alohaguy53 Posted April 13, 2011 Author ID:415506 Share Posted April 13, 2011 Malwarebytes' Anti-Malware 1.50.1.1100www.malwarebytes.orgDatabase version: 6344Windows 5.1.2600 Service Pack 3 (Safe Mode)Internet Explorer 7.0.5730.134/12/2011 5:45:45 PMmbam-log-2011-04-12 (17-45-45).txtScan type: Quick scanObjects scanned: 180554Time elapsed: 4 minute(s), 57 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Larry, I have a feeling we might be getting close to having my problem solved...no idea really...you are the guy that will know. Anyway, whenever we get finished, please check back, because I have a few questions I need to ask. Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415509 Share Posted April 13, 2011 Are these scans done under your login? Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415510 Share Posted April 13, 2011 The are done on the Administrator2 user account that we set up last night. Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415513 Share Posted April 13, 2011 Try your account.If your account still doesn't work and you have data you want from that account, I would create a new account like Dan2 with admin rights and move all the data you want to save there. Then use the Dan2 account. Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415514 Share Posted April 13, 2011 Okay, I will try it. If that is ends up being what I am going to have to do, then I will need some tutoring on how to move the data, cause i haveno idea. Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415521 Share Posted April 13, 2011 I logged off Admin2 and logged in to my account. Programs such as Outlook Express, Excell, Word still won't run. So, I am assuming I will need to follow your instructions and start a new user account. First question is can we use the Administrator2 account and just rename it?Then the scary part for me...what kinds of data are we talking about moving? If I open a program such as Outlook Express in ADmin2 will all my emails and addresses still be there? If I open excel, will all my files still be there? Is there any way to tranfer my internet favorites to the new account? I'm sure there are a number of other things I need to know.Kevin Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415536 Share Posted April 13, 2011 You may need to call support for all that if we can fix it with the tools we use.Using the Admin2 account, run Combofix Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415542 Share Posted April 13, 2011 Okay, I am in Admin2 account and I downloaded Combofix.exe and started it. I will let it run for awhile, but it looks just like it did last night with one blinking dash down in the lower left corner and no prompts appearing. Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415548 Share Posted April 13, 2011 15 minutes in an still just one blinking dot in the lower left corner. Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415606 Share Posted April 13, 2011 40 minutes in and nothing happening. Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415627 Share Posted April 13, 2011 It's hung up again.Try this:Please download DDS and save it to your desktop.Disable any script blocking protection Double click dds.scr to run the tool. When done, DDS.txt will open. Click Yes at the next prompt for Optional Scan. Save both reports to your desktop.---------------------------------------------------Please Please copy / paste the scan reults.DDS.txt Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415639 Share Posted April 13, 2011 I ran it once, but did not have AVG turned off. I can't figure out how to disable AVG.Logs with AVG on are as follows:UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH ITDDS (Ver_09-06-26.01)Microsoft Windows XP ProfessionalBoot Device: \Device\HarddiskVolume1Install Date: 6/12/2010 8:21:08 AMSystem Uptime: 4/13/2011 10:12:55 AM (3 hours ago)Motherboard: Hewlett-Packard | | 30C0Processor: Intel® Core2 Duo CPU T7250 @ 2.00GHz | U10 | 1596/200mhz==== Disk Partitions =========================C: is FIXED (NTFS) - 149 GiB total, 76.382 GiB free.D: is CDROM ()E: is FIXED (FAT32) - 596 GiB total, 478.245 GiB free.G: is Removable==== Disabled Device Manager Items ================= System Restore Points ===================RP1: 3/25/2011 9:07:26 PM - System CheckpointRP2: 3/25/2011 11:08:44 PM - March 25,2011RP3: 3/27/2011 11:52:17 AM - System CheckpointRP4: 3/28/2011 11:54:49 AM - System CheckpointRP5: 3/29/2011 12:14:42 PM - System CheckpointRP6: 3/30/2011 3:28:56 PM - System CheckpointRP7: 3/31/2011 6:31:59 PM - System CheckpointRP8: 4/1/2011 6:33:03 PM - System CheckpointRP9: 4/2/2011 6:54:21 PM - System CheckpointRP10: 4/3/2011 7:17:52 PM - System CheckpointRP11: 4/4/2011 8:58:52 PM - System CheckpointRP12: 4/5/2011 9:36:28 PM - System CheckpointRP13: 4/7/2011 1:07:36 AM - System CheckpointRP14: 4/8/2011 1:44:26 AM - System CheckpointRP15: 4/9/2011 2:22:22 AM - System CheckpointRP16: 4/10/2011 3:22:26 AM - System CheckpointRP17: 4/11/2011 4:05:11 PM - Restore OperationRP18: 4/13/2011 12:28:14 PM - System Checkpoint==== Installed Programs ======================7-Zip 9.20Acrobat.comActivClient x86Adobe AIRAdobe Flash Player 10 ActiveXAdobe Photoshop CSAdobe Reader 9.2Agere Systems HDA ModemAmerican Greetings CreataCardApple Mobile Device SupportApple Software UpdateAuthenTec Fingerprint Sensor Minimum InstallAVG Free 9.0Barbie Fashion Show CD-ROMBarbie In The 12 Dancing PrincessesBIOS Configuration for HP ProtectToolsBonjourBroadcom NetXtreme Ethernet ControllerCanon Camera Access LibraryCanon Camera Support Core LibraryCanon G.726 WMP-DecoderCanon IJ Network Scan UtilityCanon IJ Network ToolCANON iMAGE GATEWAY Task for ZoomBrowser EXCanon Internet Library for ZoomBrowser EXCanon MovieEdit Task for ZoomBrowser EXCanon MP Navigator EX 1.0Canon MX700 seriesCanon MX700 series User RegistrationCanon My PrinterCanon RAW Image Task for ZoomBrowser EXCanon Utilities CameraWindowCanon Utilities CameraWindow DCCanon Utilities CameraWindow DC_DV 5 for ZoomBrowser EXCanon Utilities CameraWindow DC_DV 6 for ZoomBrowser EXCanon Utilities Easy-PhotoPrint EXCanon Utilities EOS UtilityCanon Utilities MyCameraCanon Utilities MyCamera DCCanon Utilities PhotoStitchCanon Utilities RemoteCapture DCCanon Utilities RemoteCapture Task for ZoomBrowser EXCanon Utilities Solution MenuCanon Utilities ZoomBrowser EXCanon ZoomBrowser EX Memory Card UtilityCCleanerChinese Simplified Fonts Support For Adobe Reader 9Cisco ConnectCredential Manager for HP ProtectToolsDevice Access Manager for HP ProtectToolsDING!Disney's Lilo & Stitch Trouble in ParadiseDrive Encryption for HP ProtectToolsEmbedded Security for HP ProtectToolsGoogle ChromeGoogle EarthGoogle Toolbar for Internet ExplorerGoogle Update HelperHotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)Hotfix for Windows XP (KB2158563)Hotfix for Windows XP (KB2443685)Hotfix for Windows XP (KB952287)Hotfix for Windows XP (KB954550-v5)Hotfix for Windows XP (KB961118)Hotfix for Windows XP (KB981793)HP 3D DriveGuardHP PCMCIA Smart Card ReaderHP ProtectTools Security ManagerHP Wireless AssistantIntel® Graphics Media Accelerator DriverInterVideo DVD CheckInterVideo WinDVDiTunesJapanese Fonts Support For Adobe Reader 9Java Auto UpdaterJava 6 Update 21K-Lite Codec Pack 6.8.0 (Full)Logitech Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415657 Share Posted April 13, 2011 Delete this filec:\windows\system32\drivers\nhwqg.sys Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415659 Share Posted April 13, 2011 Done Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415663 Share Posted April 13, 2011 http://www.eset.eu/online-scannerGo here to run an online scannner from ESET.Click the green ESET Online Scanner button.Read the End User License Agreement and check the box: YES, I accept the Terms of Use.Click on the Start button next to it.You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.A new window will appear asking "Do you want to install this software?"".Answer Yes to download and install the ActiveX controls that allows the scan to run.Click Start.Check Remove found threats and Scan potentially unwanted applications.Click Scan to begin. If offered the option to get information or buy software. Just close the window. Wait for the scan to finishUse notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txtCopy and paste that log as a reply to this topic. Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415686 Share Posted April 13, 2011 C:\Documents and Settings\Kevin\Application Data\Sun\Java\Deployment\cache\6.0\1\3f128481-77a5b297 a variant of Java/TrojanDownloader.OpenStream.NAZ trojan deleted - quarantinedC:\Documents and Settings\Kevin\My Documents\Downloads\7zip_Bing.exe Win32/Toolbar.Zugo application deleted - quarantined Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415689 Share Posted April 13, 2011 Go here and follow the instructions to clear your Java Cachehttp://www.java.com/en/download/help/plugin_cache.xml Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415693 Share Posted April 13, 2011 ok I think that worked Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415695 Share Posted April 13, 2011 I would like to get combofix to run but I think in order to get it to run you'll need to uninstall AVG.Other than that I've done waht I could. Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415697 Share Posted April 13, 2011 1. Isn't there a AVG control panel somewhere that I can just turn it off for awhile. 2. Do you think the system is just about clean?3. As I mentioned Larry, I am going to need some help transferring data to the new user account can I call your support guys to help with this? 4. What is the phone number Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415702 Share Posted April 13, 2011 if there is a phone number but you don't want to post it here, I can send you my e-mail address. Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415703 Share Posted April 13, 2011 1. We tried that and CF still didn't run. It should show the AVG Icon down on the taskbar by the time.If it's there, Right Click on the Icon and select disable. Then try Combofix again. Link to post Share on other sites More sharing options...
alohaguy53 Posted April 13, 2011 Author ID:415704 Share Posted April 13, 2011 I right clicked on it but there is no disable option Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415705 Share Posted April 13, 2011 if there is a phone number but you don't want to post it here, I can send you my e-mail address.you can contact the help desk at support@malwarebytes.org or here. Link to post Share on other sites More sharing options...
LDTate Posted April 13, 2011 ID:415708 Share Posted April 13, 2011 I right clicked on it but there is no disable optionOnly option is to uninstall it.AVG > AVG Removal Tool (x86) - AVG Identity Protection > AVGIDPUninstaller Link to post Share on other sites More sharing options...
Recommended Posts