gmer log - others won't work

Roon · September 5, 2010

Thank you for your help. I have Windows XP Home on this machine. Besides Malware bytes, I was using AVG for my virus. It was up to date but expired about Thursday. My internet was down. When my internet came back up, I noticed that Comcast had installed Macafee and I decided to use that instead of paying for AVG update. I'm not married to that if that is a bad idea. I also kept my malwarebytes up to date and have a paid subscription to it. There is no free space but I delete files and that doesn't seem to free space up. My system did not come with discs for windows just a restore operating system. I had already deleted temp files but I just installed the hard drive so very little had built up.

DDS wouldn't work. "Unknown Error"

Defogger wouldn't work "Unable to operate create file"

Here is the log from gmer. It would not create the file (disk full) so I copied and pasted. It did seem to have an error or message or two that flashed by in the beginning but I didn't catch what they were or said.

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-09-05 18:38:13

Windows 5.1.2600 Service Pack 3

Running: nqyby96b.com

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B84639015731CB44CBE593FB79D735AF\Usage@PDFCreate32 1025835108

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@TracesProcessed 3319

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\Meg\My Documents\restored laptop\Drive©\Documents and Settings\Meg\Application Data\Macromedia\Flash Player\#SharedObjects\BSVED63S\g-ecx.images-amazon.com\images\G\01\digital\music\swfs\AlbumSampler_Localized_Prod._V228929840_.swf\AlbumSampler.sol 52 bytes

---- EOF - GMER 1.0.15 ----

Again, thank you in advance!

Meg

Maurice Naggar · September 5, 2010

Hello Meg,

Do you mean this system is out of free space? or extremely close to it?

There is no free space but I delete files and that doesn't seem to free space up.

Download TFC by OldTimer to your desktop

Please double-click TFC.exe to run it. (Note: If you are running on Vista or Windows 7, right-click on the file and choose Run As Administrator).
It will close all programs when run, so make sure you have saved all your work before you begin.
Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
IF prompted to Reboot, reply "Yes".

Next: Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Next, use My Computer {Windows Explorer}. Look at the My Computer selection. How much free space is there?

Roon · September 6, 2010

Ok, wasn't quite as easy as that but I eventually was able to trick the computer into running it. It seemed to help already, my internet looks normal again.

When I look at properties, my hard drive is now showing pink again with 85.1 GB free.

Am I repaired or are there still steps to take?

Thank you once again!

Meg

Edited September 6, 2010 by Maurice Naggar
Quoted section removed

Maurice Naggar · September 6, 2010

No we aren't done. There's more checking to start with. I need to see other reports.

Download DDS and save it to your desktop from http://www.techsupportforum.com/sectools/sUBs/dds here or

http://download.bleepingcomputer.com/sUBs/dds.scr or

http://www.forospyware.com/sUBs/dds

Disable any script blocker if your antivirus/antimalware has it.

Then double click dds.scr to run the tool.

DDS will run in a command prompt window and will take 3 to 4 minutes or so.

When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop.

Please include the following logs ( Copy & Paste) in your next reply:

DDS.txt

Attach.txt

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

When starting a reply, please onlu use the AddReply button at lower left of forum screen.

Roon · September 6, 2010

Here you go. I am SO impressed by the level of help. You guys deserve an award! Thank you!

DDS log

DDS (Ver_10-03-17.01) - NTFSx86

Run by Meg at 11:53:20.82 on Mon 09/06/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1029 [GMT -4:00]

AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Nuance\PDF Professional 6\PDFProFiltSrv.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

C:\Program Files\Creative\VoiceCenter\AndreaVC.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Pure Networks\Network Magic\nmapp.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Nuance\PDF Professional 6\pdfpro6hook.exe

C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe

C:\Program Files\NetWaiting\netWaiting.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\Xfinity TV\Xfinity TV Downloads Media Manager\MediaManager.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe

C:\Program Files\Common Files\Teleca Shared\Generic.exe

C:\Program Files\Common Files\Teleca Shared\logger.exe

C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe

C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe

C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Meg\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://dogpile.com/

uInternet Connection Wizard,ShellNext = hxxp://www.dell.com/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll

BHO: PlusIEEventHelper Class: {551a852f-39a6-44a7-9c13-afbec9185a9d} - c:\program files\nuance\pdf professional 6\bin\PlusIEContextMenu.dll

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll

BHO: ZeonIEEventHelper Class: {da986d7d-ccaf-47b2-84fe-bfa1549bebf9} - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll

TB: Nuance PDF: {e3286bf1-e654-42ff-b4a6-5e111731df6b} - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll

uRun: [setDefaultMIDI] MIDIDef.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /installquiet

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

mRun: [sigmatelSysTrayApp] stsystra.exe

mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe

mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"

mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r

mRun: [MBDef] MBDef.Exe

mRun: [updReg] c:\windows\UpdReg.EXE

mRun: [VoiceCenter] "c:\program files\creative\voicecenter\AndreaVC.exe" /tray

mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"

mRun: [nmapp] "c:\program files\pure networks\network magic\nmapp.exe" -autorun -nosplash

mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe

mRun: [PDFHook] c:\program files\nuance\pdf professional 6\pdfpro6hook.exe

mRun: [PDF6 Registry Controller] c:\program files\nuance\pdf professional 6\RegistryController.exe

mRun: [Nuance PDF Professional 6-reminder] "c:\program files\nuance\pdf professional 6\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\pdf professional 6\ereg\Ereg.ini"

mRun: [intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup

mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe

mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe

mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Mobile Connectivity Suite] "c:\program files\htc\htc sync\application launcher\Application Launcher.exe" /startoptions

mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng1.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\xfinit~1.lnk - c:\program files\xfinity tv\xfinity tv downloads media manager\MediaManager.exe

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Open with Nuance PDF Converter 6.0 - c:\program files\nuance\pdf professional 6\cnvres_eng.dll /100

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll

Notify: avgrsstarter - avgrsstx.dll

Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

LSA: Authentication Packages = msv1_0 relog_ap

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-8-21 12552]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-8-21 335240]

R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-8-21 27784]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-8-21 108552]

R2 PDFProFiltSrv;PDFProFiltSrv;c:\program files\nuance\pdf professional 6\PDFProFiltSrv.exe [2009-7-27 134944]

R4 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2010-8-21 297752]

S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2010-9-3 24576]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

=============== Created Last 30 ================

2010-09-05 20:27:37 0 ----a-w- C:\kxloapog.sys

2010-09-05 18:00:32 0 d-----w- c:\program files\Trend Micro

2010-09-05 17:46:22 44544 ----a-w- c:\windows\system32\agremove.exe

2010-09-04 02:27:38 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf

2010-09-04 02:27:37 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

2010-09-04 02:27:30 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll

2010-09-04 02:08:16 0 d-----w- c:\docume~1\meg\applic~1\Teleca

2010-09-04 02:07:52 0 d-----w- c:\docume~1\alluse~1\applic~1\HTC

2010-09-04 02:07:47 0 d-----w- c:\program files\common files\Teleca Shared

2010-09-04 02:07:47 0 d-----w- c:\docume~1\alluse~1\applic~1\Teleca

2010-09-04 02:05:58 24576 ----a-w- c:\windows\system32\drivers\ANDROIDUSB.sys

2010-09-04 02:05:58 1122664 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll

2010-09-04 02:05:53 0 d-----w- c:\program files\Spirent Communications

2010-09-04 02:05:46 0 d-----w- c:\program files\HTC

2010-09-03 20:49:58 0 d-----w- c:\docume~1\meg\applic~1\Intuit

2010-09-03 20:49:18 0 d-----w- c:\program files\common files\AnswerWorks 5.0

2010-09-03 20:15:24 0 d-----w- c:\program files\iPod

2010-09-03 20:14:43 0 d-----w- c:\program files\iTunes

2010-09-03 18:41:18 0 d-----w- c:\program files\TurboTax

2010-09-03 14:02:11 0 d-----w- c:\program files\Xfinity TV

2010-09-03 13:33:03 0 d-----w- c:\program files\Windows Media Connect 2

2010-09-03 13:31:42 0 d-----w- c:\windows\system32\LogFiles

2010-09-03 06:42:14 0 d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan

2010-09-03 06:42:12 0 d-----w- c:\program files\McAfee Security Scan

2010-09-01 05:11:02 0 d-----w- c:\program files\Baarns

2010-08-30 20:38:29 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2010-08-30 20:38:29 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2010-08-30 20:36:54 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-08-30 20:33:21 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2010-08-30 20:33:21 3062048 ----a-w- c:\windows\system32\usbaaplrc.dll

