windows XP (KB2183461)Security Update for Windows XP (KB2229593)Security Update for Windows XP (KB2259922)Security Update for Windows XP (KB2286198)Security Update for Windows XP (KB2347290)Security Update for Windows XP (KB923561)Security Update for Windows XP (KB938464)Security Update for Windows XP (KB941569)Security Update for Windows XP (KB946648)Security Update for Windows XP (KB950762)Security Update for Windows XP (KB950974)Security Update for Windows XP (KB951066)Security Update for Windows XP (KB951376-v2)Security Update for Windows XP (KB951698)Security Update for Windows XP (KB951748)Security Update for Windows XP (KB952004)Security Update for Windows XP (KB952954)Security Update for Windows XP (KB954211)Security Update for Windows XP (KB954459)Security Update for Windows XP (KB954600)Security Update for Windows XP (KB955069)Security Update for Windows XP (KB956572)Security Update for Windows XP (KB956744)Security Update for Windows XP (KB956802)Security Update for Windows XP (KB956803)Security Update for Windows XP (KB956841)Security Update for Windows XP (KB956844)Security Update for Windows XP (KB957095)Security Update for Windows XP (KB957097)Security Update for Windows XP (KB958215)Security Update for Windows XP (KB958644)Security Update for Windows XP (KB958687)Security Update for Windows XP (KB958690)Security Update for Windows XP (KB958869)Security Update for Windows XP (KB959426)Security Update for Windows XP (KB960225)Security Update for Windows XP (KB960714)Security Update for Windows XP (KB960715)Security Update for Windows XP (KB960803)Security Update for Windows XP (KB960859)Security Update for Windows XP (KB961371-v2)Security Update for Windows XP (KB961373)Security Update for Windows XP (KB961501)Security Update for Windows XP (KB963027)Security Update for Windows XP (KB968537)Security Update for Windows XP (KB969059)Security Update for Windows XP (KB969897)Security Update for Windows XP (KB969898)Security Update for Windows XP (KB969947)Security Update for Windows XP (KB970238)Security Update for Windows XP (KB970430)Security Update for Windows XP (KB971468)Security Update for Windows XP (KB971486)Security Update for Windows XP (KB971557)Security Update for Windows XP (KB971633)Security Update for Windows XP (KB971657)Security Update for Windows XP (KB971961)Security Update for Windows XP (KB972260)Security Update for Windows XP (KB972270)Security Update for Windows XP (KB973346)Security Update for Windows XP (KB973354)Security Update for Windows XP (KB973507)Security Update for Windows XP (KB973525)Security Update for Windows XP (KB973869)Security Update for Windows XP (KB973904)Security Update for Windows XP (KB974112)Security Update for Windows XP (KB974318)Security Update for Windows XP (KB974392)Security Update for Windows XP (KB974571)Security Update for Windows XP (KB975025)Security Update for Windows XP (KB975467)Security Update for Windows XP (KB975560)Security Update for Windows XP (KB975561)Security Update for Windows XP (KB975562)Security Update for Windows XP (KB975713)Security Update for Windows XP (KB976325)Security Update for Windows XP (KB977165)Security Update for Windows XP (KB977816)Security Update for Windows XP (KB977914)Security Update for Windows XP (KB978037)Security Update for Windows XP (KB978251)Security Update for Windows XP (KB978262)Security Update for Windows XP (KB978338)Security Update for Windows XP (KB978542)Security Update for Windows XP (KB978601)Security Update for Windows XP (KB978706)Security Update for Windows XP (KB979309)Security Update for Windows XP (KB979482)Security Update for Windows XP (KB979559)Security Update for Windows XP (KB979683)Security Update for Windows XP (KB980195)Security Update for Windows XP (KB980218)Security Update for Windows XP (KB980232)Security Update for Windows XP (KB980436)Security Update for Windows XP (KB981322)Security Update for Windows XP (KB981349)Security Update for Windows XP (KB981852)Security Update for Windows XP (KB981997)Security Update for Windows XP (KB982214)Security Update for Windows XP (KB982381)Security Update for Windows XP (KB982665)Security Update for Windows XP (KB982802)Shop for HP SuppliesShopAtHome SelectRebatesSmartWebPrintingSolutionCenterSpelling Dictionaries Support For Adobe Reader 9StatusToolboxTrayAppUnloadSupportUpdate for 2007 Microsoft Office System (KB967642)Update for Microsoft .NET Framework 3.5 SP1 (KB963707)Update for Microsoft Office OneNote 2007 (KB980729)Update for Outlook 2007 Junk Email Filter (kb2291599)Update for Windows XP (KB2141007)Update for Windows XP (KB898461)Update for Windows XP (KB951618-v2)Update for Windows XP (KB951978)Update for Windows XP (KB955759)Update for Windows XP (KB955839)Update for Windows XP (KB967715)Update for Windows XP (KB968389)Update for Windows XP (KB971737)Update for Windows XP (KB973687)Update for Windows XP (KB973815)Update for Windows XP (KB978207)Update for Windows XP (KB980182)VBA (2627.01)VideoToolkit01Visual Basic for Applications ® CoreVisual Basic for Applications ® Core - EnglishWebExWebFldrs XPWebRegWindows Genuine Advantage Notifications (KB905474)Windows Internet Explorer 8Windows Live ID Sign-in AssistantWindows Media Format 11 runtimeWindows Media Player 11Windows Presentation FoundationWindows Search 4.0XML Paper Specification Shared Components Pack 1.0Yahoo! DetectYahoo! Toolbar.==== Event Viewer Messages From Past Week ========.12/9/2011 7:55:40 AM, error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.12/9/2011 7:22:56 AM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.12/6/2011 8:14:43 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}12/12/2011 2:52:19 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume..==== End Of File ===========================Thank you for any assistance you can give us! Link to post Share on other sites More sharing options...
levers Posted December 14, 2011 Author ID:505016 Share Posted December 14, 2011 I know you are all extremely busy, but did anyone have any advice for us?Thank you so much!! Link to post Share on other sites More sharing options...
LDTate Posted December 16, 2011 ID:505475 Share Posted December 16, 2011 Logs will be closed if you haven't replied within 3 days Please do not attach the scan results from Combofx. Use copy/paste.DO NOT use any TOOLS such as Combofix, or HijackThis fixes without supervision.Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.Vista and Windows 7 users:1. These tools MUST be run from the executable. (.exe) every time you run them 2. With Admin Rights (Right click, choose "Run as Administrator")Stay with this topic until I give you the all clean post.You might want to print these instructions out.I suggest you do this:XP UsersDouble-click My Computer. Click the Tools menu, and then click Folder Options. Click the View tab.Uncheck "Hide file extensions for known file types." Under the "Hidden files" folder, select "Show hidden files and folders." Uncheck "Hide protected operating system files." Click Apply, and then click OK.Vista UsersTo enable the viewing of hidden and protected system files in Windows Vista please follow these steps:Close all programs so that you are at your desktop.Click on the Start button. This is the small round button with the Windows flag in the lower left corner.Click on the Control Panel menu option.When the control panel opens you can either be in Classic View or Control Panel Home view: If you are in the Classic View do the following: Double-click on the Folder Options icon.Click on the View tab.If you are in the Control Panel Home view do the following: Click on the Appearance and Personalization link.Click on Show Hidden Files or Folders.Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.Remove the checkmark from the checkbox labeled Hide extensions for known file types.Remove the checkmark from the checkbox labeled Hide protected operating system files.Please do not delete anything unless instructed to. Next:Download TFC to your desktopClose any open windows.Double click the TFC icon to run the programTFC will close all open programs itself in order to run, Click the Start button to begin the process. Allow TFC to run uninterrupted.The program should not take long to finish it's jobOnce its finished it should automatically reboot your machine,if it doesn't, manually reboot to ensure a complete cleanNext:Download ComboFix from one of these locations:Link 1Link 2 If using this link, Right Click and select Save As.* IMPORTANT !!! Save ComboFix.exe to your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective ProgramsDouble click on ComboFix.exe & follow the prompts.Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7. Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console partAs part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.Notes:1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.Give it atleast 20-30 minutes to finish if needed.Please do not attach the scan results from Combofx. Use copy/paste.Also please describe how your computer behaves at the moment. Link to post Share on other sites More sharing options...
LDTate Posted December 18, 2011 ID:506309 Share Posted December 18, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts