Infected Laptop

dusktilldawnll · November 15, 2011

Hello. My wife's laptop had a virus. A friend of mine said he removed it, but I think it is still here, or another virus has attacked her laptop. Virus attacked the "indexing" of the laptop. All files were hidden. My friend supposedly removed the virus. I was able to "unhide" most of files, but there are still some that are hidden. Used Malware Bytes and removed 6 infected files. Still having trouble with computer. Here is some info:

DDS:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_14

Run by Jessica at 0:57:37 on 2011-11-14

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2220 [GMT -5:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\igfxtray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\SelectRebates\SelectRebates.exe

C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\com.apple.DotMacSync.client.exe

C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Flip Video\FlipShare\FlipShareService.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\WINDOWS\system32\svchost.exe -k HPService

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\DRIVERS\o2flash.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wscntfy.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uWindow Title = Windows Internet Explorer provided by Comcast

mStart Page = hxxp://www.comcast.net/

mWindow Title = Windows Internet Explorer provided by Comcast

uInternet Settings,ProxyOverride = *.local

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {465E08E7-F005-4389-980F-1D8764B3486C} - No File

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: ShopAtHomeIEHelper Class: {e8daaa30-6caa-4b58-9603-8e54238219e2} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: ShopAtHome.com Toolbar: {98279c38-de4b-4bcf-93c9-8ec26069d6f4} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dll

TB: {6ADB0F93-1AA5-4BCF-9DF4-CEA689A3C111} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Alcmtr] ALCMTR.EXE

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [eligmini] c:\program files\fisher-price\easy-link internet launch pad\Easy-Link internet launch pad.exe 0

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [selectRebates] c:\program files\selectrebates\SelectRebates.exe

mRun: [sSP Notifier] c:\program files\fisher-price\fp3 player\sspnotifier.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

StartupFolder: c:\docume~1\jessica\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE

StartupFolder: c:\documents and settings\jessica\start menu\programs\startup\PowerReg Scheduler V3.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\billeo.lnk - c:\program files\billeo\billeo.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

Trusted Zone: arise.com

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237657637703

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237657630812

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\program files\cozi express\CoziProtocolHandler.dll

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Notify: igfxcui - igfxdev.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

.

============= SERVICES / DRIVERS ===============

.

R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2009-3-21 51288]

R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2009-3-21 43608]

S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [2011-1-13 18560]

S3 PLTurbh;Prolific turbo filter driver for hdd;c:\windows\system32\drivers\plturbh.sys [2010-5-27 16384]

S3 PLTurbo;Prolific turbo filter driver for odd;c:\windows\system32\drivers\plturbo.sys [2010-5-27 16640]

.

=============== Created Last 30 ================

.

2011-11-14 05:24:18 28160 ----a-w- c:\windows\system32\dll.dll

2011-11-14 03:46:42 296054 ----a-w- c:\windows\system32\shimg.dll

2011-11-03 03:05:44 0 ----a-w- c:\documents and settings\jessica\vsgsykpseb.tmp

2011-11-03 02:18:56 -------- d-----w- c:\windows\system32\CatRoot_bak

2011-11-03 01:04:46 274288 ----a-w- c:\windows\system32\mucltui.dll

2011-11-03 01:04:46 16736 ----a-w- c:\windows\system32\mucltui.dll.mui

2011-11-03 01:03:11 -------- d-----w- c:\documents and settings\jessica\application data\QuickScan

2011-11-02 21:49:22 -------- d-----w- c:\windows\system32\appmgmt

2011-11-02 21:24:53 -------- d-----w- c:\windows\pss

.

==================== Find3M ====================

.

2011-08-31 21:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

.

============= FINISH: 1:03:42.67 ===============

ATTACH:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 5/7/2005 11:24:05 AM

System Uptime: 11/14/2011 12:48:36 AM (1 hours ago)

.

Motherboard: Dell Inc. | | 0M277C

Processor: Intel® Core™2 Duo CPU T5870 @ 2.00GHz | U2E1 | 1995/800mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 50 GiB total, 26.878 GiB free.

D: is FIXED (NTFS) - 99 GiB total, 15.797 GiB free.

E: is CDROM (CDFS)

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}

Description: Officejet 6500 E709n

Device ID: ROOT\IMAGE\0000

Manufacturer: HP

Name: 6500 E709n,192.168.1.104

PNP Device ID: ROOT\IMAGE\0000

Service: StillCam

.

Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}

Description: Officejet 6500 E709n

Device ID: ROOT\MULTIFUNCTION\0000

Manufacturer: HP

Name: Officejet 6500 E709n

PNP Device ID: ROOT\MULTIFUNCTION\0000

Service:

.

Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}

Description: Officejet 6500 E709n

Device ID: ROOT\PRINTER\0000

Manufacturer: HP

Name: Officejet 6500 E709n

PNP Device ID: ROOT\PRINTER\0000

Service:

.

==== System Restore Points ===================

.

RP673: 8/2/2011 10:33:11 PM - System Checkpoint

RP674: 8/4/2011 4:54:08 PM - System Checkpoint

RP675: 8/5/2011 9:43:40 PM - System Checkpoint

RP676: 8/6/2011 10:00:24 PM - System Checkpoint

RP677: 8/8/2011 9:50:27 AM - System Checkpoint

RP678: 8/9/2011 10:52:49 AM - System Checkpoint

RP679: 8/10/2011 3:46:32 PM - System Checkpoint

RP680: 8/12/2011 7:51:36 AM - System Checkpoint

RP681: 8/15/2011 8:32:32 AM - System Checkpoint

RP682: 8/17/2011 4:43:49 PM - System Checkpoint

RP683: 8/19/2011 8:49:56 AM - System Checkpoint

RP684: 8/20/2011 3:23:17 PM - System Checkpoint

RP685: 8/22/2011 9:25:28 AM - System Checkpoint

RP686: 8/23/2011 6:04:17 PM - System Checkpoint

RP687: 8/25/2011 10:03:57 AM - System Checkpoint

RP688: 8/26/2011 10:37:58 AM - System Checkpoint

RP689: 8/28/2011 10:50:29 AM - System Checkpoint

RP690: 8/29/2011 10:59:38 AM - System Checkpoint

RP691: 8/31/2011 9:11:38 AM - System Checkpoint

RP692: 9/1/2011 9:23:38 AM - System Checkpoint

RP693: 9/2/2011 11:23:52 AM - System Checkpoint

RP694: 9/3/2011 11:59:29 AM - System Checkpoint

RP695: 9/4/2011 12:25:35 PM - System Checkpoint

RP696: 9/5/2011 2:49:59 PM - System Checkpoint

RP697: 9/6/2011 3:46:18 PM - System Checkpoint

RP698: 9/7/2011 6:00:35 PM - System Checkpoint

RP699: 9/9/2011 5:42:00 PM - System Checkpoint

RP700: 9/10/2011 6:44:26 PM - System Checkpoint

RP701: 9/11/2011 7:34:22 PM - System Checkpoint

RP702: 9/11/2011 9:29:18 PM - Installed Homeschool Tracker Basic

RP703: 9/13/2011 12:38:03 AM - System Checkpoint

RP704: 9/14/2011 3:59:40 PM - System Checkpoint

RP705: 9/16/2011 9:17:31 PM - System Checkpoint

RP706: 9/18/2011 3:15:30 PM - System Checkpoint

RP707: 9/19/2011 11:37:40 PM - System Checkpoint

RP708: 9/21/2011 12:26:10 PM - System Checkpoint

RP709: 9/22/2011 2:16:13 PM - System Checkpoint

RP710: 9/23/2011 7:10:20 PM - System Checkpoint

RP711: 9/27/2011 11:37:39 AM - System Checkpoint

RP712: 9/28/2011 12:22:05 PM - System Checkpoint

RP713: 9/29/2011 12:57:51 PM - System Checkpoint

RP714: 10/2/2011 2:26:57 PM - System Checkpoint

RP715: 10/3/2011 3:53:21 PM - System Checkpoint

RP716: 10/4/2011 6:15:22 PM - System Checkpoint

RP717: 10/8/2011 12:58:29 PM - System Checkpoint

RP718: 10/9/2011 2:21:36 PM - System Checkpoint

RP719: 10/11/2011 11:53:54 AM - System Checkpoint

RP720: 10/12/2011 12:32:39 PM - System Checkpoint

RP721: 10/13/2011 1:15:06 PM - System Checkpoint

RP722: 10/19/2011 11:10:39 AM - System Checkpoint

RP723: 10/20/2011 9:50:59 PM - System Checkpoint

RP724: 10/30/2011 9:52:00 PM - System Checkpoint

RP725: 11/2/2011 5:49:22 PM - Removed Desktop Doctor

RP726: 11/2/2011 9:07:14 PM - Removed Desktop Doctor

RP727: 11/13/2011 11:59:22 PM - System Checkpoint

.

==== Installed Programs ======================

.

2007 Microsoft Office Suite Service Pack 1 (SP1)

32 Bit HP CIO Components Installer

3DVIA player 5.0

3ivx MPEG-4 5.0.3 (remove only)

6300

6300_Help

6300Trb

6500_E709_eDocs

6500_E709_Help

6500_E709n

Acrobat.com

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9.2

Adobe Shockwave Player 11.5

Advertising Center

AiO_Scan_CDA

AiOSoftwareNPI

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Bengal

Bonjour

bpd_scan

BPDSoftware

BPDSoftware_Ini

BufferChm

CCleaner

Comcast High-Speed Internet Install Wizard

Coupon Printer for Windows

Cozi

Cozi Outlook Toolbar

CP_AtenaShokunin1Config

CP_CalendarTemplates1

cp_OnlineProjectsConfig

CP_Package_Basic1

CP_Package_Variety1

CP_Package_Variety2

CP_Package_Variety3

CP_Panorama1Config

cp_PosterPrintConfig

CueTour

CustomerResearchQFolder

Destination Component

DeviceDiscovery

DeviceFunctionQFolder

DeviceManagementQFolder

Diamond Drop (CD version)

Diamond Drop 2 (CD version)

Disney Princess Royal Horse Show

DocMgr

DocProc

DocumentViewer

DocumentViewerQFolder

Dogz (remove only)

DolbyFiles

Download Updater (AOL LLC)

Easy-Link internet launch pad

eSupportQFolder

Fax

Fax_CDA

FlipShare

FP3 Player

FullDPAppQFolder

GoToMeeting 4.5.0.457

GPBaseService2

Homeschool Tracker Basic

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB954550-v5)

HP Customer Participation Program 12.0

HP Document Manager 2.0

HP Document Viewer 6.1

HP Imaging Device Functions 12.0

HP Officejet 6500 E709 Series

HP Photosmart Premier Software 6.1

HP PSC & OfficeJet 6.1.A

HP Smart Web Printing

HP Solution Center 12.0

HP Update

HPProductAssistant

HPSSupply

ImagXpress

InstantShareDevices

Intel® Graphics Media Accelerator Driver

iTunes

Java™ 6 Update 14

JumpStart Advanced Language Club

JumpStart Animal Field Trip

JumpStart Artist

JumpStart World Presents Pet Playground

LeapFrog Connect

LeapFrog Didj Plugin

LeapFrog Tag Plugin

LightScribe System Software

Malwarebytes' Anti-Malware version 1.51.2.1300

MarketResearch

Menu Templates - Starter Kit

Microsoft .NET Framework 1.1

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Office 2007 Primary Interop Assemblies

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Software Update for Web Folders (English) 12

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual Studio 2005 Tools for Office Runtime

Microsoft Zoo Tycoon

MobileMe Control Panel

Movie Templates - Starter Kit

Nero 9 Essentials

Nero BurnRights

Nero BurnRights Help

Nero ControlCenter

Nero CoverDesigner

Nero CoverDesigner Help

Nero DiscSpeed

Nero DiscSpeed Help

Nero DriveSpeed

Nero DriveSpeed Help

Nero Express Help

Nero InfoTool

Nero InfoTool Help

Nero Installer

Nero Online Upgrade

Nero ShowTime

Nero StartSmart

Nero StartSmart Help

Nero Vision

Nero Vision Help

NeroExpress

neroxml

Network

NetZero Internet and Voice Offer

NewCopy_CDA

Norton Security Scan

O2Micro Flash Memory Card Reader Driver (x86)

OCR Software by I.R.I.S. 12.0

PanoStandAlone

PhotoGallery

ProductContext

ProductContextNPI

Publix Preschool Pals

Putt Putt Saves the Zoo

QuickTime

RandMap

Reading Readiness

Readme

Realtek High Definition Audio Driver

Safari

Scan

ScannerCopy

Security Update for 2007 Microsoft Office System (KB951550)

Security Update for 2007 Microsoft Office System (KB951944)

Security Update for 2007 Microsoft Office System (KB958439)

Security Update for Microsoft Office Excel 2007 (KB958437)

Security Update for Microsoft Office OneNote 2007 (KB950130)

Security Update for Microsoft Office PowerPoint 2007 (KB951338)

Security Update for Microsoft Office Publisher 2007 (KB950114)

Security Update for Microsoft Office system 2007 (KB954326)

Security Update for Microsoft Office system 2007 (KB956828)

Security Update for Microsoft Office Word 2007 (KB956358)

Security Update for Windows XP (KB923789)

Shop for HP Supplies

ShopAtHome.com Toolbar

SkinsHP1

SmartWebPrinting

Smilebox

SolutionCenter

Sonic_PrimoSDK

Spelling Dictionaries Support For Adobe Reader 9

Sprint Mobile Broadband (Sierra)

Status

Synaptics Pointing Device Driver

The Land Before Time Kindergarten Adventure

Toolbox

Transition Math K-1

TrayApp

Unity Web Player

Unload

UnloadSupport

Update for Microsoft Office 2007 Help for Common Features (KB957244)

Update for Microsoft Office Access 2007 Help (KB957241)

Update for Microsoft Office Excel 2007 Help (KB957242)

Update for Microsoft Office InfoPath 2007 Help (KB957243)

Update for Microsoft Office OneNote 2007 Help (KB957245)

Update for Microsoft Office Outlook 2007 (KB952142)

Update for Microsoft Office Outlook 2007 Help (KB957246)

Update for Microsoft Office PowerPoint 2007 Help (KB957247)

Update for Microsoft Office Publisher 2007 Help (KB957249)

Update for Microsoft Office Word 2007 Help (KB957252)

Update for Microsoft Script Editor Help (KB957253)

Update for Office 2007 (KB946691)

Update for Outlook 2007 Junk Email Filter (kb962871)

USBFast

Use the entry named LeapFrog Connect to uninstall (LeapFrog Didj Plugin)

Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin)

Visual Studio 2005 Tools for Office Second Edition Runtime

VIVA MEDIA GAME CENTER

VoiceOver Kit

WebFldrs XP

WebReg

Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)

Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Search 4.0

Zoboomafoo Animal Alphabet™

.

==== Event Viewer Messages From Past Week ========

.

11/14/2011 12:49:12 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

11/13/2011 10:23:38 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070020: Automatic Updates.

.

==== End Of File ===========================

Thanks for your help.

Chris

Maniac · November 15, 2011

Hello Chris! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/paste in your next reply.

I want to see what Malwarebytes' Anti-Malware detects to have an idea what we are dealing, so:

Launch Malwarebytes' Anti-Malware
Go to Update" tab and select Check for Updates.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, please post the following log files:

Malwarebytes' Anti-Malware log
a new fresh DDS log only

dusktilldawnll · November 16, 2011

Anti-Malware log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8171

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

11/15/2011 8:06:31 PM

mbam-log-2011-11-15 (20-06-31).txt

Scan type: Quick scan

Objects scanned: 179368

Time elapsed: 1 minute(s), 22 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS log:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_14

Run by Jessica at 19:52:20 on 2011-11-15

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2403 [GMT -5:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

C:\Program Files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Flip Video\FlipShare\FlipShareService.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\WINDOWS\system32\svchost.exe -k HPService

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\DRIVERS\o2flash.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\wscntfy.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://forums.malwarebytes.org/

mStart Page = hxxp://www.comcast.net/

mWindow Title = Windows Internet Explorer provided by Comcast

uInternet Settings,ProxyOverride = *.local

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {465E08E7-F005-4389-980F-1D8764B3486C} - No File

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll