start menu and icons paritally missing

ronirp · May 8, 2011

TOday I got the windows restore virus. This is Sony Vaio running windows 7. I followed the advice here and was able to successfully remove (last MBAM was clean). At first all icons and programs were not available. Using unhide, I was able to get some of them back, but still not fully there. The background is black instead of my normal windows background. The start menu is empty, and when I click on on the folder it states "empty" even though it is running (for example, mcaffee). Not all icons are back on my desktop either, only some of them.

In addition to MBAM and unhide I also tried the regedit 4 that was lister in one of the responses to a similar question.

Any idea what my next step is?

Thanks

ronirp

ronirp · May 8, 2011

Yesterday I got the "windows recovery virus". Using a Sony Vaio Windows 7 machince. Was able to finally remove it using MBAM, which is now clean (log says 0 on everything). All files were hidden, and was able to get some of them unhidden using unhide as mentioned in a previous thread (thanks!).

At this point, I have some of my programs and all of my documents unhidden. However, I am still missing some things. For example, the start menu shows up as blank, until I press programs. Some previously loaded programs are not showing as icons, and showing as empty (for example cccleaner). My background turned to black (just a black screen) instead of the normal windows background that I had.

Tried to run hijack this, but it would not run a log (it run, but I cannot post a log because it would not create one).

Any suggestions?

LDTate · May 8, 2011

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs for these tools, use "copy/paste".

Please stay in this topic.

First we need to rehide hidden / system files so they don't get deleted.

To re-hide those files:

[*]Click on My Computer from your desktop and from the menu click on Tools and then Folder Options.

[*]Click on the View tab and under the Hidden Files and Folders section, choose the radio button that says

ronirp · May 8, 2011

Thanks!!!

Done (acutally I saw this in another thread and tried it yesterday, and double checked today)

Computer is running OK, but the same files/icons that are missing are still missing. (another one I just noticed, the trash can on my desk top is missing....)

What should be my next step?

Thanks again

LDTate · May 8, 2011

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

ronirp · May 8, 2011

Ran into trouble trying to disable McAffee following the instructions listed. It is opening up automatically. When I go to the start menu it tells me that McAffee is empty. When I look at my icon tray it is there, but I cannot find a way to disable it.

Any suggestsion?

LDTate · May 8, 2011

Try running combofix anyway

ronirp · May 8, 2011

Log from combofix is copied below

ComboFix 11-05-07.02 - Roni 05/08/2011 9:31.1.4 - x64

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.6007.4035 [GMT -5:00]

Running from: c:\users\Roni\Downloads\ComboFix.exe

AV: McAfee VirusScan Enterprise *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\Tarma Installer

c:\programdata\Tarma Installer\{CDE1F7BF-9B4B-44AB-9788-A9EBF9453F13}\_Setup.dll

c:\programdata\Tarma Installer\{CDE1F7BF-9B4B-44AB-9788-A9EBF9453F13}\20110322231903.log

c:\programdata\Tarma Installer\{CDE1F7BF-9B4B-44AB-9788-A9EBF9453F13}\Setup.dat

c:\programdata\Tarma Installer\{CDE1F7BF-9B4B-44AB-9788-A9EBF9453F13}\Setup.exe

c:\programdata\Tarma Installer\{CDE1F7BF-9B4B-44AB-9788-A9EBF9453F13}\Setup.ico

c:\programdata\Tarma Installer\{CDE1F7BF-9B4B-44AB-9788-A9EBF9453F13}\TsuDll.dll

c:\users\Roni\AppData\Local\{B0574953-C343-4F04-A38C-43225DD7D3D5}

c:\users\Roni\AppData\Local\{B0574953-C343-4F04-A38C-43225DD7D3D5}\chrome.manifest

c:\users\Roni\AppData\Local\{B0574953-C343-4F04-A38C-43225DD7D3D5}\chrome\content\_cfg.js

c:\users\Roni\AppData\Local\{B0574953-C343-4F04-A38C-43225DD7D3D5}\chrome\content\overlay.xul

c:\users\Roni\AppData\Local\{B0574953-C343-4F04-A38C-43225DD7D3D5}\install.rdf

c:\users\Roni\AppData\Local\cah.exe

c:\users\Roni\AppData\Local\lrw.exe

c:\users\Roni\AppData\Local\pbn.exe

c:\users\Roni\AppData\Local\twf.exe

c:\users\Roni\AppData\Roaming\Adobe\plugs

c:\users\Roni\AppData\Roaming\Adobe\shed

c:\users\Roni\AppData\Roaming\Adobe\shed\thr1.chm

c:\users\Roni\g2mdlhlpx.exe

.

((((((((((((((((((((((((( Files Created from 2011-04-08 to 2011-05-08 )))))))))))))))))))))))))))))))

.

2011-05-08 14:39 . 2011-05-08 14:39 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-05-08 14:39 . 2011-05-08 14:39 -------- d-----w- c:\users\boinc_master\AppData\Local\temp

2011-05-08 14:24 . 2011-05-08 14:24 -------- d-----w- c:\windows\147BCE03C0F14C9F81576A89B6D2D973.TMP

2011-05-08 14:00 . 2011-05-08 14:00 -------- d-----w- c:\users\Roni\AppData\Roaming\smkits

2011-05-08 13:48 . 2011-05-08 13:48 -------- d-----w- c:\users\Roni\AppData\Local\{9A6532E6-B10C-49D2-A7B1-970A903EBEA2}

2011-05-08 13:23 . 2011-05-08 13:23 388096 ----a-r- c:\users\Roni\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-05-08 13:23 . 2011-05-08 13:23 -------- d-----w- c:\program files (x86)\Trend Micro

2011-05-08 01:48 . 2011-05-08 01:48 -------- d-----w- c:\users\Roni\AppData\Local\{662EFECC-1FED-4375-A2F5-AA6C6383728D}

2011-05-07 17:39 . 2011-05-07 17:39 0 ----a-w- c:\users\Roni\AppData\Local\Ftularusaney.bin

2011-05-07 13:47 . 2011-05-07 13:47 -------- d-----w- c:\users\Roni\AppData\Local\{86F5FA2F-C3A1-4741-96BC-F1A1641A916C}

2011-05-06 14:37 . 2011-05-06 14:37 -------- d-----w- c:\users\Roni\AppData\Local\{C2F460B0-53F3-4260-BA47-E0324EDA53DD}

2011-05-06 02:36 . 2011-05-06 02:36 -------- d-----w- c:\users\Roni\AppData\Local\{A828F74F-BF96-49CB-AF9B-4E69E2096C81}

2011-05-05 14:35 . 2011-05-05 14:36 -------- d-----w- c:\users\Roni\AppData\Local\{103F77EB-1B11-4D23-80F7-98550C754980}

2011-05-05 02:35 . 2011-05-08 13:49 -------- d-----w- c:\users\Roni\AppData\Local\Windows Live

2011-05-05 02:34 . 2011-05-05 02:35 -------- d-----w- c:\users\Roni\AppData\Local\{F226C129-D4D9-4F4F-976B-BB44BA1A9525}

2011-05-05 02:34 . 2011-05-05 02:34 -------- d-----w- c:\users\Roni\AppData\Local\{4ABEA837-5CF3-4531-BB43-5485A05A9BE3}

2011-04-28 01:39 . 2011-02-18 06:33 31232 ----a-w- c:\windows\system32\prevhost.exe

2011-04-28 01:39 . 2011-02-18 05:33 31232 ----a-w- c:\windows\SysWow64\prevhost.exe

2011-04-25 23:28 . 2009-08-20 07:50 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll

2011-04-25 00:20 . 2011-04-25 00:20 -------- d-----w- c:\program files\iPod

2011-04-25 00:20 . 2011-04-25 00:21 -------- d-----w- c:\program files\iTunes

2011-04-25 00:20 . 2011-04-25 00:21 -------- d-----w- c:\program files (x86)\iTunes

2011-04-25 00:18 . 2011-04-25 00:18 -------- d-----w- c:\program files\Bonjour

2011-04-25 00:18 . 2011-04-25 00:18 -------- d-----w- c:\program files (x86)\Bonjour

2011-04-15 23:03 . 2011-02-24 06:30 476160 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-04-15 23:03 . 2011-02-24 05:32 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll

2011-04-15 23:03 . 2011-03-03 03:58 3133440 ----a-w- c:\windows\system32\win32k.sys

2011-04-14 08:39 . 2011-04-14 08:39 103864 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll

2011-04-11 17:23 . 2011-04-11 17:26 -------- d-----w- c:\users\tech

2011-04-11 17:16 . 2011-04-11 17:14 888 ----a-w- C:\exe.reg

2011-04-11 14:19 . 2010-12-20 23:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-04-11 14:19 . 2011-05-07 18:04 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-04-10 21:54 . 2011-04-10 21:54 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2011-04-10 21:54 . 2011-04-10 21:54 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2011-04-10 21:54 . 2011-04-10 21:54 229888 ----a-w- c:\windows\system32\XpsRasterService.dll

2011-04-10 21:54 . 2011-04-10 21:54 1863680 ----a-w- c:\windows\system32\ExplorerFrame.dll

2011-04-10 21:54 . 2011-04-10 21:54 1837568 ----a-w- c:\windows\system32\d3d10warp.dll

2011-04-10 21:54 . 2011-04-10 21:54 1495040 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll

2011-04-10 21:54 . 2011-04-10 21:54 144384 ----a-w- c:\windows\system32\cdd.dll

2011-04-10 21:54 . 2011-04-10 21:54 135168 ----a-w- c:\windows\SysWow64\XpsRasterService.dll

2011-04-10 21:54 . 2011-04-10 21:54 1170944 ----a-w- c:\windows\SysWow64\d3d10warp.dll

2011-04-08 17:29 . 2011-04-08 17:29 -------- d-----w- c:\users\Roni\AppData\Roaming\Malwarebytes

2011-04-08 17:29 . 2011-04-08 17:29 -------- d-----w- c:\programdata\Malwarebytes

2011-04-08 17:29 . 2010-12-20 23:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-06 21:26 . 2011-04-06 21:26 96544 ----a-w- c:\windows\system32\dnssd.dll

2011-04-06 21:26 . 2011-04-06 21:26 69408 ----a-w- c:\windows\system32\jdns_sd.dll

2011-04-06 21:26 . 2011-04-06 21:26 237856 ----a-w- c:\windows\system32\dnssdX.dll

2011-04-06 21:26 . 2011-04-06 21:26 119584 ----a-w- c:\windows\system32\dns-sd.exe

2011-04-06 21:20 . 2011-04-06 21:20 91424 ----a-w- c:\windows\SysWow64\dnssd.dll

2011-04-06 21:20 . 2011-04-06 21:20 75040 ----a-w- c:\windows\SysWow64\jdns_sd.dll

2011-04-06 21:20 . 2011-04-06 21:20 197920 ----a-w- c:\windows\SysWow64\dnssdX.dll

2011-04-06 21:20 . 2011-04-06 21:20 107808 ----a-w- c:\windows\SysWow64\dns-sd.exe

2011-03-21 13:58 . 2010-06-24 19:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-03-04 06:17 . 2011-04-28 01:40 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2011-03-04 06:17 . 2011-04-28 01:40 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2011-02-19 06:37 . 2011-03-09 14:59 1135104 ----a-w- c:\windows\system32\FntCache.dll

2011-02-19 06:37 . 2011-03-09 14:59 1540608 ----a-w- c:\windows\system32\DWrite.dll

2011-02-19 06:36 . 2011-03-09 14:59 902656 ----a-w- c:\windows\system32\d2d1.dll

2011-02-19 05:32 . 2011-03-09 14:59 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll

2011-02-19 05:32 . 2011-03-09 14:59 739840 ----a-w- c:\windows\SysWow64\d2d1.dll

2011-02-18 21:36 . 2011-02-18 21:36 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys

2011-02-18 21:36 . 2011-02-18 21:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36 94208 ----a-w- c:\users\Roni\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36 94208 ----a-w- c:\users\Roni\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36 94208 ----a-w- c:\users\Roni\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-01-26 15026056]

"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2011-01-31 38840]

"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-09-23 640440]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"SmartWiHelper"="c:\program files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" [2010-07-15 89080]

"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2010-06-01 673136]

"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-06-01 600928]

