Another Aartemis Problem

PamJ · November 19, 2013

I downloaded something yesterday (JAVA Update) that my AV program said I needed to download. And I was also trying to watch a free TV episode online when this happened. So I downloaded/updated Java. This is when the problems began. This Aartemis think hijacked my FF homepage. I had set a restore point before downloading the Java thing, so I went back to that restore point. That SEEMED to fix it, as I could now set my FF homepage to what I wanted again and it stayed there. Later today, although the homepage is fine, every time in FF when I click the "+" tab to open up a new tab, I get Aartemis instead. This is only happening on FF (which was my default browser at the time), not IE or Chrome.

I ran a Quick Scan and then a Full Scan with MB, and the problem is still there. (Although MB did find some things on the full scan, it wasn't something that fixed this issue.)

(In case it matters, I had an issue with a Money vs avast last Friday that someone on their forums was trying to help me with, downloading scans and then posting the resulting logs. Other than a bunch of PUPs (which have a life of their own, I think), and some adware, he said he didn't see anything that could be causing the problem And indeed, after eliminating these, the problem still existed. I end up deleting Money and THAT issue now seems to be resolved.)

The instructions under the MB thread "I'm infected - What do i do now?" say to cut-and-paste the contents of the dds and attach text logs here in this post. So, here they are. Thanks!!

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Run by Pam at 18:59:11 on 2013-11-18

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1093 [GMT -5:00]

.

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ================

.

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

C:\WINDOWS\system32\cypxsrv10.exe

C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Microsoft SQL Server\MSSQL$ENCOREPRO\Binn\sqlservr.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Epson Software\Event Manager\EEventManager.exe

C:\Program Files\Epson Software\FAX Utility\FUFAXRCV.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Documents and Settings\Pam\Local Settings\Application Data\FluxSoftware\Flux\flux.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\ActiveWords\AWMonitor.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Program Files\ActiveWords\AWApps\L&T\AWLearnTrain.exe

C:\Program Files\ActiveWords\AWFeedback.exe

C:\Program Files\ActiveWords\nahuatl.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Pam\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6081129

BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\dell\bae\BAE.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

uRun: [F.lux] "c:\documents and settings\pam\local settings\application data\fluxsoftware\flux\flux.exe" /noshow

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Google Update] "c:\documents and settings\pam\local settings\application data\google\update\GoogleUpdate.exe" /c

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [EEventManager] "c:\program files\epson software\event manager\EEventManager.exe"

mRun: [FUFAXRCV] "c:\program files\epson software\fax utility\FUFAXRCV.exe"

mRun: [FUFAXSTM] "c:\program files\epson software\fax utility\FUFAXSTM.exe"

mRun: [LTCM Client] c:\program files\ltcm client\ltcmClient.exe /startup

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\active~1.lnk - c:\program files\activewords\AWMonitor.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: Add to Evernote 4.0 - c:\program files\evernote\evernote\EvernoteIE.dll/204

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

IE: Free YouTube Download - c:\documents and settings\pam\application data\dvdvideosoftiehelpers\freeyoutubedownload.htm

IE: Free YouTube to Mp3 Converter - c:\documents and settings\pam\application data\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - c:\program files\evernote\evernote\EvernoteIE.dll/204

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL

SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\pam\application data\mozilla\firefox\profiles\35637qgf.default\

FF - prefs.js: browser.search.selectedEngine - aartemis

FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\pam\application data\mozilla\plugins\npatgpc.dll

FF - plugin: c:\documents and settings\pam\local settings\application data\google\update\1.3.21.165\npGoogleUpdate3.dll

FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\google\update\1.3.21.165\npGoogleUpdate3.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_9_900_117.dll

.

============= SERVICES / DRIVERS ===============

.

R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-5-4 49376]

R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-5-4 177864]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-5-4 770344]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-5-4 369584]

R1 cypxdv10;cypxdv10;c:\windows\system32\drivers\cypxdv10.sys [2013-7-13 98560]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-3-23 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 67664]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-9-10 116608]

R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\common files\abbyy\finereadersprint\9.00\licensing\NetworkLicenseServer.exe [2009-5-14 759048]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-5-4 29816]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-5-4 66336]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-5-4 46808]

R2 cypherix10service;Cypherix 10 service;c:\windows\system32\cypxsrv10.exe [2013-7-13 1055072]

R2 EpsonCustomerParticipation;EpsonCustomerParticipation;c:\program files\epson\epsoncustomerparticipation\EPCP.exe [2011-6-9 521600]

R2 MSSQL$ENCOREPRO;MSSQL$ENCOREPRO;c:\program files\microsoft sql server\mssql$encorepro\binn\sqlservr.exe [2005-5-4 9158656]

R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;c:\windows\system32\drivers\Envy24HF.sys [2012-12-10 690992]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 MSRSService;MSRS Recording System;c:\program files\nch swift sound\msrs\msrs.exe [2010-2-6 745476]

S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 12872]

S3 SQLAgent$ENCOREPRO;SQLAgent$ENCOREPRO;c:\program files\microsoft sql server\mssql$encorepro\binn\sqlagent.EXE [2005-5-3 323584]

S3 TTIUSB;Mako DT3500 SmartCard Reader;c:\windows\system32\drivers\2800.sys [2009-1-13 24320]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-11 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856]

.

=============== File Associations ===============

.

ShellExec: switch.exe: Convert with Switch Sound File Converter="c:\program files\nch software\switch\switch" "%L"

.

=============== Created Last 30 ================

.

2013-11-18 04:06:24 -------- d-----w- c:\windows\system32\wbem\repository\FS

2013-11-18 04:06:24 -------- d-----w- c:\windows\system32\wbem\Repository

2013-11-18 04:02:58 -------- d-----w- c:\program files\Uninstaller

2013-11-18 04:01:44 -------- d-----w- c:\program files\MyPC Backup

2013-11-18 04:01:07 -------- d-----w- c:\documents and settings\pam\local settings\application data\SevereWeatherAlerts

2013-11-17 15:10:21 -------- d-----w- c:\program files\CCleaner

2013-11-16 21:28:29 24064 ----a-w- c:\windows\zoek-delete.exe

2013-11-16 18:14:04 -------- d-----w- C:\zoek_backup

2013-11-16 18:12:18 -------- d--h--w- c:\windows\PIF

2013-10-26 15:49:32 -------- d-----w- c:\documents and settings\pam\local settings\application data\iSite

2013-10-26 15:49:32 -------- d-----w- c:\documents and settings\all users\application data\Philips

2013-10-26 15:49:17 -------- d-----w- c:\documents and settings\pam\PIMVLibraries

.

==================== Find3M ====================

.

2013-10-20 17:17:43 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-10-20 17:17:43 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-08-30 07:48:13 177864 ----a-w- c:\windows\system32\drivers\aswVmm.sys

2013-08-30 07:48:12 770344 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2013-08-30 07:48:12 49376 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2013-08-30 07:48:11 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2013-08-30 07:47:40 41664 ----a-w- c:\windows\avastSS.scr

.

============= FINISH: 18:59:51.60 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 1/9/2009 8:37:06 PM

System Uptime: 11/18/2013 6:40:19 PM (0 hours ago)

.

Motherboard: Dell Inc. | | 0RY007

Processor: Intel® Pentium® Dual CPU E2200 @ 2.20GHz | Socket 775 | 2194/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 298 GiB total, 209.203 GiB free.

D: is CDROM ()

H: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP1654: 8/20/2013 8:26:30 PM - B4 word upgrade