2010-08-30 20:31:49 0 d-----w- c:\program files\Bonjour

2010-08-28 00:52:59 0 d-----w- c:\program files\common files\Motive

2010-08-27 15:24:31 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf

2010-08-27 15:24:26 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2010-08-27 15:22:19 21504 ----a-w- c:\windows\system32\drivers\hidserv.dll

2010-08-27 15:08:22 74528 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT

2010-08-27 15:07:34 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys

2010-08-27 15:07:34 14592 ----a-w- c:\windows\system32\dllcache\kbdhid.sys

2010-08-27 13:28:53 0 d-----w- c:\windows\system32\wbem\Repository

2010-08-26 03:46:13 3248 ----a-w- c:\windows\system32\wbem\Outlook_01cb44d13ae5dcac.mof

2010-08-25 05:11:04 0 d-----w- c:\documents and settings\meg\Philips backup

2010-08-25 03:35:27 44384 ----a-w- c:\windows\system32\drivers\tifsfilt.sys

2010-08-25 03:35:27 441760 ----a-w- c:\windows\system32\drivers\timntr.sys

2010-08-25 03:35:22 129248 ----a-w- c:\windows\system32\drivers\snapman.sys

2010-08-25 03:35:12 368736 ----a-w- c:\windows\system32\drivers\tdrpman.sys

2010-08-25 02:37:02 0 d-----w- c:\docume~1\meg\applic~1\Nuance

2010-08-25 02:36:58 0 d-----w- c:\docume~1\meg\applic~1\FLEXnet

2010-08-23 23:25:32 0 d-----w- C:\123ca2a33f23cf854b66aa

2010-08-23 23:01:57 1089593 ------w- c:\windows\system32\dllcache\ntprint.cat

2010-08-23 20:20:02 4194304 ----a-w- c:\windows\system32\cdintf400.dll

2010-08-23 20:11:47 0 d-----w- c:\program files\Intuit

2010-08-23 20:11:47 0 d-----w- c:\program files\common files\Intuit

2010-08-23 20:11:47 0 d-----w- c:\docume~1\alluse~1\applic~1\Intuit

2010-08-23 19:36:26 90 ----a-w- c:\windows\QBChanUtil_Trigger.ini

2010-08-23 19:36:24 0 d-----w- c:\docume~1\alluse~1\applic~1\SQL Anywhere 11

2010-08-23 19:36:08 0 d-----w- c:\docume~1\alluse~1\applic~1\COMMON FILES

2010-08-23 19:28:22 0 d-----w- c:\windows\system32\XPSViewer

2010-08-23 19:26:00 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2010-08-23 19:26:00 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2010-08-23 19:26:00 117760 ------w- c:\windows\system32\prntvpt.dll

2010-08-23 19:25:59 575488 ------w- c:\windows\system32\xpsshhdr.dll

2010-08-23 19:25:59 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll

2010-08-23 19:25:59 1676288 ------w- c:\windows\system32\xpssvcs.dll

2010-08-23 19:25:59 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll

2010-08-23 19:25:58 0 d-----w- C:\83d2f382e70aa8b986f70d31

2010-08-23 18:21:14 0 ----a-w- c:\windows\tosOBEX.INI

2010-08-23 17:15:07 0 d-----w- c:\windows\Intuit

2010-08-23 15:45:29 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys

2010-08-23 15:45:29 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys

2010-08-23 15:45:18 21504 ----a-w- c:\windows\system32\hidserv.dll

2010-08-23 15:45:18 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll

2010-08-23 15:45:11 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2010-08-23 15:45:11 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys

2010-08-23 15:44:54 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys

2010-08-23 15:44:54 10368 ----a-w- c:\windows\system32\dllcache\hidusb.sys

2010-08-23 13:15:40 726008 ----a-w- c:\documents and settings\meg\gotomypc_438.exe

2010-08-22 13:35:36 274288 ----a-w- c:\windows\system32\mucltui.dll

2010-08-22 13:35:36 215920 ----a-w- c:\windows\system32\muweb.dll

2010-08-22 13:35:36 16736 ----a-w- c:\windows\system32\mucltui.dll.mui

2010-08-21 04:34:33 0 d-----w- c:\docume~1\meg\applic~1\Zeon

2010-08-21 04:34:26 0 d-----w- c:\docume~1\alluse~1\applic~1\Nuance

2010-08-21 04:33:34 0 d-----w- c:\docume~1\alluse~1\applic~1\zeon

2010-08-21 04:33:30 0 d-----w- c:\program files\common files\ScanSoft Shared

2010-08-21 04:33:02 0 d-----w- c:\program files\Nuance

2010-08-21 04:12:38 0 d-----w- c:\docume~1\meg\applic~1\AVG8

2010-08-21 04:12:07 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2010-08-21 04:12:06 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-08-21 04:12:04 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-08-21 04:11:58 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-08-21 04:11:56 0 d-----w- c:\windows\system32\drivers\Avg

2010-08-21 04:11:53 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar

2010-08-21 04:11:42 0 d-----w- c:\program files\AVG

2010-08-21 04:11:42 0 d-----w- c:\docume~1\alluse~1\applic~1\avg8

2010-08-21 03:19:34 0 d-----w- c:\program files\Pure Networks

2010-08-21 03:13:41 0 d-----w- c:\program files\WebEx

2010-08-21 03:13:06 25392 ----a-w- c:\windows\system32\drivers\pnarp.sys

2010-08-21 03:12:50 26672 ----a-w- c:\windows\system32\drivers\purendis.sys

2010-08-21 03:12:47 0 d-----w- c:\program files\common files\Pure Networks Shared

2010-08-21 03:12:21 0 d-----w- c:\docume~1\alluse~1\applic~1\Pure Networks

2010-08-21 01:52:10 0 d-----w- c:\docume~1\meg\applic~1\Malwarebytes

2010-08-21 01:52:02 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-08-21 01:52:01 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-21 01:44:32 17920 ----a-w- c:\windows\system32\mdimon.dll

2010-08-21 01:43:03 0 d-----w- c:\windows\SHELLNEW

2010-08-21 00:55:32 0 d-sh--w- c:\documents and settings\meg\IECompatCache

2010-08-21 00:55:24 376 ----a-w- c:\windows\ODBC.INI

2010-08-21 00:54:51 0 d-sh--w- c:\documents and settings\meg\PrivacIE

2010-08-21 00:45:34 0 d-sh--w- c:\documents and settings\meg\IETldCache

2010-08-21 00:41:27 0 dc-h--w- c:\windows\ie8

2010-08-21 00:17:53 0 d-----w- c:\windows\system32\scripting

2010-08-21 00:17:53 0 d-----w- c:\windows\l2schemas

2010-08-21 00:17:52 0 d-----w- c:\windows\system32\en

2010-08-21 00:17:52 0 d-----w- c:\windows\system32\bits

2010-08-21 00:16:57 0 d-----w- c:\windows\ServicePackFiles

2010-08-21 00:15:43 0 d-----w- c:\docume~1\meg\applic~1\Intel

2010-08-21 00:14:49 4128 ----a-w- C:\INFCACHE.1

2010-08-21 00:13:16 0 d-----w- c:\windows\EHome

2010-08-21 00:10:15 8192 ----a-w- c:\windows\REGLOCS.OLD

2010-08-21 00:09:01 61 ----a-w- c:\windows\smscfg.ini

2010-08-21 00:06:58 999 ------w- c:\windows\system32\dllcache\bktrh.gif

2010-08-21 00:02:34 0 d-sh--w- c:\documents and settings\meg\UserData

2010-08-20 23:57:14 272128 ------w- c:\windows\system32\dllcache\bthport.sys

2010-08-20 23:55:36 203136 ------w- c:\windows\system32\dllcache\rmcast.sys

2010-08-20 23:55:25 331776 ------w- c:\windows\system32\dllcache\msadce.dll

2010-08-20 23:54:49 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-08-20 23:48:41 0 d-----w- c:\windows\system32\PreInstall

2010-08-20 23:37:14 0 d-----w- c:\windows\system32\SoftwareDistribution

2010-08-20 23:33:50 0 d-----w- c:\windows\pss

2010-08-20 23:32:47 0 d-----w- c:\docume~1\alluse~1\applic~1\Citrix

2010-08-20 23:32:09 0 d-----w- c:\program files\Citrix

2010-08-20 23:32:02 61224 ----a-w- c:\documents and settings\meg\GoToAssistDownloadHelper.exe

2010-08-20 21:41:51 33 ----a-w- c:\windows\SAENSystems.sni

2010-08-20 21:41:51 26 ----a-w- c:\windows\VoiceCenter.vci

2010-08-20 21:41:35 44032 ------w- c:\windows\system32\CTSVCCDA.EXE

2010-08-20 21:41:35 25088 ------w- c:\windows\system32\CTSVCCTL.EXE

2010-08-20 21:41:30 0 d-----w- c:\program files\common files\Creative

2010-08-20 21:41:29 0 d--h--w- c:\program files\Creative Installation Information

2010-08-20 21:41:25 647872 ------w- c:\windows\system32\Mscomct2.ocx

2010-08-20 21:41:25 41984 ------w- c:\windows\Ctregrun.exe

2010-08-20 21:41:22 90112 ------w- c:\windows\Updreg.EXE

2010-08-20 21:41:09 10820 ----a-w- c:\windows\system32\CTSBMB.INI

2010-08-20 21:41:09 0 d-----w- c:\windows\system32\Data

2010-08-20 21:40:58 9728 ------w- c:\windows\system32\drivers\PfModNT.sys

2010-08-20 21:23:14 0 d-----w- c:\program files\Creative

2010-08-20 21:23:07 0 d-----w- c:\program files\Digital Line Detect

2010-08-20 21:23:00 0 d-----w- c:\program files\NetWaiting

2010-08-20 21:22:53 0 d-----w- c:\program files\Modem Helper

2010-08-20 21:22:50 0 d-----w- c:\program files\Dell

2010-08-20 21:22:45 16128 ----a-w- c:\windows\system32\drivers\APPDRV.SYS

2010-08-20 21:21:08 0 d-----w- c:\program files\CONEXANT

2010-08-20 21:21:01 0 d-----w- c:\program files\Sigmatel

2010-08-20 21:20:15 0 d-----w- c:\program files\BlueTooth

2010-08-20 21:19:37 0 d-----w- c:\program files\Toshiba

2010-08-20 21:19:34 0 d-----w- c:\program files\Intel, Inc

2010-08-20 21:19:13 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys

2010-08-20 21:18:44 0 d-----w- c:\program files\Broadcom

2010-08-20 21:18:28 0 d-----w- c:\program files\Synaptics

2010-08-20 21:14:56 247326 ------w- c:\windows\system32\dllcache\strmdll.dll

2010-08-20 21:12:50 0 d-----w- c:\program files\MSXML 4.0

2010-08-20 21:07:53 17051 ----a-w- c:\windows\system32\nvModes.001

2010-08-20 21:07:51 17051 ----a-w- c:\windows\system32\nvModes.dat

2010-08-20 21:04:21 30098 ----a-w- c:\windows\system32\nvapps.xml

2010-08-20 21:04:21 176128 ----a-w- c:\windows\system32\nvudisp.exe

2010-08-20 21:04:21 14757 ----a-w- c:\windows\system32\nvdisp.nvu

2010-08-20 21:04:21 0 d-----w- c:\windows\nview

2010-08-20 21:04:09 0 d-----w- c:\windows\system32\ReinstallBackups

2010-08-20 21:03:28 6400 ----a-w- c:\windows\system32\drivers\enum1394.sys

2010-08-20 21:03:28 61696 ----a-w- c:\windows\system32\drivers\ohci1394.sys

2010-08-20 21:03:27 53376 ----a-w- c:\windows\system32\drivers\1394bus.sys

2010-08-20 21:03:18 8832 ----a-w- c:\windows\system32\drivers\wmiacpi.sys

2010-08-20 21:03:04 10240 ----a-w- c:\windows\system32\drivers\compbatt.sys

2010-08-20 21:03:03 14208 ----a-w- c:\windows\system32\drivers\battc.sys

2010-08-20 21:03:03 13952 ----a-w- c:\windows\system32\drivers\cmbatt.sys

2010-08-20 19:22:27 9728 ----a-w- c:\windows\system32\wceprv.dll

2010-08-20 19:22:27 49152 ----a-w- c:\windows\system32\instw32.exe

2010-08-20 19:22:27 32256 ----a-w- c:\windows\system32\instd32.exe

2010-08-19 12:57:09 6857 ---ha-r- C:\dell.sdr

2010-08-19 12:54:57 787512 ----a-w- c:\windows\Dell.bmp

2010-08-19 12:54:24 1711104 ----a-w- c:\windows\system32\drivers\NETw3x32.sys

2010-08-19 12:54:23 561152 ----a-w- c:\windows\system32\NETw3c32.dll

2010-08-19 12:54:23 2732032 ----a-w- c:\windows\system32\NETw3r32.dll

2010-08-19 12:54:19 44544 ----a-w- c:\windows\system32\drivers\bcm4sbxp.sys

2010-08-19 12:54:19 0 d-----w- C:\drivers

2010-08-19 12:54:15 6857 ----a-w- c:\windows\system32\drivers\1028_Dell_INS_9400.mrk

2010-08-19 12:52:45 96310 ----a-w- c:\windows\system32\DELLWALL.BMP

2010-08-19 12:52:45 787356 ----a-w- c:\windows\system32\OEMBKGN1.BMP

2010-08-19 12:52:45 5134 ----a-w- c:\windows\system32\OEMLOGO.BMP

2010-08-19 12:52:45 1120 ----a-w- c:\windows\system32\OEMINFO.INI

2010-08-10 09:15:58 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-08-10 09:15:58 69632 ----a-w- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2010-08-20 21:16:30 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll

2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-30 12:31:35 149504 ------w- c:\windows\system32\dllcache\schannel.dll

2010-06-24 21:51:58 11077120 ------w- c:\windows\system32\dllcache\ieframe.dll

2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-24 12:22:03 916480 ------w- c:\windows\system32\dllcache\wininet.dll

2010-06-24 12:22:03 12800 ------w- c:\windows\system32\dllcache\xpshims.dll

2010-06-24 12:22:02 1210368 ------w- c:\windows\system32\dllcache\urlmon.dll

2010-06-24 12:22:01 611840 ------w- c:\windows\system32\dllcache\mstime.dll

2010-06-24 12:22:01 5951488 ------w- c:\windows\system32\dllcache\mshtml.dll

2010-06-24 12:22:01 206848 ------w- c:\windows\system32\dllcache\occache.dll

2010-06-24 12:21:59 599040 ------w- c:\windows\system32\dllcache\msfeeds.dll

2010-06-24 12:21:59 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-06-24 12:21:59 25600 ------w- c:\windows\system32\dllcache\jsproxy.dll

2010-06-24 12:21:58 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll

2010-06-24 12:21:58 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll

2010-06-24 12:21:58 184320 ------w- c:\windows\system32\dllcache\iepeers.dll

2010-06-24 12:21:56 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll

2010-06-24 12:21:55 387584 ------w- c:\windows\system32\dllcache\iedkcs32.dll

2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-23 13:44:04 1851904 ------w- c:\windows\system32\dllcache\win32k.sys

2010-06-23 12:08:09 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-06-21 15:27:11 354304 ------w- c:\windows\system32\dllcache\srv.sys

2010-06-18 13:36:12 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe

2010-06-18 11:39:18 16896 ------w- c:\windows\system32\dllcache\iecompat.dll

2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll

2010-06-14 07:41:45 1172480 ------w- c:\windows\system32\dllcache\msxml3.dll

============= FINISH: 11:53:46.23 ===============

attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 8/20/2010 8:15:29 PM

System Uptime: 9/6/2010 11:43:39 AM (0 hours ago)

Motherboard: Dell Inc. | | 0YD479

Processor: Genuine Intel® CPU T1300 @ 1.66GHz | Microprocessor | 1662/166mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 144 GiB total, 3.915 GiB free.

D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP62: 9/6/2010 1:53:23 AM - System Checkpoint

RP63: 9/6/2010 3:01:53 AM - Software Distribution Service 3.0

==== Installed Programs ======================

Acronis

Maurice Naggar · September 6, 2010

I am SO impressed by the level of help. You guys deserve an award! Thank you!

:blink: Your note is much appreciated and touching.

This last DDS log shows the system has AVG antivirus, and also, McAfee Security Scan.

I would personnaly suggest you remove both and switch to Avira AntiVir free edition -- as long as this is a home system for personal use.

Let me know what you decide.

My impression of AVG is not favorable. I have seen too many infected systems that happened to also have AVG.

The McAfee, we can't tell how you came about to have it.

Advise me of your inclination. I'll need to guide you properly if you switch.

Meantime, proceed with these steps:

Step 1

Download Dr.Web CureIt to the desktop.

Doubleclick the drweb-cureit.exe file, then on Start and allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, chose the Complete Scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look and see if you can click the following icon next to the files found:
If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer to allow files that were in use to be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web you saved previously in your next reply along with a new OTL log.

NOTE: During the scan, a pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.

Step 2

Download Security Check by screen317 and save it to your Desktop: here or here

Run Security Check
Follow the onscreen instructions inside of the command window.
A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Step 3

Please download & save Malwarebytes Anti-Malware from

http://www.malwarebytes.org/mbam-download.php or

http://www.besttechie.net/tools/mbam-setup.exe or

http://malwarebytes.gt500.org/mbam.jsp

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy & Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.

click OK to either and let MBAM proceed with the disinfection process.

If asked to restart the computer, please do so immediately.

Reply with copy of contents of the Dr Web Cure-It log

and the MBAM scan log

and Checkup.txt

Roon · September 6, 2010

OTL log??? Is that TFC by OldTimer?

Roon · September 6, 2010

cannot launch Dr. Cure-it.

First when I try, I get a message that flashes quite fast on the screen that you can't read it. I finally realized if I was fast, I could do a print screen and paste that elsewhere to read. Once I did that, I clicked ok to run in EMP mode. Then I received a message that says:

91efac.exe - application Error

The application failed to initialize property (0xc0000142). Click ok to terminate the application.

So next time I clicked "ok" and did it again, this time choosing "cancel" which runs it in the other mode. I didn't get any choices or screens that time, but the light if flashing on my hard drive as if it could be doing something.

Well, now it looks like I need to start all over because the message is back that my machine is low on disk space.

Maurice Naggar · September 6, 2010

Let's forget the DrWeb Cure-It scan. Let's don't run it. Find where you saved it, and delete it. Then Empty the Recycle Bin.

Then find TFC from before and Run it again.

Then skip to my last note and get and run MBAM.

and I need for you to recheck again and tell me How much Free space is on your C Drive

Roon · September 6, 2010

Can't delete it - it says it is currently in use

Maurice Naggar · September 6, 2010

Logoff and restart the system. Then try deleting one more time.

Roon · September 6, 2010

Ok - I'm back to 85.6 Gigs of free space.

I'm not sure how the MacAfee got loaded either, I think it was part of the load that comcast did when I loaded the program to control my tv from my computer (don't have compcast internet at this time). Since the AVG subscription is up this is a good time to switch. I just did some reading on Avira and I'm willing to give it a try.

I'm thinking I know how the file space problem came back. When I went to run the Dr. Web Cure it and it didn't seem to be working, I thought it might be safe to change file from .com back to .exe and run it thinking that might be the problem. I'm beginning to think that when I executed a .exe file, the virus or whatever this is was launched again. Therefore I'm wondering if it is still lurking since I've basically taken the same steps as last time. Only difference is that I ran TFC and it removed a bunch of problems, I rebooted and it removed more. So wondering if I should keep running and rebooting until that is a clean run?

Thanks AGAIN!!!!

Meg

Here is the log for malwarebytes:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4557

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

9/6/2010 6:29:20 PM

mbam-log-2010-09-06 (18-29-20).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 239418

Time elapsed: 2 hour(s), 22 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Maurice Naggar · September 8, 2010

Bravo on "I'm back to 85.6 Gigs of free space."

You should not have to run TFC quite this often. But you certainly can keep the program, and you can run it on a periodic basis to empty out temporary files.

The MBAM scan found no malwares. So that is encouraging.

I'd like for you to do an online scan at Eset.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Using Internet Explorer browser only, go to ESET Online Scanner website:

Vista users should start IE by Start (Vista Orb) >> Internet Explorer >> Right-Click and select Run As Administrator.

Accept the Terms of Use and press Start button;
Approve the install of the required ActiveX Control, then follow on-screen instructions;
Enable (check) the Remove found threats option, and run the scan.
After the scan completes, the Details tab in the Results window will display what was found and removed.
- A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt.
Look at contents of this file using Notepad or Wordpad.
The Frequently Asked Questions for ESET Online Scanner can be viewed here
http://www.eset.com/onlinescan/cac4.php?page=faq
- From ESET Tech Support: If you have ESET NOD32 installed, you should disable it prior to running this scanner.
  Otherwise the scan will take twice as long to do:
  everytime the ESET online scanner opens a file on your computer to scan it, NOD32 on your machine will rescan the file as a result.
- It is emphasized to temporarily disable any pc-resident {active} antivirus program prior to any on-line scan by any on-line scanner.
  (And the prompt re-enabling when finished.)
- If you use Firefox, you have to install IETab, an add-on. This is to enable ActiveX support.

RE-Enable your AntiVirus and AntiSpyware applications.

Copy and Paste the contents of the ESET Scan log.

Roon · September 9, 2010

Hi Maurice,

Well 16 hours later, nothing. I will post the log in a second. I've had to run the file to delete the temp files about 8 or 9 times. In fact, it is currenlty working at creating temp files because I'm losing a gig about every 60 or seconds or less. I have to run it in safe mode, it will not run in normal mode.

Can you send me the info on the virus program you mentioned please? I deleted the Macafee since I have no idea where it came from. I thought Comcast but I saw an add and I think comcast uses Nortons. I deleted the AVG when I was trying to get disk space to run the programs you were telling me to run.

Thanks again for all your help. I've got major deadlines and this isn't helping.

Meg

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=7d820e78b2129f4987c3cf689c493de4

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-09-09 12:28:01

# local_time=2010-09-09 08:28:01 (-0500, Eastern Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1024 16777215 100 0 687118 687118 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=123149

# found=0

# cleaned=0

# scan_time=62723

Maurice Naggar · September 11, 2010

As much as possible, run this in Normal mode of Windows. It's vital to see all that is running in Normal mode.

Step 1

Download RootRepeal from one of these links:

>> Link 1<<

or >>Link 2<<

or >>Link 3<<

SAVE the zip download to your Desktop.
Extract the archive to a folder you create such as C:\RootRepeal
Double-click RootRepeal.exe to launch the program (Vista users should right-click and select "Run as Administrator).
Click the "File" tab (located at the bottom of the RootRepeal screen)
Click the "Scan" button
In the popup dialog, check the drives to be scanned - making sure to check your primary operating system drive - normally C:
Click OK and the file scan will begin
When the scan is done, there will be files listed, but most if not all of them will be legitimate
Click the "Save Report" Button
Save the log file to your Documents folder
Post the content of the RootRepeal file scan log in your next reply.

Reply with copy of Rootrepeal log

Step 2

Download The Avenger by Swandog46 from here.

Unzip/extract it to a folder on your desktop.
Double click on avenger.exe to run The Avenger.
Click OK.
Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.

Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.

Files to delete:
C:\Kxloapog.sys

Folders to delete:
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler

In the avenger window, click the Paste Script from Clipboard icon, button.
! Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
Click the Execute button.
You will be asked Are you sure you want to execute the current script?.
Click Yes.
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
Click Yes.
Your PC will now be rebooted.
Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.

If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.

and then reboot the system again.

Step 3

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Please download Rkill by Grinler and save it to your desktop.

Link 2
Link 3
Link 4
Double-click on the Rkill desktop icon to run the tool.
If using Vista, right-click on it and Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
If your antivirus program gives a prompt message, respond positive to allow RKILL to run.
If a malware-rogue gives a message regarding RKILL, proceed forward to running RKILL

Step 4

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Double-Click on TDSSKiller.exe to run the application, then on Start Scan.
If running Vista or Windows 7, do a RIGHT-Click and select Run as Administrator to start TDSSKILLER.exe.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Reply with copy of Rootrepeal log

C:\Avenger.txt

the TDSSKILLER log

Roon · September 12, 2010

I can see that it is still there because my drive is filling up while we speak. Here are the logs:

Root Repeal

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2010/09/11 23:53

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Hidden/Locked Files

-------------------

Path: C:\hiberfil.sys

Status: Locked to the Windows API!

Path: c:\windows\temp\perflib_perfdata_298.dat