Jump to content


Photo

Gifted Used Computer, Checking if Clean


  • This topic is locked This topic is locked
24 replies to this topic

#1 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 23 July 2012 - 11:32 AM

Hey guys,

I appreciate the help. I was given this used laptop. It runs Vista 32 bit. Haven't had any problems with it, but would love to check if there are any spies or viruses and things like that. And that everything is in good form.

The computer did not have any antivirus. Though i suspect they may have run a recovery disk before they gave it to me. It seams like it though not sure.

I've downloaded firefox, malwarebytes, spybot s&d, and have also followed the instructions. (nothing was found with malwarebytes or spybot)

It seams like the instructions have changed and you guys don't require Hijack this anymore so i didn't run it. If you need me to run it, let me know.

Thanks so much for this check guys, I appreciate it!


Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.23.08

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.16982
rick :: RICK-PC [administrator]

7/23/2012 8:29:49 AM
mbam-log-2012-07-23 (08-29-49).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 172019
Time elapsed: 4 minute(s), 5 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)





.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6000.16982
Run by rick at 11:45:04 on 2012-07-23
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2046.1004 [GMT -5:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Toshiba\IVP\ISM\pinger.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Utilities\KeNotify.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Toshiba Registration\Registration.exe
C:\Program Files\Toshiba Registration\BootInfo.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\Core\mchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20120723110240.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe
uRun: [1145860967] c:\program files\toshiba registration\registration.exe /r "c:\program files\toshiba registration\Registration.rpd"
uRun: [95641731] c:\program files\toshiba registration\bootinfo.exe /r "c:\program files\toshiba registration\BootInfo.rpd"
uRunOnce: [MISPInst] "c:\users\rick\appdata\local\temp\mcinstalltemp\Install.exe" /Resume /Restart
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [PSQLLauncher] "c:\program files\protector suite ql\launcher.exe" /startup
mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [NDSTray.exe] NDSTray.exe
mRun: [HWSetup] \HWSetup.exe hwSetUP
mRun: [SVPWUTIL] c:\program files\toshiba\utilities\SVPWUTIL.exe SVPwUTIL
mRun: [KeNotify] c:\program files\toshiba\utilities\KeNotify.exe
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mPolicies-system: DisableCAD = 1 (0x1)
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\npjpi160.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8DA2B145-41AD-46B6-B896-302199E21359} : DhcpNameServer = 192.168.1.254
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: psfus - c:\windows\system32\psqlpwd.dll
LSA: Notification Packages = scecli psqlpwd
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\rick\appdata\roaming\mozilla\firefox\profiles\hbxovwj5.default\
FF - plugin: c:\progra~1\mcafee\msc\npMcSnFFPl.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_265.dll
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2012-2-22 464304]
R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2012-7-23 64912]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2012-7-23 89792]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-7-23 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-7-23 214904]
R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-7-23 214904]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2012-7-23 166320]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2012-7-23 161664]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2012-7-23 151912]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2012-7-23 180848]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2012-7-23 59456]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2012-7-23 340920]
S2 0011571343059392mcinstcleanup;McAfee Application Installer Cleanup (0011571343059392);c:\users\rick\appdata\local\temp\001157~1.exe -cleanup -nolog --> c:\users\rick\appdata\local\temp\001157~1.EXE -cleanup -nolog [?]
S2 0024401343059785mcinstcleanup;McAfee Application Installer Cleanup (0024401343059785);c:\windows\temp\002440~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\windows\temp\002440~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-6 250056]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2012-7-23 57600]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2012-7-23 87656]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-7-23 113120]
.
=============== Created Last 30 ================
.
2012-07-23 15:50:10 151912 ----a-w- c:\windows\system32\mfevtps.exe
2012-07-23 14:32:56 -------- d-----w- c:\users\rick\appdata\local\Macromedia
2012-07-23 14:19:06 -------- d-----w- c:\users\rick\appdata\local\Mozilla
2012-07-23 13:44:49 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-07-23 13:44:49 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-07-23 13:28:54 -------- d-----w- c:\users\rick\appdata\roaming\Malwarebytes
2012-07-23 13:28:39 -------- d-----w- c:\programdata\Malwarebytes
2012-07-23 13:28:38 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-23 13:28:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-23 05:37:09 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-07-23 05:37:09 289792 ----a-w- c:\windows\system32\atmfd.dll
2012-07-23 05:37:09 24064 ----a-w- c:\windows\system32\lpk.dll
2012-07-23 05:37:09 156672 ----a-w- c:\windows\system32\t2embed.dll
2012-07-23 05:37:09 10240 ----a-w- c:\windows\system32\dciman32.dll
2012-07-23 05:37:08 72704 ----a-w- c:\windows\system32\fontsub.dll
2012-07-23 05:34:07 61440 ----a-w- c:\windows\system32\winipsec.dll
2012-07-23 05:34:07 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2012-07-23 05:34:07 28672 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2012-07-23 05:34:07 272896 ----a-w- c:\windows\system32\polstore.dll
2012-07-23 05:33:29 84992 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-07-23 05:33:29 306688 ----a-w- c:\windows\system32\drivers\srv.sys
2012-07-23 05:32:52 707072 ----a-w- c:\program files\common files\system\wab32.dll
2012-07-23 05:32:52 41984 ----a-w- c:\program files\windows mail\wabimp.dll
2012-07-23 05:32:52 1098752 ----a-w- c:\program files\common files\system\wab32res.dll
2012-07-23 05:32:51 87040 ----a-w- c:\windows\system32\msoert2.dll
2012-07-23 05:32:51 39424 ----a-w- c:\windows\system32\ACCTRES.dll
2012-07-23 05:32:51 2836992 ----a-w- c:\program files\windows mail\MSOERES.dll
2012-07-23 05:32:51 205824 ----a-w- c:\windows\system32\msoeacct.dll
2012-07-23 05:32:51 1614848 ----a-w- c:\program files\windows mail\msoe.dll
2012-07-23 05:32:48 397312 ----a-w- c:\program files\windows mail\WinMail.exe
2012-07-23 05:32:47 81408 ----a-w- c:\program files\windows mail\oeimport.dll
2012-07-23 05:32:47 24064 ----a-w- c:\program files\common files\system\DirectDB.dll
2012-07-23 05:31:55 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2012-07-23 05:31:55 15360 ----a-w- c:\windows\system32\netevent.dll
2012-07-23 05:31:55 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2012-07-23 05:31:54 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2012-07-23 05:31:54 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2012-07-23 05:31:54 19968 ----a-w- c:\windows\system32\ARP.EXE
2012-07-23 05:31:54 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2012-07-23 05:31:54 103936 ----a-w- c:\windows\system32\netiohlp.dll
2012-07-23 05:31:54 10240 ----a-w- c:\windows\system32\finger.exe
2012-07-23 05:30:57 194560 ----a-w- c:\windows\system32\WebClnt.dll
2012-07-23 05:30:57 110080 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2012-07-23 05:30:22 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2012-07-23 05:30:20 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2012-07-23 05:30:20 502784 ----a-w- c:\windows\system32\wlansvc.dll
2012-07-23 05:30:20 47104 ----a-w- c:\windows\system32\wlanapi.dll
2012-07-23 05:30:20 299520 ----a-w- c:\windows\system32\wlansec.dll
2012-07-23 05:30:20 289280 ----a-w- c:\windows\system32\wlanmsm.dll
2012-07-23 05:29:37 2048 ----a-w- c:\windows\system32\msxml3r.dll
2012-07-23 05:29:37 1260032 ----a-w- c:\windows\system32\msxml3.dll
2012-07-23 05:29:36 2048 ----a-w- c:\windows\system32\msxml6r.dll
2012-07-23 05:29:36 1406464 ----a-w- c:\windows\system32\msxml6.dll
2012-07-23 05:28:53 216576 ----a-w- c:\windows\system32\msv1_0.dll
2012-07-23 05:28:14 58368 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-07-23 05:28:14 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-07-23 05:28:14 102400 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-07-23 05:27:34 98816 ----a-w- c:\windows\system32\mfps.dll
2012-07-23 05:27:34 2855424 ----a-w- c:\windows\system32\mf.dll
2012-07-23 05:27:33 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2012-07-23 05:27:33 24576 ----a-w- c:\windows\system32\mfpmp.exe
2012-07-23 05:27:33 2048 ----a-w- c:\windows\system32\mferror.dll
2012-07-23 05:26:49 3502480 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-07-23 05:26:49 3468168 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-07-23 05:25:38 376832 ----a-w- c:\windows\system32\winhttp.dll
2012-07-23 05:25:02 434176 ----a-w- c:\windows\system32\vbscript.dll
2012-07-23 05:24:25 71680 ----a-w- c:\windows\system32\atl.dll
2012-07-23 05:23:50 297472 ----a-w- c:\windows\system32\gdi32.dll
2012-07-23 05:22:21 374456 ----a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2012-07-23 05:21:54 500736 ----a-w- c:\windows\system32\msdtcprx.dll
2012-07-23 05:21:53 30208 ----a-w- c:\windows\system32\xolehlp.dll
2012-07-23 05:21:20 156160 ----a-w- c:\windows\system32\wkssvc.dll
2012-07-23 05:20:43 36352 ----a-w- c:\windows\system32\tsgqec.dll
2012-07-23 05:20:43 1871872 ----a-w- c:\windows\system32\mstscax.dll
2012-07-23 05:20:43 116736 ----a-w- c:\windows\system32\aaclient.dll
2012-07-23 05:20:05 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2012-07-23 05:18:57 63488 ----a-w- c:\windows\system32\drivers\mpsdrv.sys
2012-07-23 05:18:57 392192 ----a-w- c:\windows\system32\FirewallAPI.dll
2012-07-23 05:18:56 86016 ----a-w- c:\windows\system32\icfupgd.dll
2012-07-23 05:18:56 61952 ----a-w- c:\windows\system32\cmifw.dll
2012-07-23 05:18:56 396800 ----a-w- c:\windows\system32\MPSSVC.dll
2012-07-23 05:18:56 16896 ----a-w- c:\windows\system32\wfapigp.dll
2012-07-23 05:17:56 150016 ----a-w- c:\program files\movie maker\MOVIEMK.exe
2012-07-23 05:17:55 23040 ----a-w- c:\program files\movie maker\WMM2EXT.dll
2012-07-23 05:17:55 195072 ----a-w- c:\program files\movie maker\WMM2AE.dll
2012-07-23 05:17:55 10922496 ----a-w- c:\program files\movie maker\MOVIEMK.dll
2012-07-23 05:15:25 2048 ----a-w- c:\windows\system32\tzres.dll
2012-07-23 05:14:44 696832 ----a-w- c:\windows\system32\localspl.dll
2012-07-23 05:14:17 2923520 ----a-w- c:\windows\explorer.exe
2012-07-23 05:13:23 7680 ----a-w- c:\windows\system32\lsass.exe
2012-07-23 05:13:23 72704 ----a-w- c:\windows\system32\secur32.dll
2012-07-23 05:13:23 494592 ----a-w- c:\windows\system32\kerberos.dll
2012-07-23 05:13:23 408136 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-23 05:13:23 175104 ----a-w- c:\windows\system32\wdigest.dll
2012-07-23 05:13:23 1233920 ----a-w- c:\windows\system32\lsasrv.dll
2012-07-23 05:13:22 272384 ----a-w- c:\windows\system32\schannel.dll
2012-07-23 05:12:55 24064 ----a-w- c:\windows\system32\netcfg.exe
2012-07-23 05:11:23 1585664 ----a-w- c:\windows\system32\setupapi.dll
2012-07-23 05:09:32 549888 ----a-w- c:\windows\system32\rpcss.dll
2012-07-23 05:09:31 654336 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-07-23 05:09:31 24576 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-07-23 05:09:30 614912 ----a-w- c:\windows\system32\wbem\fastprox.dll
2012-07-23 05:09:30 501760 ----a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2012-07-23 05:09:30 247296 ----a-w- c:\windows\system32\wbem\WmiPrvSE.exe
2012-07-23 05:09:30 130560 ----a-w- c:\windows\system32\wbem\WmiDcPrv.dll
2012-07-23 05:09:29 97280 ----a-w- c:\windows\system32\iasrecst.dll
2012-07-23 05:09:29 53248 ----a-w- c:\windows\system32\iasads.dll
2012-07-23 05:09:29 37888 ----a-w- c:\windows\system32\iasdatastore.dll
2012-07-23 05:09:29 158720 ----a-w- c:\windows\system32\sdohlp.dll
2012-07-23 05:09:03 62464 ----a-w- c:\windows\system32\l3codeca.acm
2012-07-23 05:09:03 220672 ----a-w- c:\windows\system32\l3codecp.acm
2012-07-23 05:08:17 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2012-07-23 05:08:16 815104 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-07-23 05:08:16 22016 ----a-w- c:\windows\system32\netiougc.exe
2012-07-23 05:08:16 213592 ----a-w- c:\windows\system32\drivers\netio.sys
2012-07-23 05:08:16 179712 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-07-23 05:08:16 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2012-07-23 05:08:16 15360 ----a-w- c:\windows\system32\drivers\TUNMP.SYS
2012-07-23 05:07:45 454656 ----a-w- c:\program files\common files\system\msadc\msadce.dll
2012-07-23 05:07:21 9728 ----a-w- c:\windows\system32\LAPRXY.DLL
2012-07-23 05:07:21 223232 ----a-w- c:\windows\system32\WMASF.DLL
2012-07-23 05:07:21 2048 ----a-w- c:\windows\system32\asferror.dll
2012-07-23 05:07:05 25600 ----a-w- c:\windows\system32\amxread.dll
2012-07-23 05:07:05 14848 ----a-w- c:\windows\system32\apilogen.dll
2012-07-23 05:06:45 37376 ----a-w- c:\windows\system32\printcom.dll
2012-07-23 05:06:44 441856 ----a-w- c:\windows\system32\win32spl.dll
2012-07-23 05:06:25 2031104 ----a-w- c:\windows\system32\win32k.sys
2012-07-23 05:06:07 14848 ----a-w- c:\windows\system32\wshrm.dll
2012-07-23 05:06:07 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
2012-07-23 05:04:42 83968 ----a-w- c:\windows\system32\dnsrslvr.dll
2012-07-23 05:04:42 24576 ----a-w- c:\windows\system32\dnscacheugc.exe
2012-07-23 05:04:10 996352 ----a-w- c:\windows\system32\WMNetMgr.dll
2012-07-23 05:04:10 94720 ----a-w- c:\windows\system32\logagent.exe
2012-07-23 05:03:40 148992 ----a-w- c:\windows\system32\drivers\ks.sys
2012-07-23 05:03:33 765952 ----a-w- c:\program files\common files\microsoft shared\vgx\VGX.dll
2012-07-23 05:03:22 84480 ----a-w- c:\windows\system32\INETRES.dll
2012-07-23 05:03:22 737792 ----a-w- c:\windows\system32\inetcomm.dll
2012-07-23 05:03:03 60928 ----a-w- c:\windows\system32\msasn1.dll
2012-07-23 05:02:49 5120 ----a-w- c:\windows\system32\wmi.dll
2012-07-23 05:02:49 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-07-23 05:02:48 152576 ----a-w- c:\windows\system32\imagehlp.dll
2012-07-23 05:02:32 788992 ----a-w- c:\windows\system32\rpcrt4.dll
2012-07-23 05:02:11 130048 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-07-23 05:01:49 274432 ----a-w- c:\windows\system32\raschap.dll
2012-07-23 05:01:48 232960 ----a-w- c:\windows\system32\rastls.dll
2012-07-23 05:01:24 321536 ----a-w- c:\windows\system32\WSDApi.dll
2012-07-23 05:01:11 99840 ----a-w- c:\windows\system32\poqexec.exe
2012-07-23 05:00:29 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2012-07-23 05:00:29 22528 ----a-w- c:\windows\system32\msyuv.dll
2012-07-23 05:00:29 11776 ----a-w- c:\windows\system32\tsbyuv.dll
2012-07-23 05:00:28 1327616 ----a-w- c:\windows\system32\quartz.dll
2012-07-23 05:00:27 88576 ----a-w- c:\windows\system32\avifil32.dll
2012-07-23 05:00:27 82944 ----a-w- c:\windows\system32\mciavi32.dll
2012-07-23 05:00:27 65024 ----a-w- c:\windows\system32\avicap32.dll
2012-07-23 05:00:27 31232 ----a-w- c:\windows\system32\msvidc32.dll
2012-07-23 05:00:27 13312 ----a-w- c:\windows\system32\msrle32.dll
2012-07-23 05:00:27 123904 ----a-w- c:\windows\system32\msvfw32.dll
2012-07-23 04:59:47 750080 ----a-w- c:\windows\system32\qmgr.dll
2012-07-23 04:59:25 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2012-07-23 03:29:12 -------- d-----w- c:\users\rick\appdata\local\Seven Zip
2012-07-23 03:20:18 -------- d-----w- c:\users\rick\appdata\roaming\WinBatch
2012-07-22 19:25:21 171520 ----a-w- c:\windows\system32\wintrust.dll
2012-07-22 19:24:24 97792 ----a-w- c:\windows\system32\cabview.dll
2012-07-22 19:23:36 396800 ----a-w- c:\windows\system32\drivers\http.sys
2012-07-22 19:23:36 31232 ----a-w- c:\windows\system32\httpapi.dll
2012-07-22 19:23:36 24064 ----a-w- c:\windows\system32\nshhttp.dll
2012-07-22 18:16:43 -------- d-----w- c:\users\rick\appdata\local\Adobe
2012-07-22 17:56:01 -------- d-----w- c:\users\rick\appdata\local\Yahoo
.
==================== Find3M ====================
.
2012-07-23 14:54:33 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-23 14:54:33 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-23 05:35:50 72704 ----a-w- c:\windows\system32\admparse.dll
2012-07-23 05:35:49 52736 ----a-w- c:\windows\apppatch\iebrshim.dll
2012-07-23 05:35:48 832512 ----a-w- c:\windows\system32\wininet.dll
2012-07-23 05:35:44 389120 ----a-w- c:\windows\system32\html.iec
2012-07-23 05:35:43 78336 ----a-w- c:\windows\system32\ieencode.dll
2012-07-23 05:35:43 48128 ----a-w- c:\windows\system32\mshtmler.dll
2012-07-23 05:35:42 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2012-07-23 05:35:40 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2012-07-23 05:35:38 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2012-07-23 05:35:36 56320 ----a-w- c:\windows\system32\iesetup.dll
2012-07-23 05:07:05 40960 ----a-w- c:\windows\apppatch\apihex86.dll
2012-07-23 05:05:47 8147968 ----a-w- c:\windows\system32\wmploc.DLL
2012-07-23 05:05:46 7680 ----a-w- c:\windows\system32\spwmp.dll
2012-07-23 05:05:45 4096 ----a-w- c:\windows\system32\msdxm.ocx
2012-07-23 05:05:45 4096 ----a-w- c:\windows\system32\dxmasf.dll
2012-07-23 05:05:41 43520 ----a-w- c:\windows\system32\msdxm.tlb
2012-07-23 05:05:41 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2012-07-23 05:05:41 18432 ----a-w- c:\windows\system32\amcompat.tlb
2012-07-23 05:05:05 11776 ----a-w- c:\windows\system32\sbunattend.exe
.
============= FINISH: 11:54:15.66 ===============




Results of screen317's Security Check version 0.99.43
Windows Vista x86 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.62.0.1300
Java™ SE Runtime Environment 6
Java version out of Date!
Adobe Flash Player 11.3.300.265
Adobe Reader 8 Adobe Reader out of Date!
Mozilla Firefox (14.0.1)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 4 % Defragment your hard drive soon!
````````````````````End of Log``````````````````````



Thanks!


UPDATE:
I did a ESET Online Virus Scan and it said: "No Threats Found". Also McAfee didn't find any threats.

Edited by TimmU, 23 July 2012 - 12:19 PM.


#2 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 25 July 2012 - 12:24 AM

Hello TimmU. :)

We now prefer DDS because it is able to display more information and is more effective at helping us find the latest infections. :thumbup:

Have you noticed anything odd at all on your computer? Redirects, slowness, popups etc?


Please follow these instructions to run ComboFix.exe. Please visit this webpage for download links and instructions for running this tool:

http://www.bleepingc...to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix (CF).

Please go here to see a list of programs that need to be disabled.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall.**

**Note 2: If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.**

Please include the C:\ComboFix.txt in your next reply for further review.

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#3 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 25 July 2012 - 09:38 AM

Thanks so much The Dark Knight!

Have I noticed anything odd? Not really. No redirects or weird pop-ups.

Slowness: I don't think so. My old laptop was 10 years old and compared to that this computer is fast, but I don't know, maybe it could be faster.

The only odd thing i noticed just now as i was checking out the instructions for Combofix was that Firefox was "not responding" and i had to restart the computer to get it working again.

Thanks! And here is the report you requested:

ComboFix 12-07-26.03 - rick 07/25/2012 10:16:45.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2046.1341 [GMT -5:00]
Running from: c:\users\rick\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
.
.
((((((((((((((((((((((((( Files Created from 2012-06-25 to 2012-07-25 )))))))))))))))))))))))))))))))
.
.
2012-07-25 15:22 . 2012-07-25 15:23 -------- d-----w- c:\users\rick\AppData\Local\temp
2012-07-25 15:22 . 2012-07-25 15:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-24 16:20 . 2012-07-24 16:20 378368 ----a-w- c:\windows\system32\winhttp.dll
2012-07-24 16:20 . 2012-07-24 16:20 268800 ----a-w- c:\windows\system32\es.dll
2012-07-24 13:57 . 2012-02-22 18:29 9608 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2012-07-24 13:57 . 2012-02-22 18:29 89792 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
2012-07-24 13:57 . 2012-02-22 18:29 87656 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2012-07-24 13:57 . 2012-02-22 18:29 64912 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2012-07-24 13:57 . 2012-02-22 18:29 59456 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2012-07-24 13:57 . 2012-02-22 18:29 57600 ----a-w- c:\windows\system32\drivers\cfwids.sys
2012-07-24 13:57 . 2012-02-22 18:29 340920 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2012-07-24 13:57 . 2012-02-22 18:29 180848 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2012-07-24 13:56 . 2012-07-24 19:51 -------- d-----w- c:\program files\McAfee
2012-07-24 00:49 . 2012-07-24 00:49 96760 ----a-w- c:\windows\system32\dfshim.dll
2012-07-24 00:49 . 2012-07-24 00:49 41984 ----a-w- c:\windows\system32\netfxperf.dll
2012-07-24 00:49 . 2012-07-24 00:49 282112 ----a-w- c:\windows\system32\mscoree.dll
2012-07-24 00:49 . 2012-07-24 00:49 83968 ----a-w- c:\windows\system32\mscories.dll
2012-07-24 00:49 . 2012-07-24 00:49 158720 ----a-w- c:\windows\system32\mscorier.dll
2012-07-23 23:55 . 2012-07-23 23:55 -------- d-----w- c:\program files\Common Files\Adobe
2012-07-23 23:45 . 2012-07-23 23:45 -------- d-----w- c:\program files\Common Files\Java
2012-07-23 23:44 . 2012-07-23 23:44 -------- d-----w- c:\program files\Oracle
2012-07-23 23:43 . 2012-07-06 03:06 772544 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-07-23 23:43 . 2012-07-06 03:06 687544 ----a-w- c:\windows\system32\deployJava1.dll
2012-07-23 23:43 . 2012-07-23 23:43 -------- d-----w- c:\program files\Java
2012-07-23 17:40 . 2012-07-23 17:40 -------- d-----w- c:\users\rick\AppData\Roaming\QuickScan
2012-07-23 16:02 . 2012-07-24 13:59 -------- d-----w- c:\program files\Common Files\Mcafee
2012-07-23 15:50 . 2012-05-25 22:13 151912 ----a-w- c:\windows\system32\mfevtps.exe
2012-07-23 14:32 . 2012-07-23 14:32 -------- d-----w- c:\users\rick\AppData\Local\Macromedia
2012-07-23 14:29 . 2012-07-23 14:29 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-07-23 14:19 . 2012-07-23 14:19 -------- d-----w- c:\users\rick\AppData\Local\Mozilla
2012-07-23 13:44 . 2012-07-25 14:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-07-23 13:44 . 2012-07-23 13:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-07-23 13:28 . 2012-07-23 13:28 -------- d-----w- c:\users\rick\AppData\Roaming\Malwarebytes
2012-07-23 13:28 . 2012-07-23 13:28 -------- d-----w- c:\programdata\Malwarebytes
2012-07-23 13:28 . 2012-07-23 13:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-23 13:28 . 2012-07-03 18:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-23 05:37 . 2012-07-23 05:37 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-07-23 05:37 . 2012-07-23 05:37 289792 ----a-w- c:\windows\system32\atmfd.dll
2012-07-23 05:37 . 2012-07-23 05:37 24064 ----a-w- c:\windows\system32\lpk.dll
2012-07-23 05:37 . 2012-07-23 05:37 156672 ----a-w- c:\windows\system32\t2embed.dll
2012-07-23 05:37 . 2012-07-23 05:37 10240 ----a-w- c:\windows\system32\dciman32.dll
2012-07-23 05:37 . 2012-07-23 05:37 72704 ----a-w- c:\windows\system32\fontsub.dll
2012-07-23 05:34 . 2012-07-23 05:34 61440 ----a-w- c:\windows\system32\winipsec.dll
2012-07-23 05:34 . 2012-07-23 05:34 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2012-07-23 05:34 . 2012-07-23 05:34 28672 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2012-07-23 05:34 . 2012-07-23 05:34 272896 ----a-w- c:\windows\system32\polstore.dll
2012-07-23 05:33 . 2012-07-23 05:33 84992 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-07-23 05:33 . 2012-07-23 05:33 306688 ----a-w- c:\windows\system32\drivers\srv.sys
2012-07-23 05:32 . 2012-07-23 05:32 707072 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-07-23 05:32 . 2012-07-23 05:32 41984 ----a-w- c:\program files\Windows Mail\wabimp.dll
2012-07-23 05:32 . 2012-07-23 05:32 1098752 ----a-w- c:\program files\Common Files\System\wab32res.dll
2012-07-23 05:32 . 2012-07-23 05:32 87040 ----a-w- c:\windows\system32\msoert2.dll
2012-07-23 05:32 . 2012-07-23 05:32 39424 ----a-w- c:\windows\system32\ACCTRES.dll
2012-07-23 05:32 . 2012-07-23 05:32 2836992 ----a-w- c:\program files\Windows Mail\MSOERES.dll
2012-07-23 05:32 . 2012-07-23 05:32 205824 ----a-w- c:\windows\system32\msoeacct.dll
2012-07-23 05:32 . 2012-07-23 05:32 1614848 ----a-w- c:\program files\Windows Mail\msoe.dll
2012-07-23 05:32 . 2012-07-23 05:32 397312 ----a-w- c:\program files\Windows Mail\WinMail.exe
2012-07-23 05:32 . 2012-07-23 05:32 81408 ----a-w- c:\program files\Windows Mail\oeimport.dll
2012-07-23 05:32 . 2012-07-23 05:32 24064 ----a-w- c:\program files\Common Files\System\DirectDB.dll
2012-07-23 05:31 . 2012-07-23 05:31 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2012-07-23 05:31 . 2012-07-23 05:31 15360 ----a-w- c:\windows\system32\netevent.dll
2012-07-23 05:31 . 2012-07-23 05:31 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2012-07-23 05:31 . 2012-07-23 05:31 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2012-07-23 05:31 . 2012-07-23 05:31 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2012-07-23 05:31 . 2012-07-23 05:31 19968 ----a-w- c:\windows\system32\ARP.EXE
2012-07-23 05:31 . 2012-07-23 05:31 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2012-07-23 05:31 . 2012-07-23 05:31 103936 ----a-w- c:\windows\system32\netiohlp.dll
2012-07-23 05:31 . 2012-07-23 05:31 10240 ----a-w- c:\windows\system32\finger.exe
2012-07-23 05:30 . 2012-07-23 05:30 194560 ----a-w- c:\windows\system32\WebClnt.dll
2012-07-23 05:30 . 2012-07-23 05:30 110080 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2012-07-23 05:30 . 2012-07-23 05:30 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2012-07-23 05:30 . 2012-07-23 05:30 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2012-07-23 05:30 . 2012-07-23 05:30 502784 ----a-w- c:\windows\system32\wlansvc.dll
2012-07-23 05:30 . 2012-07-23 05:30 47104 ----a-w- c:\windows\system32\wlanapi.dll
2012-07-23 05:30 . 2012-07-23 05:30 299520 ----a-w- c:\windows\system32\wlansec.dll
2012-07-23 05:30 . 2012-07-23 05:30 289280 ----a-w- c:\windows\system32\wlanmsm.dll
2012-07-23 05:29 . 2012-07-23 05:29 2048 ----a-w- c:\windows\system32\msxml3r.dll
2012-07-23 05:29 . 2012-07-23 05:29 1260032 ----a-w- c:\windows\system32\msxml3.dll
2012-07-23 05:29 . 2012-07-23 05:29 2048 ----a-w- c:\windows\system32\msxml6r.dll
2012-07-23 05:29 . 2012-07-23 05:29 1406464 ----a-w- c:\windows\system32\msxml6.dll
2012-07-23 05:28 . 2012-07-23 05:28 216576 ----a-w- c:\windows\system32\msv1_0.dll
2012-07-23 05:28 . 2012-07-23 05:28 58368 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-07-23 05:28 . 2012-07-23 05:28 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-07-23 05:28 . 2012-07-23 05:28 102400 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-07-23 05:27 . 2012-07-23 05:27 98816 ----a-w- c:\windows\system32\mfps.dll
2012-07-23 05:27 . 2012-07-23 05:27 2855424 ----a-w- c:\windows\system32\mf.dll
2012-07-23 05:27 . 2012-07-23 05:27 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2012-07-23 05:27 . 2012-07-23 05:27 24576 ----a-w- c:\windows\system32\mfpmp.exe
2012-07-23 05:27 . 2012-07-23 05:27 2048 ----a-w- c:\windows\system32\mferror.dll
2012-07-23 05:26 . 2012-07-23 05:26 3502480 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-07-23 05:26 . 2012-07-23 05:26 3468168 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-07-23 05:25 . 2012-07-23 05:25 434176 ----a-w- c:\windows\system32\vbscript.dll
2012-07-23 05:24 . 2012-07-23 05:24 71680 ----a-w- c:\windows\system32\atl.dll
2012-07-23 05:23 . 2012-07-23 05:23 297472 ----a-w- c:\windows\system32\gdi32.dll
2012-07-23 05:22 . 2012-07-23 05:22 374456 ----a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2012-07-23 05:21 . 2012-07-23 05:21 500736 ----a-w- c:\windows\system32\msdtcprx.dll
2012-07-23 05:21 . 2012-07-23 05:21 30208 ----a-w- c:\windows\system32\xolehlp.dll
2012-07-23 05:21 . 2012-07-23 05:21 156160 ----a-w- c:\windows\system32\wkssvc.dll
2012-07-23 05:20 . 2012-07-23 05:20 36352 ----a-w- c:\windows\system32\tsgqec.dll
2012-07-23 05:20 . 2012-07-23 05:20 1871872 ----a-w- c:\windows\system32\mstscax.dll
2012-07-23 05:20 . 2012-07-23 05:20 116736 ----a-w- c:\windows\system32\aaclient.dll
2012-07-23 05:20 . 2012-07-23 05:20 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2012-07-23 05:18 . 2012-07-23 05:18 63488 ----a-w- c:\windows\system32\drivers\mpsdrv.sys
2012-07-23 05:18 . 2012-07-23 05:18 392192 ----a-w- c:\windows\system32\FirewallAPI.dll
2012-07-23 05:18 . 2012-07-23 05:18 396800 ----a-w- c:\windows\system32\MPSSVC.dll
2012-07-23 05:18 . 2012-07-23 05:18 86016 ----a-w- c:\windows\system32\icfupgd.dll
2012-07-23 05:18 . 2012-07-23 05:18 61952 ----a-w- c:\windows\system32\cmifw.dll
2012-07-23 05:18 . 2012-07-23 05:18 16896 ----a-w- c:\windows\system32\wfapigp.dll
2012-07-23 05:17 . 2012-07-23 05:17 150016 ----a-w- c:\program files\Movie Maker\MOVIEMK.exe
2012-07-23 05:17 . 2012-07-23 05:17 23040 ----a-w- c:\program files\Movie Maker\WMM2EXT.dll
2012-07-23 05:17 . 2012-07-23 05:17 195072 ----a-w- c:\program files\Movie Maker\WMM2AE.dll
2012-07-23 05:17 . 2012-07-23 05:17 10922496 ----a-w- c:\program files\Movie Maker\MOVIEMK.dll
2012-07-23 05:15 . 2012-07-23 05:15 2048 ----a-w- c:\windows\system32\tzres.dll
2012-07-23 05:14 . 2012-07-23 05:14 696832 ----a-w- c:\windows\system32\localspl.dll
2012-07-23 05:14 . 2012-07-23 05:14 2923520 ----a-w- c:\windows\explorer.exe
2012-07-23 05:13 . 2012-07-23 05:13 7680 ----a-w- c:\windows\system32\lsass.exe
2012-07-23 05:13 . 2012-07-23 05:13 72704 ----a-w- c:\windows\system32\secur32.dll
2012-07-23 05:13 . 2012-07-23 05:13 494592 ----a-w- c:\windows\system32\kerberos.dll
2012-07-23 05:13 . 2012-07-23 05:13 408136 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-23 05:13 . 2012-07-23 05:13 175104 ----a-w- c:\windows\system32\wdigest.dll
2012-07-23 05:13 . 2012-07-23 05:13 1233920 ----a-w- c:\windows\system32\lsasrv.dll
2012-07-23 05:13 . 2012-07-23 05:13 272384 ----a-w- c:\windows\system32\schannel.dll
2012-07-23 05:12 . 2012-07-23 05:12 24064 ----a-w- c:\windows\system32\netcfg.exe
2012-07-23 05:11 . 2012-07-23 05:11 1585664 ----a-w- c:\windows\system32\setupapi.dll
2012-07-23 05:09 . 2012-07-23 05:09 549888 ----a-w- c:\windows\system32\rpcss.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-24 16:17 . 2012-07-24 16:17 36864 ----a-w- c:\windows\system32\drivers\en-US\http.sys.mui
2012-07-23 14:54 . 2012-04-06 20:33 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-23 14:54 . 2012-04-06 20:33 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-23 05:35 . 2012-07-23 05:35 52736 ----a-w- c:\windows\apppatch\iebrshim.dll
2012-07-23 05:10 . 2012-07-23 05:10 5632 ----a-w- c:\windows\system32\drivers\en-US\sermouse.sys.mui
2012-07-23 05:10 . 2012-07-23 05:10 4608 ----a-w- c:\windows\system32\drivers\en-US\mouclass.sys.mui
2012-07-23 05:10 . 2012-07-23 05:10 4608 ----a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
2012-07-23 05:10 . 2012-07-23 05:10 3072 ----a-w- c:\windows\system32\drivers\en-US\mouhid.sys.mui
2012-07-23 05:10 . 2012-07-23 05:10 3072 ----a-w- c:\windows\system32\drivers\en-US\kbdhid.sys.mui
2012-07-23 05:10 . 2012-07-23 05:10 10752 ----a-w- c:\windows\system32\drivers\en-US\i8042prt.sys.mui
2012-07-23 05:07 . 2012-07-23 05:07 40960 ----a-w- c:\windows\apppatch\apihex86.dll
2012-07-14 00:17 . 2012-07-23 14:29 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2006-12-04 00:03 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2006-12-04 00:03 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-01-22 417792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HWSetup"="\HWSetup.exe hwSetUP" [X]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-06 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-06 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-06 81920]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2006-12-03 49168]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 413696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-19 861744]
"NDSTray.exe"="NDSTray.exe" [BU]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-23 438272]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-07 34352]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 411192]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-03-22 448632]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-05-22 538744]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-28 4472832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-03-22 1318816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-12-03 23:50 90112 ----a-w- c:\windows\System32\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 14:54]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\rick\AppData\Roaming\Mozilla\Firefox\Profiles\hbxovwj5.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-25 10:23
Windows 6.0.6000 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i???????72o ????c?@?c?x?c???c???
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(772)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infra.dll
.
Completion time: 2012-07-25 10:24:42
ComboFix-quarantined-files.txt 2012-07-25 15:24
.
Pre-Run: 82,944,954,368 bytes free
Post-Run: 82,944,315,392 bytes free
.
- - End Of File - - CA1CCA33FCE52CADBE9F91FD290FB522

#4 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 27 July 2012 - 02:02 AM

Hey TimmU. :)

If Firefox has only done that once I wouldn't be too worried. :thumbup:


Please run a free online scan with the ESET Online Scanner.
Note: You will need to use Internet Explorer for this scan.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start.
  • When asked, allow the ActiveX control to install.
  • Click Start.
  • Make sure that the option Remove found threats is unchecked and the option Scan unwanted applications is checked.
  • Click Scan.
    Wait for the scan to finish.
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#5 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 27 July 2012 - 09:37 AM

Hey The Dark Knight, thanks for your help!

I ran the ESET online scanner. I found a log in a place a bit different than the path you provided. This is where I found it:

C:\Program Files\ESET/EsetOnlineScanner\log.txt.


Anyway, the window that shows the scan results says: "No Threats Found"

And here is the log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK


...that's all it said

Thanks for your help. Please let me know next steps. Thanks!

Edited by TimmU, 27 July 2012 - 09:37 AM.


#6 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 27 July 2012 - 04:41 PM

Hello TimmU. :)

No problem. :thumbup:

Please do the following updates. Your Windows and Internet Explorer are out of date and by updating to the latest Service Packs you will minimise the risk of future infections through these security patches and fixes.

Service Pack 1 (SP1) is a very important update for Windows Vista as it provides many security patches and fixes to greatly decrease your chances of being infected! I highly recommend you install SP2.

Please open Internet Explorer and follow the instructions below to update Windows:

  • Go to this link: Windows Update
  • Download all the Critical updates, making sure you have selected Windows Vista SP1 and Internet Explorer 8.
  • Once they have been installed, please revisit Windows Update and select any further Critical updates, making sure you have selected Internet Explorer 9.
Note:
It will be necessary for you to restart the computer during the updates, and return to the Windows Update site several times before all critical updates are installed.

IMPORTANT: Please enable Automatic Updates under Start > Control Panel > Automatic Updates to ensure your Windows updates regularly. This is extremely important in ensuring you remain protected against vulnerabilities and infections.
=========

Next, your version of Adobe Reader is out of date. It could have security vulnerabilities, so please follow these instructions to update it:

  • Please go to Start>All Programs>Adobe Reader.
  • Open Adobe Reader and navigate to Help>Check for Updates.
  • Please follow the prompts to install the latest version.

Also, your version of Java is out of date. It's important to remove older versions of Java since it does not do so automatically and older versions can leave you vulnerable.

Please follow the instructions below to update Java:
  • Please go to the below link and download the latest Windows Vista version:
http://www.java.com/en/download/manual.jsp

  • Save it to your Desktop.
  • Please go to Start > Control Panel > Add Or Remove Programs.
  • Navigate to any versions of Java (J2SE Runtime Environment) you have installed. They will have this icon next to them: Posted Image
  • Select Remove.
  • Please double-click the installer and follow the prompts to install the latest version once all the previous versions have been successfully removed.
=========

In your next post please let me know if you encounter any issues performing these updates. :thumbup:

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#7 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 27 July 2012 - 08:03 PM

Hey The Dark Knight,

Java Update- Done

Adobe Reader Update - Done

Windows Automatic Updates : Was already done

Having trouble getting Service Pack 1. I download it, and install, and the installation is super quick (like 2 seconds literally, and the computer never restarts) - which is weird because the instructions says it might take 1 hour. But anyway, I restart the computer and there it is again, ready to install. I've done this several times and always the same result: service pack 1 says it is ready to be installed. not sure whats going on there

Also - I don't see any Internet Explorer updates available.

Thanks The Dark Knight!

#8 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 27 July 2012 - 08:21 PM

Hey TimmU. :)

The Internet Explorer updates will appear after Vista's SP1 is installed.

Please go to the following link to download an offline copy of the service pack. Because it is a large file it is possible that during the automatic process it didn't complete the download. Please give this a try instead:

http://www.microsoft...ails.aspx?id=30

Please let me know if SP1 still doesn't install. :thumbup:

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#9 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 27 July 2012 - 11:22 PM

Hey The Dark Knight!

So I was able to install SP1 from the link you provided. That was pretty cool. When I check for windows updates it states that "Windows is up to date".

I still don't see Internet Explorer update. Nor do I see SP2.

..Ready for next step. Thanks again!

#10 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 28 July 2012 - 01:28 AM

Hey TimmU. :)

Please go to this Microsoft link to download and install SP2:

http://windows.micro...vice-Pack-2-SP2

For Internet Explorer 9:

http://windows.micro...er/downloads/ie

Please let me know how those updates go. :thumbup:

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#11 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 28 July 2012 - 12:23 PM

Thanks The Dark Knight!

SP2 and IE9 are now installed.

Please let me know next steps. Thanks again!

#12 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 28 July 2012 - 05:57 PM

Hey TimmU. :)

Awesome!

A little housekeeping to uninstall ComboFix:

Please click Start>Run and copy/paste the following text, including the space between "ComboFix and "/uninstall", into the Run box and click OK:

ComboFix /uninstall

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Right-click the Recycle Bin and please select Empty Recycle Bin.
==========

Please consider using these ideas to help secure your computer. While there is no way to guarantee safety when you use a computer, these steps will make it much less likely that you will need to endure another infection. While we really like to help people, we would rather help you protect yourself so that you won't need that help in the future. :thumbup:


IMPORTANT: Please enable Automatic Updates under Start > Control Panel > Automatic Updates to ensure your Windows updates regularly. This is extremely important in ensuring you remain protected against vulnerabilities and infections. This is a crucial security measure.

As a minimum, you need at least an antivirus, firewall and some type of anti-spyware program.

Please consider installing and running the following program (there is a free version available):

SpywareBlaster
A tutorial on using SpywareBlaster to prevent malware from ever installing on your computer may be found here.

Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster, can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you may be able to find out if it is a rogue here:

http://www.spywarewa...nti-spyware.htm

A similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.


Please consider using an alternate browser. Mozilla's Firefox browser is a very good alternative. In addition to being generally more secure than Internet Explorer, it has a very good built-in popup blocker and add-ons, like Adblock Plus, NoScript and Web of Trust, can make it even more secure. Google Chrome or Opera are other good options.

Please also read Tony Klein's excellent article: How did I get infected in the first place.

Hopefully these steps will help to keep you error free. If you run into more difficulty, we will certainly do what we can to help. :)

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#13 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 28 July 2012 - 10:15 PM

Thanks for the notes The Dark Knight,

1) I'm coming from Windows XP and "Run" was super easy to find there, and I'm having trouble finding it on Vista. From quick Google search it looks like Vista does not have Run. Not sure what to do here. Please let me know.

2) Can I run Adblock Plus, NoScript and Web of Trust on Firefox at the same time without interference?

3) I have McAfee Site Advisor which sounds similar to Web of Trust. If I try Web of Trust, should I disable McAfee Site Advisor?

4) In your opinion is this computer clean (no security threats)?

5) I see a couple of "Recommended" (as opposed to Critical) Windows Vista updates that show up on Windows update available for this computer. What should I do about these? Should I install them?

Thanks for your help The Dark Knight!

#14 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 28 July 2012 - 10:41 PM

Howdy TimmU. :)

For Vista, the Search box after opening the Start Menu is the equivalent of the Run box in XP. :thumbup:

You certainly can run Adblock Plus, WOT and NoScript all together. Adblock Plus will block most ads, WOT will give you an indication of how safe a site is and NoScript will block any running scripts on a webpage.

McAfee Site Advisor is similar to WOT. You can choose to continue with just this one, or alternatively you could use both. Up to you. :)

The logs you provided do not indicate any threats are present.

Often there are some updates that are only Recommended. If they are security patches or for Office I recommend installing them. :thumbup:

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#15 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 28 July 2012 - 10:53 PM

Hello again TimmU. :)

Just to confirm, you are using McAfee as your antivirus? It just doesn't appear active in the logs.

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#16 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 28 July 2012 - 11:06 PM

Hey The Dark Knight,

I've cleaned up Combofix as per your instructions. And thanks for your answers.

And yes, I am running McAfee as my antivirus. I've double checked at Windows Security Center just to make sure, and sure enough it shows it as my antivirus and turned on. That's weird that it doesn't show up...

#17 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 29 July 2012 - 01:25 AM

Hi TimmU. :)

All good. :thumbup:

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#18 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 29 July 2012 - 08:24 AM

Awesome thanks a lot The Dark Knight.

I really appreciate your help. Have a good one!

#19 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 30 July 2012 - 02:36 AM

Glad we could help. :)

[Reopened]

Everyone else please begin a New Topic.

Edited by cnm, 30 July 2012 - 01:10 PM.

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#20 cnm

cnm

    Mother Lion of SWI

  • Retired Staff
  • PipPipPipPipPip
  • 25,317 posts

Posted 30 July 2012 - 01:09 PM

Reopened at request of topic owner.
Microsoft MVP Windows Security 2005-2006
How camest thou in this pickle? -- William Shakespeare:(1564-1616)
The various helper groups here
UNITE

#21 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 30 July 2012 - 03:15 PM

Thanks cnm! And thanks The Dark Knight!

On one of the logs you requested I see that it recommends to defrag soon. I remember someone here sent me a link for a defrag guide for XP once, and I wonder if there is a similar resource you know of that teaches how to do so for Vista. If not, that's cool. If yes, I'd appreciate you letting me know. Thanks a lot!

Also, download links for CCleaner and ATF Cleaner would be awesome. I had them on my old XP computer and I'm considering them for this Vista computer.

Thanks again The Dark Knight, I appreciate it!

#22 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 30 July 2012 - 05:44 PM

Hello TimmU. :)

To defrag Vista you can use the utility already installed:

http://windows.micro...-your-hard-disk

Alternatively you can use a free disk defragmenter like Defraggler or Auslogics Disk Defrag.
==========

For ATF Cleaner: http://www.atribune.org

For CCleaner: http://www.piriform.com/CCLEANER

Hope that helps. :thumbup:

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#23 TimmU

TimmU

    Advanced Member

  • Full Member
  • PipPipPip
  • 193 posts

Posted 30 July 2012 - 06:39 PM

Sweet. Thanks a lot Dark Knight, your awesome! :thumbsup:

#24 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 30 July 2012 - 08:28 PM

Glad I could be of some assistance. :)

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif


#25 The Dark Knight

The Dark Knight

    The Magician

  • Trusted Advisor*
  • PipPipPipPipPip
  • 2,263 posts

Posted 22 August 2012 - 07:08 PM

Glad we could help. :)

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

If you make yourself more than just a man, if you devote yourself to an ideal...you become something else entirely. A legend, Mr. Wayne, a legend!

If I have helped you please consider donating to help keep this forum running; see this topic for more details.

unite_zpse83e3a16.gif





Member of UNITE
Support SpywareInfo Forum - click the button