RP1655: 8/20/2013 8:34:56 PM - Installed Microsoft Office Small Business 2007

RP1656: 8/20/2013 9:34:50 PM - Configured Microsoft Office Small Business 2007

RP1657: 8/20/2013 9:35:34 PM - Configured Microsoft Office Small Business 2007

RP1658: 8/21/2013 11:09:24 PM - Configured Microsoft Office Small Business 2007

RP1659: 8/22/2013 11:21:22 AM - Configured Microsoft Office Small Business 2007

RP1660: 8/23/2013 12:10:23 AM - Configured Microsoft Office Small Business 2007

RP1661: 8/23/2013 11:52:32 PM - Configured Microsoft Office Small Business 2007

RP1662: 8/25/2013 1:33:54 AM - System Checkpoint

RP1663: 8/25/2013 5:16:08 PM - Configured Microsoft Office Small Business 2007

RP1664: 8/26/2013 6:46:27 PM - System Checkpoint

RP1665: 8/27/2013 6:59:17 PM - System Checkpoint

RP1666: 8/27/2013 7:35:19 PM - Configured Microsoft Office Small Business 2007

RP1667: 8/28/2013 10:37:40 AM - Configured Microsoft Office Small Business 2007

RP1668: 8/28/2013 5:10:19 PM - Configured Microsoft Office Small Business 2007

RP1669: 8/29/2013 5:53:31 PM - System Checkpoint

RP1670: 8/30/2013 4:53:00 PM - Configured Microsoft Office Small Business 2007

RP1671: 8/31/2013 5:34:00 PM - System Checkpoint

RP1672: 9/1/2013 5:46:31 PM - System Checkpoint

RP1673: 9/2/2013 7:25:36 PM - System Checkpoint

RP1674: 9/3/2013 11:17:09 PM - System Checkpoint

RP1675: 9/5/2013 12:53:35 AM - System Checkpoint

RP1676: 9/6/2013 12:54:09 AM - System Checkpoint

RP1677: 9/7/2013 11:31:54 AM - Configured Microsoft Office Small Business 2007

RP1678: 9/8/2013 12:09:47 PM - System Checkpoint

RP1679: 9/8/2013 7:58:41 PM - Configured Microsoft Office Small Business 2007

RP1680: 9/9/2013 10:32:19 PM - System Checkpoint

RP1681: 9/10/2013 9:45:49 AM - Configured Microsoft Office Small Business 2007

RP1682: 9/11/2013 2:22:47 AM - Configured Microsoft Office Small Business 2007

RP1683: 9/12/2013 2:54:46 AM - System Checkpoint

RP1684: 9/13/2013 12:33:54 AM - Configured Microsoft Office Small Business 2007

RP1685: 9/13/2013 10:10:52 PM - Configured Microsoft Office Small Business 2007

RP1686: 9/14/2013 10:22:47 PM - System Checkpoint

RP1687: 9/15/2013 10:40:52 PM - System Checkpoint

RP1688: 9/16/2013 11:18:55 AM - Configured Microsoft Office Small Business 2007

RP1689: 9/17/2013 11:46:40 AM - System Checkpoint

RP1690: 9/18/2013 12:32:56 PM - System Checkpoint

RP1691: 9/19/2013 12:51:18 PM - System Checkpoint

RP1692: 9/19/2013 11:26:09 PM - Configured Microsoft Office Small Business 2007

RP1693: 9/21/2013 11:28:57 AM - System Checkpoint

RP1694: 9/22/2013 1:28:13 PM - System Checkpoint

RP1695: 9/23/2013 4:08:22 PM - System Checkpoint

RP1696: 9/24/2013 10:28:54 PM - Configured Microsoft Office Small Business 2007

RP1697: 9/26/2013 2:50:33 PM - System Checkpoint

RP1698: 9/27/2013 3:19:19 PM - System Checkpoint

RP1699: 9/28/2013 4:19:16 PM - System Checkpoint

RP1700: 9/29/2013 4:53:16 PM - System Checkpoint

RP1701: 9/30/2013 4:54:18 PM - System Checkpoint

RP1702: 10/1/2013 5:09:14 PM - System Checkpoint

RP1703: 10/2/2013 9:22:55 PM - System Checkpoint

RP1704: 10/3/2013 9:53:07 PM - System Checkpoint

RP1705: 10/4/2013 9:53:51 PM - System Checkpoint

RP1706: 10/5/2013 4:28:28 PM - Configured Microsoft Office Small Business 2007

RP1707: 10/5/2013 4:30:51 PM - Configured Microsoft Office Small Business 2007

RP1708: 10/6/2013 5:14:02 PM - System Checkpoint

RP1709: 10/7/2013 3:14:52 PM - Configured Microsoft Office Small Business 2007

RP1710: 10/8/2013 5:03:51 PM - System Checkpoint

RP1711: 10/9/2013 1:55:20 PM - B4 Avast Update

RP1712: 10/9/2013 8:32:10 PM - Configured Microsoft Office Small Business 2007

RP1713: 10/10/2013 9:16:37 PM - System Checkpoint

RP1714: 10/11/2013 10:24:47 AM - Configured Microsoft Office Small Business 2007

RP1715: 10/11/2013 5:14:20 PM - Configured Microsoft Office Small Business 2007

RP1716: 10/12/2013 6:56:49 PM - System Checkpoint

RP1717: 10/13/2013 3:32:30 PM - Configured Microsoft Office Small Business 2007

RP1718: 10/14/2013 3:39:20 PM - System Checkpoint

RP1719: 10/15/2013 5:11:50 PM - System Checkpoint

RP1720: 10/16/2013 7:34:30 PM - System Checkpoint

RP1721: 10/17/2013 7:47:08 PM - System Checkpoint

RP1722: 10/18/2013 8:22:11 PM - System Checkpoint

RP1723: 10/19/2013 1:56:20 PM - Configured Microsoft Office Small Business 2007

RP1724: 10/20/2013 3:19:15 PM - System Checkpoint

RP1725: 10/21/2013 4:38:39 PM - System Checkpoint

RP1726: 10/22/2013 7:54:51 PM - System Checkpoint

RP1727: 10/23/2013 10:34:33 PM - System Checkpoint

RP1728: 10/25/2013 11:16:57 AM - System Checkpoint

RP1729: 10/26/2013 12:27:58 PM - System Checkpoint

RP1730: 10/27/2013 11:28:49 PM - System Checkpoint

RP1731: 10/28/2013 11:57:21 PM - System Checkpoint

RP1732: 10/30/2013 1:31:06 AM - System Checkpoint

RP1733: 10/31/2013 1:33:22 PM - System Checkpoint

RP1734: 11/1/2013 9:21:27 PM - System Checkpoint

RP1735: 11/2/2013 9:58:08 PM - System Checkpoint

RP1736: 11/3/2013 9:28:28 PM - System Checkpoint

RP1737: 11/4/2013 8:48:01 PM - Configured Microsoft Office Small Business 2007

RP1738: 11/5/2013 6:29:48 PM - Configured Microsoft Office Small Business 2007

RP1739: 11/6/2013 6:58:38 PM - System Checkpoint

RP1740: 11/7/2013 2:16:28 AM - Configured Microsoft Office Small Business 2007

RP1741: 11/7/2013 7:53:33 PM - Configured Microsoft Office Small Business 2007

RP1742: 11/8/2013 8:39:54 PM - System Checkpoint

RP1743: 11/9/2013 8:59:31 PM - System Checkpoint

RP1744: 11/10/2013 9:00:21 PM - System Checkpoint

RP1745: 11/11/2013 9:39:32 PM - System Checkpoint

RP1746: 11/12/2013 10:30:30 PM - System Checkpoint

RP1747: 11/14/2013 1:06:27 AM - System Checkpoint

RP1748: 11/15/2013 11:35:48 AM - System Checkpoint

RP1749: 11/16/2013 12:08:48 PM - System Checkpoint

RP1750: 11/16/2013 1:16:34 PM - zoek.exe restore point

RP1751: 11/17/2013 10:23:16 AM - Removed Microsoft Money 2002

RP1752: 11/17/2013 10:24:58 AM - Removed Microsoft Money 2002 System Pack

RP1753: 11/17/2013 10:59:25 PM - B4 Java Update

RP1754: 11/17/2013 11:05:24 PM - Restore Operation

.

==== Installed Programs ======================

.

