programs sometimes fail to open or just quit.

[chicksum]

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6754

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

08/06/2011 18:08:46

mbam-log-2011-06-08 (18-08-36).txt

Scan type: Quick scan

Objects scanned: 166703

Time elapsed: 3 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: () Good: (regedit.exe "%1") -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

________________________________________________________________

________________________________________________________________

.

DDS (Ver_2011-06-03.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_25

Run by Susan Elizabeth at 18:31:58 on 2011-06-08

Microsoft

attach.zip

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[chicksum]

Hi sorry it took me long to respond. I thought I had just found an answer, but no, something is wrong and i don't know how to fix it at all. I have just made the mbam scan here is the log

www.malwarebytes.org

Database version: 6818

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

14/06/2011 14:26:10

mbam-log-2011-06-14 (14-26-07).txt

Scan type: Quick scan

Objects scanned: 168148

Time elapsed: 4 minute(s), 45 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: () Good: (regedit.exe "%1") -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

------------------------------------------------------

I downloaded the combo fix, but can't load it as it says regedit.exe is not there. copy it from another machine. I may not be able to get that anytime soon, can you send me a copy of it? I run Vista sp2 home premium.

I will check every day now till I get this fixed. I am starting to have problems with bits and pieces all over now. will it help if I list the worst or do the logs tell it all?

I have no MS help and support

I run Adobe cs3 and I think dream weaver has interfered with some of the settings for file association.

Rundll.exe is constantly closing down especially host process rundll.

Please continue to help, many thanks

[screen317]

Hi,

Do you have your Windows Vista CD?

[chicksum]

Hi,

Do you have your Windows Vista CD?

I do have it yes, I wasn't thinking of that!

[screen317]

Put your disk in.

Then click Start --> Run, and type this in:

sfc /scannow

Reboot and grab a fresh copy of ComboFix. See if it runs now.

[chicksum]

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_25

Run by Susan Elizabeth at 14:27:15 on 2011-06-20

Microsoft

ComboFix.txt

Attach.zip

[screen317]

Things are looking up.

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[chicksum]

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6427

# api_version=3.0.2

# EOSSerial=0f38751bab77cc40aa9db7e849d1591c

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-06-24 11:52:37

# local_time=2011-06-24 12:52:37 (+0000, GMT Daylight Time)

# country="United Kingdom"

# lang=9

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 1190464 1190464 0 0

# compatibility_mode=770 16774142 0 2 14168766 14168766 0 0

# compatibility_mode=1538 16774142 20 3 153017 137458433 0 0

# compatibility_mode=5892 16776573 100 100 237726 146441671 0 0

# compatibility_mode=8192 67108863 100 0 146 146 0 0

# scanned=372880

# found=1

# cleaned=1

# scan_time=7413

J:\istallation progs\Corel Draw 11 Portable\Corel Draw 11 Portable\portable\reg.exe probably a variant of Win32/Agent.FGWCIKK trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

[chicksum]

Results of screen317's Security Check version 0.99.15

Windows Vista Service Pack 2 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

ESET Online Scanner v3

Preset Viewer 2.1

Panda Cloud Antivirus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

CCleaner

Java 6 Update 25

Java 6 Update 16

Out of date Java installed!

Mozilla Thunderbird (3.1.11) Thunderbird Out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

Panda Security Panda Cloud Antivirus PSUNMain.exe

Panda Security Panda Cloud Antivirus PSANHost.exe

``````````End of Log````````````

[chicksum]

Results of screen317's Security Check version 0.99.15

Windows Vista Service Pack 2 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET Online Scanner v3

Preset Viewer 2.1

Panda Cloud Antivirus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

CCleaner

Java 6 Update 26

Mozilla Thunderbird (3.1.11) Thunderbird Out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

Panda Security Panda Cloud Antivirus PSUNMain.exe

Panda Security Panda Cloud Antivirus PSANHost.exe

``````````End of Log````````````

[chicksum]

Hi screen, I am really pleased with the way my pc seems to be running at the moment. I have updated my java and switched on windows firewall. I have downloaded the latest thunderbird but It was the same version I was running anyway. 3.1.1 . I am having a problem with my work upload site, It is a passworded designer section where I upload my zipped files. sometimes I can do it other times the rundll stalls in different ways. I have asked her if it is her site and she says not. I also still don't have windows help, but I am going into Microsoft to see if i can go through their fixit solutions. If you can help me further to sort this out I will be grateful,but I understand that you are a busy guy with a big heart. Have a pint or two on me though. This is the original problem I was having that seemed to bring other problems wit it. Plus there is a automatic download to so with windows media player i can't get to stick and it always fails and Ihave tried some of their solution but it didn't work.

[screen317]

Hi,

The issue with your work upload site could be any number of things. Any chance you could bring it up with your IT department? What do you mean by Windows Help? Also could you describe the Windows Media Player issue in further detail?

[chicksum]

Hi again,

First there is a problem with some links the BBc Good Food site is an example this page here http://www.bbcgoodfood.com/recipes/2869/new-york-cheesecake#, I can use the links from there but the print link won't work and it used to. This is similar to what happens when I try to upload a zip file on this page screenshot. After I click choose and i get the browser nothing happens it just dies. From then on in if i reload or close chrome down and go in again it just doesn't work at that point at all and informs me in a little dialogue "CMD says choose a file to upload."(Ha I just completed that upload in the screen shot and it worked this time) it is random.

This kind of thing happens and more regularly now, on a few random sites.

I have no Windows Help and Support it has gone.

[screen317]

Hi,

Those are really odd symptoms and they don't sound like malware at all. You could give formatting and reinstalling Windows a try if you'd like. Other than that, you can post in our PC Help forum for alternative suggestions.

[chicksum]

Thankyou Screen317,

I thought that might be the case. I will head over there then. I really appreciate your help though. You have been a great help. Many thanks for your valuable time.

chicksum(Sue)

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!