"ShStatEXE"="c:\program files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2009-09-01 124240]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]

"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-08 273544]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-04-14 421160]

"McAfeeUpdaterUI"="c:\program files (x86)\McAfee\Common Framework\udaterui.exe" [2009-08-25 136512]

.

c:\users\Roni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Roni\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-3-30 23360040]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli c:\program files\Protector Suite\psqlpwd.dll

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-08 136176]

R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-08 136176]

R3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-06-21 108400]

R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-06-18 423280]

R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-06-21 67952]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-06-09 537456]

R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-06-09 384880]

R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2010-06-09 101232]

R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2010-06-01 1250160]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-06 169312]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 Lotus Notes Diagnostics;Lotus Notes Diagnostics;c:\program files (x86)\IBM\Lotus\Notes\nsd.exe [2010-08-11 3417480]

S2 McAfeeEngineService;McAfee Engine Service;c:\program files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe [2009-09-01 19720]

S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]

S2 Oasis2Service;Oasis2Service;c:\program files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe [2011-03-14 47616]

S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-06-01 367456]

S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x]

S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x]

S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2010-05-25 252416]

S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]

S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-02-23 2320920]

S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-22 575856]

S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2010-06-17 851824]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]

S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]

S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2010-06-07 304496]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2011-05-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-08 01:10]

.

2011-05-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-08 01:10]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36 97792 ----a-w- c:\users\Roni\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36 97792 ----a-w- c:\users\Roni\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36 97792 ----a-w- c:\users\Roni\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36 97792 ----a-w- c:\users\Roni\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]

@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"

[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]

2010-04-27 23:48 5947656 ----a-w- c:\program files\Protector Suite\farchns.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]

@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"

[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]

2010-04-27 23:48 5947656 ----a-w- c:\program files\Protector Suite\farchns.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-27 10135584]

"PSQLLauncher"="c:\program files\Protector Suite\launcher.exe" [2010-04-27 84744]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.unomaha.edu/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105

FF - ProfilePath - c:\users\Roni\AppData\Roaming\Mozilla\Firefox\Profiles\xnswswpz.default\

FF - prefs.js: network.proxy.type - 0

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

.

- - - - ORPHANS REMOVED - - - -

.

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]

"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=2000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=inteldata\""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2011-05-08 09:42:10

ComboFix-quarantined-files.txt 2011-05-08 14:42

.

Pre-Run: 388,040,732,672 bytes free

Post-Run: 387,606,196,224 bytes free

.

LDTate · May 8, 2011

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

C:\exe.reg

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

ronirp · May 8, 2011

Done

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name:

exe.reg

Submission date:

2011-05-08 14:50:00 (UTC)

Current status:

finished

Result:

0/ 41 (0.0%)

VT Community

not reviewed

Safety score: -

Compact

Print results

Antivirus

Version

Last Update

Result

AhnLab-V3

2011.05.08.00

2011.05.07

-

AntiVir

7.11.7.176

2011.05.06

-

Antiy-AVL

2.0.3.7

2011.05.08

-

Avast

4.8.1351.0

2011.05.08

-

Avast5

5.0.677.0

2011.05.08

-

AVG

10.0.0.1190

2011.05.08

-

BitDefender

7.2

2011.05.08

-

CAT-QuickHeal

11.00

2011.05.08

-

ClamAV

0.97.0.0

2011.05.07

-

Commtouch

5.3.2.6

2011.05.07

-

Comodo

8627

2011.05.08

-

DrWeb

5.0.2.03300

2011.05.08

-

eSafe

7.0.17.0

2011.05.05

-

eTrust-Vet

36.1.8312

2011.05.06

-

F-Prot

4.6.2.117

2011.05.08

-

F-Secure

9.0.16440.0

2011.05.08

-

Fortinet

4.2.257.0

2011.05.08

-

GData

22

2011.05.08

-

Ikarus

T3.1.1.103.0

2011.05.08

-

Jiangmin

13.0.900

2011.05.05

-

K7AntiVirus

9.102.4584

2011.05.06

-

Kaspersky

9.0.0.837

2011.05.08

-

McAfee

5.400.0.1158

2011.05.08

-

McAfee-GW-Edition

2010.1D

2011.05.07

-

Microsoft

1.6802

2011.05.08

-

NOD32

6104

2011.05.08

-

Norman

6.07.07

2011.05.07

-

Panda

10.0.3.5

2011.05.08

-

PCTools

7.0.3.5

2011.05.06

-

Prevx

3.0

2011.05.08

-

Rising

23.56.06.05

2011.05.08

-

Sophos

4.65.0

2011.05.08

-

SUPERAntiSpyware

4.40.0.1006

2011.05.08

-

Symantec

20101.3.2.89

2011.05.08

-

TheHacker

6.7.0.1.191

2011.05.08

-

TrendMicro

9.200.0.1012

2011.05.08

-

TrendMicro-HouseCall

9.200.0.1012

2011.05.08

-

VBA32

3.12.16.0

2011.05.08

-

VIPRE

9223

2011.05.08

-

ViRobot

2011.5.7.4450

2011.05.08

-

VirusBuster

13.6.343.0

2011.05.08

-

Additional information

Show all

MD5 : 01f06c474fb9c442bdae7d7194c7cc7a

SHA1 : 929fcf5acd2b8378c27a6d0230a30cd416e82d4d

SHA256: 56425babf77a0049e5fe6d29462bcef9542a14ff93994d31aa85e6dc6bb27041

VT Community

LDTate · May 8, 2011

How's it running now?

ronirp · May 8, 2011

Running as it did before - no real problems in actual performance. Still missing icons, start menu only shows things after clicking "all programs" and some programs, while there, showing as empty (McAfee is one example). Still have the black background.

ronirp · May 8, 2011

forgot to add that I rebooted, and rechecked.

LDTate · May 8, 2011

Click: Start > All Programs> Accessories

Open Notepad, click on Format and uncheck Word Wrap.

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

c:\windows\system32\drivers\rimssne64.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

ronirp · May 8, 2011

notepad was unchecked (the previous scan did not produce a log in the notepad so I copied from the window)

Looking at windows\system32\drivers - there is no such file.

now what?

Thanks again

LDTate · May 8, 2011

create a new user and let me know what everything looks like with thst new user.

ronirp · May 8, 2011

New user - background is fine, trash can is there. Start menu is still empty, but once you click on "all programs" all the programs are showing. The ones that previously showed as empty (even though they are running and exist) are still empty.

Was not sure how to move everything from the original account to the new user so did not do that - if that is needed, let me know how (or I can search for it).

So it seemed to have solved some things, but not all

Again thanks

LDTate · May 8, 2011

Lets try this

Right Click the Start button and select Explore

Under the All Users account, Right Click the Start Menu and select Copy.

Now move down to your user account, Right Click the Start Menu and select Paste.

Reboot and let me know if that fixed the issues

ronirp · May 8, 2011

hmmmm

Right click on start button gives me two options

"properties" - when I do this I get menu and task bar

"open windows explorere" - when I do this I get "libraries"

Am I doing something wrong?

LDTate · May 8, 2011

What I gave you is for XP and you're running W7

Opem My Computer and try it

Under the All Users account, Right Click the Start Menu and select Copy.

Now move down to your user account, Right Click the Start Menu and select Paste.

LDTate · May 8, 2011

Lets also run a new combofix scan

ronirp · May 8, 2011

Sorry. Still not seeing it. Under computer I can see Drive C, and on the right hand side favorites and libraries, but not all users.

LDTate · May 8, 2011

Lets also run a new combofix scan

ronirp · May 8, 2011

wow this one took much longer. Here is the log

ComboFix 11-05-07.03 - Roni 05/08/2011 12:31:42.3.4 - x64

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.6007.3878 [GMT -5:00]

Running from: c:\users\Roni\Downloads\ComboFix.exe

AV: McAfee VirusScan Enterprise *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2011-04-08 to 2011-05-08 )))))))))))))))))))))))))))))))

.

2011-05-08 18:26 . 2011-05-08 18:26 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-05-08 18:26 . 2011-05-08 18:26 -------- d-----w- c:\users\boinc_master\AppData\Local\temp

2011-05-08 15:49 . 2011-05-08 15:50 -------- d-----w- c:\users\rrp