32 Bit HP CIO Components Installer

7-Zip 9.22beta

ABBYY FineReader 9.0 Sprint

AceFTP 3 Freeware

Acrobat.com

ActiveWords

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.05)

Amazon MP3 Downloader 1.0.15

Apple Application Support

Apple Software Update

Audacity 1.2.6

avast! Free Antivirus

AVS Audio Converter 7

BPD_Scan

Browser Address Error Redirector

CA VMN Anti-Spyware (remove only)

CamStudio OSS Desktop Recorder

CamStudio version 2.7

CCleaner

Chronotron Pro

Compatibility Pack for the 2007 Office system

Cypherix LE 10

Debut Video Capture Software

DeCypherIT

Dell DataSafe Online

Dell Driver Reset Tool

Digital Voice Recorder

DocProcQFolder

Dropbox

DVDVideoSoftTB Toolbar

Encore Pro

EncoreBasic

Epson Connect

Epson Customer Participation

Epson Download Navigator

Epson Event Manager

Epson FAX Utility

Epson PC-FAX Driver

EPSON Scan

EPSON WorkForce 545 Series Printer Uninstall

eSupportQFolder

Evernote v. 4.5.2

Express Burn Disc Burning Software

Express Dictate

Express Scribe

Express Zip

f.lux

Free Audio CD Burner version 1.4.7

Free AVI Video Converter version 5.0.23.320

Free MP4 Video Converter version 5.0.3.1206

Free Studio version 5.0.8

Free YouTube Download version 3.2.1.320

Free YouTube to MP3 Converter version 3.11.26.706

FTR TheRecord Player

GearPlayer

Google Chrome

Google Drive

Google Update Helper

High-Logic FontCreator 6.0

High Definition Audio Driver Package - KB835221

Hotfix 2055 for SQL Server 2000 ENU (KB960082)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB2779562)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB945060-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB953955)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

HP OCR Software 8.0

HP Officejet All-In-One Series

HP Photosmart Essential

HP Product Assistant

HP Solution Center and Imaging Support Tools 6.0

HP Update

HPProductAssistant

Impact 360 Desktop Applications

Intel® Graphics Media Accelerator Driver

Intel® PRO Network Connections Drivers

IrfanView (remove only)

Jasc Paint Shop Pro 8

Java Auto Updater

Java 6 Update 20

K-Lite Codec Pack 8.4.0 (Basic)

LTCM Client

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2833941)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Choice Guard

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft Office 2003 Primary Interop Assemblies

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Professional Edition 2003

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Small Business 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Software Update for Web Folders (English) 12

Microsoft SQL Server Desktop Engine (ENCOREPRO)

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual Studio 2005 Tools for Office Runtime

Microsoft Works

Mozilla Firefox 25.0.1 (x86 en-US)

Mozilla Maintenance Service

MSRS Recording System

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

MSXML 6.0 Parser (KB933579)

NCH Tone Generator

NCH Toolbox

novaPDF Lite Desktop 7.6 printer

PayPal Payment Request Wizard For Outlook

PhotoPad Image Editor

PhotoStage Slideshow Producer

Platform

PowerDVD

Print Screen Deluxe

Prism Video File Converter

QuickBooks Pro 2008

QuickTime

RealPlayer

Realtek High Definition Audio Driver

RealUpgrade 1.0

RecordPad Sound Recorder

Revo Uninstaller 1.94

River Past Audio Converter

Roxio Creator Audio

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Express Labeler 3

Roxio Update Manager

Scan

SearchAssist

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)

Security Update for Microsoft Windows (KB2564958)

Security Update for Step By Step Interactive Training (KB923723)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2846071)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB974455)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB2834904)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows Media Player 9 (KB936782)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2491683)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219-v2)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135-v2)

Security Update for Windows XP (KB2727528)

Security Update for Windows XP (KB2753842-v2)

Security Update for Windows XP (KB2757638)

Security Update for Windows XP (KB2758857)

Security Update for Windows XP (KB2770660)

Security Update for Windows XP (KB2780091)

Security Update for Windows XP (KB2802968)

Security Update for Windows XP (KB2807986)

Security Update for Windows XP (KB2813345)

Security Update for Windows XP (KB2820197)

Security Update for Windows XP (KB2820917)

Security Update for Windows XP (KB2834886)

Security Update for Windows XP (KB2839229)

Security Update for Windows XP (KB2845187)

Security Update for Windows XP (KB2850851)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953838)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371-v2)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969897)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982665)

Skype™ 5.9

Slice Audio File Splitter

Smartcard Reader Software

SolutionCenter

Sony Player Plug-in for Windows Media Player

SoundTap Streaming Audio Recorder

Spelling Dictionaries Support For Adobe Reader 9

SpywareBlaster 5.0

SUPERAntiSpyware Free Edition

SupportSoft Assisted Service

Switch Sound File Converter

The FTW Transcriber version 2.4.1

Uninstall 1.0.0.1

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB2598845)

Update for Windows Internet Explorer 8 (KB2632503)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2616676-v2)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2749655)

Update for Windows XP (KB2808679)

Update for Windows XP (KB951618-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VIA Platform Device Manager

VideoPad Video Editor

Visual Studio 2005 Tools for Office Second Edition Runtime

VLC media player 2.0.8

WavePad Sound Editor

WebEx

WebFldrs XP

WebReg

Windows Genuine Advantage Validation Tool (KB892130)

Windows Installer 3.1 (KB893803)

Windows Internet Explorer 8

Windows Management Framework Core

Windows Media Format 11 runtime

Windows Media Player 11

Windows Search 4.0

Windows XP Service Pack 3

WinZip 14.5

XP Codec Pack

.

==== Event Viewer Messages From Past Week ========

.

11/16/2013 1:53:21 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to

load: iaStor

11/12/2013 9:28:23 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service WSearch with

arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

11/12/2013 6:22:00 PM, error: Schedule [7901] - The At1.job command failed to start due to the following error:

%%2147942402

11/11/2013 11:35:34 AM, error: SCardSvr [610] - Smart Card Reader 'Infineer , Inc. USB 0' rejected IOCTL EJECT: The

request is not supported.

11/11/2013 10:23:25 AM, error: Service Control Manager [7024] - The Background Intelligent Transfer Service service

terminated with service-specific error 2147500037 (0x80004005).

.

==== End Of File ===========================

PamJ · November 19, 2013

I'm not sure if this is helpful at all, but I did a computer search for "aartemis" and came up with this:

http://www.perfect-word.net/images/aartemis.jpg

PamJ · November 19, 2013

Just thought I'd try to bump this up to see if anyone could help. Thanks.

MrCharlie · November 19, 2013

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

PamJ · November 19, 2013

Thank you, MrCharlie.

Here is the result of the RogueKiller scan:

RogueKiller V8.7.8 [Nov 14 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Pam [Admin rights]

Mode : Scan -- Date : 11/19/2013 16:55:13

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 1 ¤¤¤

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD3200AAKS-75L9A0 +++++

--- User ---

[MBR] 716891557b0b149140cf6ab6efa28616

[bSP] 11d467b9f31927f29d49c85858b51038 : Windows XP MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 112455 | Size: 305180 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_11192013_165513.txt >>

MrCharlie · November 20, 2013

Give this a try to start with:

Lets clean out any adware/spyware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Make sure you click on download buttons that look like this, not "sponsored ad links":

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

PamJ · November 20, 2013

Some of the items I recognize but most I have no clue if I should keep them or not. (And aarteimis is showing up several times.)

These are the programs that show up that I use all the time:

DVDVideoSoft

NCH Sofware

If you could take a look at the log/report below and let me know what else I should keep (or delete, whichever way is easier), I would appreciate it. Thank you!

# AdwCleaner v3.012 - Report created 19/11/2013 at 20:07:01

# Updated 11/11/2013 by Xplode

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

# Username : Pam - DDCKMRH1

# Running from : C:\Documents and Settings\Pam\Desktop\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Program Files\Mozilla Firefox\searchplugins\aartemis.xml

Folder Found C:\Documents and Settings\All Users\Application Data\NCH Software

Folder Found C:\Documents and Settings\Non-Admin\Application Data\vmntoolbar

Folder Found C:\Documents and Settings\Pam\Application Data\NCH Software

Folder Found C:\Documents and Settings\Pam\Local Settings\Application Data\DVDVideoSoftTB

Folder Found C:\Program Files\MyPC Backup

Folder Found C:\Program Files\NCH Software

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\DVDVideoSoftTB

Key Found : HKCU\Software\InstallCore

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FBEE89F7-84F2-4391-BB03-5A712C68DB32}

Key Found : HKCU\Software\NCH Software

Key Found : HKCU\Software\smartbar

Key Found : HKCU\Software\YahooPartnerToolbar

Key Found : HKCU\Toolbar

Key Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL

Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{FBEE89F7-84F2-4391-BB03-5A712C68DB32}

Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Found : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}

Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}

Key Found : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}

Key Found : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}

Key Found : HKLM\SOFTWARE\Classes\Interface\{7697BC38-D0FA-454B-AC75-968B4CCABFCE}

Key Found : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}

Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2269050

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3287822

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3289847

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\DVDVideoSoftTB

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BD5217A6-EBC7-4377-8828-EC04EDE9C032}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F587EBF6-F156-465C-9910-6055CE92FA47}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DVDVideoSoftTB Toolbar

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FBEE89F7-84F2-4391-BB03-5A712C68DB32}

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar

Key Found : HKLM\SOFTWARE\MozillaPlugins\@funwebproducts.com/Plugin

Key Found : HKLM\Software\NCH Software

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Documents and Settings\Pam\Application Data\Mozilla\Firefox\Profiles\35637qgf.default\prefs.js ]

Line Found : user_pref("CT3290229.FF19Solved", "true");

Line Found : user_pref("CT3290229.UserID", "UN10481539506906802");

Line Found : user_pref("CT3290229.browser.search.defaultthis.engineName", "true");

Line Found : user_pref("CT3290229.installDate", "6/4/2013 10:49:55");

Line Found : user_pref("CT3290229.installerVersion", "1.3.7.3");

Line Found : user_pref("CT3290229.keyword", "true");

Line Found : user_pref("browser.search.defaultenginename", "aartemis");

Line Found : user_pref("browser.search.selectedEngine", "aartemis");

Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.cookie.previous_page.value", "%22hxxp%3A//aartemis.com/%3Ftype%3Dsc%26ts%3D1384747283%26from%3Dtug[...]

Line Found : user_pref("extensions.crossrider.bic", "142695fad2a36fd7a0bf2f61b6eebaf3");

[ File : C:\Documents and Settings\Non-Admin\Application Data\Mozilla\Firefox\Profiles\xkyn64nr.default\prefs.js ]

-\\ Google Chrome v

[ File : C:\Documents and Settings\Pam\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [5727 octets] - [19/11/2013 20:07:01]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5787 octets] ##########

MrCharlie · November 20, 2013

Unchecked these:

Folder Found C:\Documents and Settings\Pam\Local Settings\Application Data\DVDVideoSoftTB

Key Found : HKCU\Software\DVDVideoSoftTB

Key Found : HKLM\Software\DVDVideoSoftTB

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar

I don't see this in the log:

NCH Sofware

MrC

PamJ · November 20, 2013

I will finish the AdwCleaner stuff up now. Thanks for going over the list for me.

The NCH Software was the first "Folder" found:

File Found : C:\Program Files\Mozilla Firefox\searchplugins\aartemis.xml

Folder Found C:\Documents and Settings\All Users\Application Data\NCH Software

Folder Found C:\Documents and Settings\Non-Admin\Application Data\vmntoolbar

Folder Found C:\Documents and Settings\Pam\Application Data\NCH Software

Folder Found C:\Documents and Settings\Pam\Local Settings\Application Data\DVDVideoSoftTB

Folder Found C:\Program Files\MyPC Backup

Folder Found C:\Program Files\NCH Software

MrCharlie · November 20, 2013

OK, you listed it as NCH Sofware (missing the t) and that's what I search for.

That's why I missed it, so just uncheck it.

MrC

PamJ · November 20, 2013

Oops, sorry about that!

It appears that AdwCleaner did the trick! I just checked on FF and the problem is gone! (FF is usually my default, but I've been using Chrome since the problem started.) I will still post the log below, but I think you fixed it! Thank you SO much! Oh, should I just keep those items in quarantine for a awhile to make sure I don't need something or just delete them permanently?

# AdwCleaner v3.012 - Report created 19/11/2013 at 21:43:46

# Updated 11/11/2013 by Xplode

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

# Username : Pam - DDCKMRH1

# Running from : C:\Documents and Settings\Pam\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

[x] Not Deleted : C:\Documents and Settings\All Users\Application Data\NCH Software

Folder Deleted : C:\Program Files\MyPC Backup

[x] Not Deleted : C:\Program Files\NCH Software

[x] Not Deleted : C:\Documents and Settings\Pam\Local Settings\Application Data\DVDVideoSoftTB

[x] Not Deleted : C:\Documents and Settings\Pam\Application Data\NCH Software

Folder Deleted : C:\Documents and Settings\Non-Admin\Application Data\vmntoolbar

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\aartemis.xml

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Toolbar

Key Deleted : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL

Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@funwebproducts.com/Plugin

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2269050

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3287822

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289847

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FBEE89F7-84F2-4391-BB03-5A712C68DB32}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7697BC38-D0FA-454B-AC75-968B4CCABFCE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FBEE89F7-84F2-4391-BB03-5A712C68DB32}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FBEE89F7-84F2-4391-BB03-5A712C68DB32}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F587EBF6-F156-465C-9910-6055CE92FA47}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BD5217A6-EBC7-4377-8828-EC04EDE9C032}

Key Deleted : HKCU\Software\Conduit

[x] Not Deleted : HKCU\Software\DVDVideoSoftTB

Key Deleted : HKCU\Software\InstallCore

[x] Not Deleted : HKCU\Software\NCH Software

Key Deleted : HKCU\Software\smartbar

Key Deleted : HKCU\Software\YahooPartnerToolbar

[x] Not Deleted : HKCU\Software\DVDVideoSoftTB

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKLM\Software\Conduit

[x] Not Deleted : HKLM\Software\DVDVideoSoftTB

[x] Not Deleted : HKLM\Software\NCH Software

[x] Not Deleted : HKLM\Software\DVDVideoSoftTB

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DVDVideoSoftTB Toolbar

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Documents and Settings\Pam\Application Data\Mozilla\Firefox\Profiles\35637qgf.default\prefs.js ]

Line Deleted : user_pref("CT3290229.FF19Solved", "true");

Line Deleted : user_pref("CT3290229.UserID", "UN10481539506906802");

Line Deleted : user_pref("CT3290229.browser.search.defaultthis.engineName", "true");

Line Deleted : user_pref("CT3290229.installDate", "6/4/2013 10:49:55");

Line Deleted : user_pref("CT3290229.installerVersion", "1.3.7.3");

Line Deleted : user_pref("CT3290229.keyword", "true");

Line Deleted : user_pref("browser.search.defaultenginename", "aartemis");

Line Deleted : user_pref("browser.search.selectedEngine", "aartemis");

Line Deleted : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.cookie.previous_page.value", "%22hxxp%3A//aartemis.com/%3Ftype%3Dsc%26ts%3D1384747283%26from%3Dtug[...]

Line Deleted : user_pref("extensions.crossrider.bic", "142695fad2a36fd7a0bf2f61b6eebaf3");

[ File : C:\Documents and Settings\Non-Admin\Application Data\Mozilla\Firefox\Profiles\xkyn64nr.default\prefs.js ]

-\\ Google Chrome v

[ File : C:\Documents and Settings\Pam\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [5867 octets] - [19/11/2013 20:07:01]

AdwCleaner[s0].txt - [5955 octets] - [19/11/2013 21:43:46]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [6015 octets] ##########

MrCharlie · November 20, 2013

Good and yes you can keep the quarantine items as long as needed.

Sometimes we have to manually fix Chrome.

Use it and let me know how it is.

MrC

PamJ · November 20, 2013

Fortunately Chrome and IE were not affected at all, but that may be because FF is my default browser. I just changed default to Chrome when the problem started on FF only. Switching back to FF, thanks to you!

Thanks again, MrC! You made it a very simple and easy process (on my side, anyway)! (Oh, and I love your "crew"!)

Pam

MrCharlie · November 20, 2013

OK........

A little clean up to do....

Please download OTC to your desktop. (This will clean up most of the tools and logs)

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again. (also HERE)

Good Luck and Thanks for using the forum, MrC

PamJ · November 20, 2013

Your preventative maintenance information looks fantastic. I will be printing that out and also bookmarking so I can have access easily to the links. Thanks again...enjoy the rest of your week!

Pam

MrCharlie · November 20, 2013

OK.....Take Care MrC

AdvancedSetup · November 21, 2013

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Another Aartemis Problem

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information