tssd.exe / windows update / missing drive

capthook · June 3, 2010

Recovering from tssd.exe

Removal appears to be succesful.

Remaining issues:

1) unable to connect to windows update (and many sites with those in the url)

2) 'C' drive disappeared from Device Manager and Disk Management (but works fine and shows in windows explorer)

3) Most earlier 'Restore Points' won't work.

Removal:

A) Malwarebytes: quick scan removed several tssd.exe components and registry keys. Full scan removed 2 restore points registry keys.

Malwarebytes, Spybot, AVG and a few other scanners all now show system as 'clean'.

C) Registry self-checks appear ok.

So trying to clean up the leftover problems:

1) windows update

http://windowsupdate.microsoft.com/ : Unable to connect - similiar to no internet connection available

http://www.update.microsoft.com/microsoftu...t.aspx?ln=en-us : Error number: 0x80072EFF

Many searches on a fix = some sigths unable to connect as they have windowsupdate in their url?

The tssd.exe didn't change my browser proxy settings - so didn't have to fix that.

Cleared browser cache.

Added both the windows update sites to the 'trusted sites' in security

I flushed the dns cache from a Command Prompt: ipconfig /flushdns.

Updated Java.

Updated BITS.

Checked DNS server etc. : Start > Run > cmd > ipconfig /all

Changed DNS server to free google DNS:

8.8.8.8

8.8.4.4

6 hours searching/working on this with no resolution!

And now - unable to post this topic from the computer at issue! Browsing/searching fine - posting just blocked?!?

2) 'C' drive disappeared

Rescanned for drive information: Start/run/cmd <enter> / diskpart <enter> / rescan <enter>

Checked low/high filters: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}

Seems like the hard drive 'busy light' is never quite now - always a small tick-tick-tick.

??

Summary:

I do believe the system has been cleaned - it's now repairing the damage left behind.

Any/all help/comments/suggestions greatly appreciated.

Thank you!!

capthook · June 3, 2010

DDS.txt included

gmer.exe locked up

DDS (Ver_10-03-17.01) - NTFSx86

Run by JCP at 11:32:19.92 on Thu 06/03/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.490 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\Sygate\SPF\smc.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

C:\WINDOWS\system32\CTHELPER.EXE

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\SYSTEM32\notepad.exe

C:\Documents and Settings\JCP\Desktop\Spybot etc\Malwarebytes tools\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://my.yahoo.com/

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/ymj/*http://www.yahoo.com

uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = hxxp://www.dell.com/

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/ymj/*http://www.yahoo.com

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll

BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - c:\progra~1\search~1\SEARCH~1.DLL

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll

BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\dap\DAPIEL~1.DLL

BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\speedb~1\toolbar\grabber.dll

TB: {62999427-33FC-4baf-9C9C-BCE6BD127F08} - No File

TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File

TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll

TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [CTSysVol] c:\program files\creative\sbaudigy2\surround mixer\CTSysVol.exe

mRun: [CTDVDDet] c:\program files\creative\sbaudigy2\dvdaudio\CTDVDDet.EXE

mRun: [CTHelper] CTHELPER.EXE

mRun: [AsioReg] REGSVR32.EXE /S CTASIO.DLL

mRun: [DVDSentry] c:\windows\system32\DSentry.exe

mRun: [Logitech Utility] Logi_MwX.Exe

mRun: [smcService] c:\progra~1\sygate\spf\smc.exe -startgui

mRun: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings

mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

StartupFolder: c:\documents and settings\jcp\start menu\programs\startup\PowerReg Scheduler V3.exe

IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm

IE: &Download with &DAP - c:\program files\dap\dapextie.htm

IE: Download &all with DAP - c:\program files\dap\dapextie2.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

Trusted Zone: microsoft.com\update

Trusted Zone: microsoft.com\windowsupdate

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} - hxxp://ea-src-cdn.systemrequirementslab.com/curi/bin/sysreqlab_srlx.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262976849734

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1260487706328

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {A31CCCB0-46A8-11D3-A726-005004B35102} - hxxp://download.actify.com/SpinFire/SFViewerWeb.cab

DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} - hxxp://support.microsoft.com/mats/DiagWebControl.cab

DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab

DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

Notify: gebcd - gebcd.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jcp\applic~1\mozilla\firefox\profiles\ytcknmzy.default\

FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/

FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll

FF - component: c:\program files\dap\dapfirefox\components\DAPFireFox.dll

FF - component: c:\program files\speedbit video downloader\spfirefox\components\Engine.dll

FF - plugin: c:\documents and settings\jcp\application data\move networks\plugins\npqmp071505000010.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\windows\system32\npmirage.dll

FF - plugin: c:\windows\system32\npwmsdrm.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-6-2 216200]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-6-2 29584]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-6-2 242896]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-6-2 308064]

R3 WFsys;WinFox Control I/O Driver;c:\windows\system32\drivers\wfsys.sys [2006-3-15 13692]

R4 WINFOXIO;WINFOXIO;c:\windows\system32\drivers\WINFOXIO.sys [2006-3-15 9600]

S3 Bulk503;Chameleon Mega Digital Camera;c:\windows\system32\drivers\bulk503.sys --> c:\windows\system32\drivers\Bulk503.sys [?]

S3 CEUSBAUD;DigiTech USB MIDI Driver;c:\windows\system32\drivers\ceusbaud.sys [2009-11-2 17920]

S3 ISO503;Chameleon Mega Video Camera;c:\windows\system32\drivers\iso503.sys --> c:\windows\system32\drivers\ISO503.SYS [?]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-3-25 17920]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-3-25 7680]

S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2008-3-25 42112]

S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2008-3-25 23680]

S3 NdUsbMsn;ARESCOM USB Network Adapter;c:\windows\system32\drivers\NdusbMsn.sys [2003-12-15 18023]

S3 tj2knd5;Terayon Cable Modem (NDIS);c:\windows\system32\drivers\tj2knd5.sys [2004-3-1 17616]

S3 tj2kunic;Terayon Cable Modem (WDM);c:\windows\system32\drivers\tj2kunic.sys [2004-3-1 69680]

S4 gupdate1c9b1bf8dd0b46;Google Update Service (gupdate1c9b1bf8dd0b46);"c:\program files\google\update\googleupdate.exe" /svc --> c:\program files\google\update\GoogleUpdate.exe [?]

S4 vsdatant;vsdatant; [x]

=============== Created Last 30 ================

2010-06-03 15:30:25 0 ----a-w- c:\documents and settings\jcp\defogger_reenable

2010-06-03 03:55:15 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-06-03 03:55:14 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-06-03 03:55:06 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-06-03 03:54:57 0 d-----w- c:\windows\system32\drivers\Avg

2010-06-03 03:54:39 0 d-----w- c:\program files\AVG

2010-06-03 03:54:38 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

2010-06-03 02:47:43 8734 ----a-w- C:\cc_20100602_224741.reg

2010-06-03 02:14:06 0 d-----w- c:\windows\system32\wbem\Repository

2010-06-03 00:38:30 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-03 00:13:58 94720 ----a-w- c:\windows\system32\dllcache\umaxud32.dll

2010-06-03 00:12:59 98080 ----a-w- c:\windows\system32\dllcache\sgiulnt5.sys

2010-06-03 00:11:59 48000 ----a-w- c:\windows\system32\dllcache\ovcam2.sys

2010-06-03 00:10:59 34304 ----a-w- c:\windows\system32\dllcache\migisol.exe

2010-06-03 00:09:57 10096640 ----a-w- c:\windows\system32\dllcache\hwxcht.dll

2010-06-03 00:08:59 206976 ----a-w- c:\windows\system32\dllcache\dot4.sys

2010-06-03 00:07:59 66082 ----a-w- c:\windows\system32\dllcache\c_10021.nls

2010-06-02 11:46:35 0 d-----w- c:\program files\Avira

2010-06-02 11:46:35 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

2010-06-02 07:33:08 0 d-----w- C:\$AVG

2010-05-17 07:33:37 460 ----a-w- C:\cc_20100517_033336.reg

2010-05-12 02:59:44 2600 ----a-w- C:\cc_20100511_225943.reg

==================== Find3M ====================

2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-24 06:21:07 6074 ----a-w- C:\cc_20100424_022103.reg

2010-04-21 20:11:55 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs

2010-04-21 20:11:53 0 ----a-w- c:\windows\system32\drivers\logiflt.iad

2010-04-19 06:39:08 460 ----a-w- C:\cc_20100419_023906.reg

2010-04-12 07:32:16 10018 ----a-w- C:\cc_20100412_033213.reg

2010-04-03 02:06:08 48870 ----a-w- C:\cc_20100402_220603.reg

2009-11-04 08:08:17 372805 ----a-w- c:\program files\uninstal.log

2009-10-11 07:19:38 23751680 ----a-w- c:\program files\Independence Free.dll

2004-08-04 07:56:57 73728 --sha-w- c:\windows\registeredpackages\{dd90d410-1823-43eb-9a16-a2331bf08799}$backup$\system\wmplayer.exe

2006-05-03 09:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 10:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 12:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

2008-05-25 00:26:32 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052420080525\index.dat

============= FINISH: 11:34:44.79 ===============

Maniac · June 3, 2010

Hello capthook! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.

DDS.txt included
gmer.exe locked up

They missing...

capthook · June 3, 2010

Hello Borislav - thank you!!

The dds.txt was pasted in the body of my previous post.

I have also now attached the file.

Also attached is the attach.zip file.

I tried to run gmer.exe but it froze up after a few min. of running.

A couple other notes to add about windows update:

- checked Hosts files, is ok

- reset Internet Explorer

Thanks again for you help!

DDS.txt

Attach.zip

capthook · June 3, 2010

P.S. I also ran Defogger: it ran and said ok but didn't reboot the system

Maniac · June 3, 2010

Step 1

Please, uninstall the following applications:

Adobe Acrobat 5.0
Adobe Reader 9.2
Uniblue ProcessScanner

You can read, how to this here:

Step 2

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Step 3

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s) in this sequence:

JavaRa log
MalwareBytes' Anti-Malware log
a new fresh DDS log only

capthook · June 3, 2010

Thank you so much for your help and your quick reply!

Uninstalled the following applications:

1.Adobe Acrobat 5.0

2.Adobe Reader 9.2

3.Uniblue ProcessScanner

- Removed ALL versions of JAVA

- Ran JavaRa

- JavaRa.log attached

- additional Java folders deleted

- Performed Quick Scan

- fresh DDS log

JavaRa 1.15 Removal Log.Report follows after line.------------------------------------The JavaRa removal process was started on Thu Jun 03 14:13:17 2010

Found and removed: C:\Program Files\Java\j2re1.4.1_02Found and removed: C:\Program Files\Java\j2re1.4.2Found and removed: C:\Program Files\Java\jre1.6.0_03Found and removed: C:\Windows\System32\jpicpl32.cplFound and removed: C:\Windows\Installer\{7148F0A8-6813-11D6-A77B-00B0D0142000}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\javaw.ExeFound and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.4Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Java Web StartFound and removed: Software\JavaSoft\Java2D\1.5.0_09Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EFCE5837-FC21-11D6-9D24-00010240CE95}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7148F0A8-6813-11D6-A77B-00B0D0142000}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}Found and removed: SOFTWARE\Classes\Installer\Products\8A0F841731866D117AB7000B0D410200Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F841731866D117AB7000B0D410200Found and removed: SOFTWARE\Classes\JavaPlugin.141_02Found and removed: SOFTWARE\Classes\JavaPlugin.142Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.4.1_02Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.4.2Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.4.1_02Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.4.2Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.4.2Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}Found and removed: Software\Classes\JavaPlugin.141_02Found and removed: Software\Classes\JavaPlugin.142Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACB9B14518A96D117A58000B0D410200Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\------------------------------------Finished reporting.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4167

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/3/2010 2:35:45 PM

mbam-log-2010-06-03 (14-35-45).txt

Scan type: Quick scan

Objects scanned: 130988

Time elapsed: 13 minute(s), 31 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-03-17.01) - NTFSx86

Run by JCP at 14:40:03.64 on Thu 06/03/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.504 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\Sygate\SPF\smc.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE