queenslander Posted April 30, 2013 Report Share Posted April 30, 2013 I ran the emergency kit yesterday and it found - c:\windows\system32\sub,mgf. There was a message that it could not be removed and to post in the support forum for help in removing it. help please. There were also two files (i forgot to write their names) that it was suggested that I submit them for analasys, which I did. Will you guys know it came from me, and will I get feedback on them. TIA Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted April 30, 2013 Report Share Posted April 30, 2013 Hello, queenslander All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread also read the Emsisoft Support Forums Terms of Use Link to comment Share on other sites More sharing options...
queenslander Posted May 2, 2013 Author Report Share Posted May 2, 2013 I downloaded the Emergency Kit, and when I tried to unzip I got this error message. Yet when I looked at the Properties it showed this:- This 74yr old pensioner is now confused and lost, and doesn't know what to do. All help will be much appreciated. It will be tomorrow before I can come back here. Sorry for the trouble I'm causing. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 2, 2013 Report Share Posted May 2, 2013 Delete the copy of the Emergency Kit you downloaded and download a fresh copy. Link to comment Share on other sites More sharing options...
queenslander Posted May 3, 2013 Author Report Share Posted May 3, 2013 These are the reports requested. And the file in my original post did not appear in the list of files found?? Many thanks for ongoing assistance. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 3, 2013 Report Share Posted May 3, 2013 Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. NOT supported for use in 9x or MEUpgrading Java: Download the latest version of JRE 7 Update 21. Click the "Download JRE" button to the right. Accept the license agreement. Click on the download link for your system and save it to your desktop.Windows x86 Offline (jre-7u21-windows-i586.exe) Close any programs you may have running - especially your web browser. Then from your desktop double-click on the download to install the newest version. Using Add or Remove Programs in the Control Panel; uninstall the following: Java(TM) 6 Update 31 J2SE Runtime Environment 5.0Run OTL.exeCopy & paste the entire contents of OTLfix.txt (ATTACHED BELOW) into the Custom Scans/Fixes box located at the bottom of OTL.NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Attach the new log produced by OTL (C:\_OTL). (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS) Let me know of any problems you may have encountered with the above instructions and also let my know how things are running. Link to comment Share on other sites More sharing options...
queenslander Posted May 4, 2013 Author Report Share Posted May 4, 2013 All went well until I tried to attach C:\_OTL I did a "Send to" to send it to My Documents. There's a folder there called OTL and when I open it there's another folder called "Moved Files". Open that and there's another folder 05042013 130221 and a text document 05042013 130221. I'm assuming that it is the text document that you want, but when I try to attach it there is an error message "Error No file was selected for upload." Clicking on the Moved file folder shows as per the attached file, and I have no idea what to do with that, or how to get the OTL file to you Trust me to stuff things up! Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 4, 2013 Report Share Posted May 4, 2013 Copy & paste the contents of the 05042013 130221 text file to your reply. Link to comment Share on other sites More sharing options...
queenslander Posted May 5, 2013 Author Report Share Posted May 5, 2013 Done. Computer running marginally quicker, but that could be due to 1. phone line problems in recent days. Telco says they are all fixed now 2. probably need to clean up the old machine. All processes killed========== OTL ==========Service Yontoo Desktop Updater stopped successfully!Service Yontoo Desktop Updater deleted successfully!File File not found not found.Service WMPNetworkSvc stopped successfully!Service WMPNetworkSvc deleted successfully!File File not found not found.Service WDICA stopped successfully!Service WDICA deleted successfully!File File not found not found.Service SASENUM stopped successfully!Service SASENUM deleted successfully!File C:\Program Files\SUPERAntiSpyware\SASENUM.SYS File not found not found.Service PDRFRAME stopped successfully!Service PDRFRAME deleted successfully!File File not found not found.Service PDRELI stopped successfully!Service PDRELI deleted successfully!File File not found not found.Service PDFRAME stopped successfully!Service PDFRAME deleted successfully!File File not found not found.Service PDCOMP stopped successfully!Service PDCOMP deleted successfully!File File not found not found.Service PCIDump stopped successfully!Service PCIDump deleted successfully!File File not found not found.Service lbrtfdc stopped successfully!Service lbrtfdc deleted successfully!File File not found not found.Service i2omgmt stopped successfully!Service i2omgmt deleted successfully!File File not found not found.Service Changer stopped successfully!Service Changer deleted successfully!File File not found not found.Service BDRsDrv stopped successfully!Service BDRsDrv deleted successfully!File C:\Program Files\Softwin\BitDefender10\bdrsdrv.sys File not found not found.Service BDFsDrv stopped successfully!Service BDFsDrv deleted successfully!File C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys File not found not found.Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Family Tree Builder Installer deleted successfully.Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616}C:\WINDOWS\Downloaded Program Files\DivXPlugin.inf moved successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WPDShServiceObj deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}\ not found.D:\Autorun.inf moved successfully.C:\WINDOWS\msdownld.tmp folder deleted successfully.Unable to delete ADS C:\Documents and Settings\HP_Administrator\My Documents\ZippedVideoCameraDriver.zip: SummaryInformation .========== FILES ==========C:\WINDOWS\system32\sub.mgf moved successfully.========== COMMANDS ========== [EMPTYTEMP] User: Administrator->Temp folder emptied: 728073 bytes->Temporary Internet Files folder emptied: 517316 bytes User: All Users User: Default User->Temp folder emptied: 18150 bytes->Temporary Internet Files folder emptied: 32768 bytes->Flash cache emptied: 84 bytes User: HP_Administrator->Temp folder emptied: 273907 bytes->Temporary Internet Files folder emptied: 5894458 bytes->Java cache emptied: 109193855 bytes->FireFox cache emptied: 504850950 bytes->Flash cache emptied: 31891 bytes User: LocalService->Temp folder emptied: 65984 bytes->Temporary Internet Files folder emptied: 2936317 bytes User: NetworkService->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33170 bytes User: UpdatusUser->Temp folder emptied: 18150 bytes->Temporary Internet Files folder emptied: 32768 bytes->Flash cache emptied: 84 bytes %systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 0 bytes%systemroot%\System32 .tmp files removed: 0 bytes%systemroot%\System32\dllcache .tmp files removed: 0 bytes%systemroot%\System32\drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 0 bytes%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 283900982 bytes%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytesRecycleBin emptied: 150793754 bytes Total Files Cleaned = 1,010.00 mb [EMPTYFLASH] User: Administrator User: All Users User: Default User->Flash cache emptied: 0 bytes User: HP_Administrator->Flash cache emptied: 0 bytes User: LocalService User: NetworkService User: UpdatusUser->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb [EMPTYJAVA] User: Administrator User: All Users User: Default User User: HP_Administrator->Java cache emptied: 0 bytes User: LocalService User: NetworkService User: UpdatusUser Total Java Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 05042013_130221 Files\Folders moved on Reboot...C:\Documents and Settings\HP_Administrator\Local Settings\Temp\Word8.0\MSForms.exd moved successfully.File\Folder C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF6372.tmp not found!File\Folder C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF940.tmp not found!File\Folder C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DFB9C.tmp not found!C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~WRD0001.doc moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~WRF0000.tmp moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\JGHUI74T\BFYYPB1F\Offline\0x00000001_R moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\JGHUI74T\BFYYPB1F\Offline\0x00000003_R moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\JGHUI74T\BFYYPB1F\Offline\HashFile.dat moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\10955CC2.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\1CC9B96C.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\58795A20.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\697D01DB.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\6DC4E693.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\8B394778.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\9B99652E.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\A53253A1.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\BA1B8A1F.jsp moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\C3879E5A.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\DF1A7119.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\E6987757.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\E8D8B446.wmf moved successfully.C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\F1AB727D.wmf moved successfully.File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot. PendingFileRenameOperations files... Registry entries deleted on Reboot... Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 5, 2013 Report Share Posted May 5, 2013 Download ComboFix from LinkSave as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop!!! IMPORTANT !!! Save ComboFix to your DesktopNOTE: ComboFix is an advanced utility, and is not like traditional automated tools. It will delete anything that it knows is bad without asking for confirmation, it will save backup copies in it's quarantine automatically, it will restart your computer, and it will produce a log that allows me to analyze and determine if there is anything left over. This log will not contain any personal information, or information about any of your documents, pictures, music, videos, etc. It only compiles information on which applications/drivers/etc were installed within the last 30 days, any applications that have certain properties that could be used for malicious purposes, and most of the load points on your system that can be abused by malicious software. If there is a false positive, and something gets deleted that should not, then I can write a script for ComboFix that will tell it to restore specific items that it deleted. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our toolsSee HERE for help Double click on Combo-Fix & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **NOTE: (This applies to Windows XP systems only) If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware.When finished, ComboFix will produce a log.NOTE:1. Do not mouseclick combofix's window while it's running. That may cause it to stall!2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.Attach logs for: (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS) ComboFix (C:\combofix.txt)Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now! Link to comment Share on other sites More sharing options...
queenslander Posted May 5, 2013 Author Report Share Posted May 5, 2013 Combofix log, as requested. Gee I'm glad that you know what it all means OA Premium said Combofix want to be added to the Autoruns. I said "Yes" - is that OK? Using the Main Forum as a measure, not running any faster ComboFix 13-05-04.01 - HP_Administrator 05/05/2013 16:31:38.1.2 - x86Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.2046.1180 [GMT 10:00]Running from: c:\documents and settings\HP_Administrator\Desktop\EEK\Combo-Fix.exeAV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}FW: Online Armor Firewall *Enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\documents and settings\Administrator\WINDOWSc:\documents and settings\All Users\Application Data\TEMPc:\documents and settings\Default User\WINDOWSc:\documents and settings\HP_Administrator\WINDOWSc:\documents and settings\UpdatusUser\WINDOWSc:\program files\xp-AntiSpyc:\program files\xp-AntiSpy\Uninstall.exec:\program files\xp-AntiSpy\xp-AntiSpy.chmc:\program files\xp-AntiSpy\xp-AntiSpy.exec:\program files\xp-AntiSpy\xp-AntiSpy.urlc:\windows\system32\config\systemprofile\WINDOWSc:\windows\system32\FF05DA0D.dllc:\windows\system32\ps2.batc:\windows\system32\URTTempc:\windows\system32\URTTemp\fusion.dllc:\windows\system32\URTTemp\mscoree.dllc:\windows\system32\URTTemp\mscoree.dll.localc:\windows\system32\URTTemp\mscorsn.dllc:\windows\system32\URTTemp\mscorwks.dllc:\windows\system32\URTTemp\msvcr71.dllc:\windows\system32\URTTemp\regtlib.exe..((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))..-------\Service_usnjsvc..((((((((((((((((((((((((( Files Created from 2013-04-05 to 2013-05-05 )))))))))))))))))))))))))))))))..2013-05-04 03:02 . 2013-05-04 03:02 -------- d-----w- C:\_OTL2013-05-04 02:48 . 2013-05-04 02:48 866720 ----a-w- c:\windows\system32\npDeployJava1.dll2013-05-04 02:48 . 2013-05-04 02:48 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll2013-05-04 02:47 . 2013-05-04 02:47 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee2013-04-26 06:14 . 2013-03-06 23:33 368176 ----a-w- c:\windows\system32\drivers\aswSP.sys2013-04-26 06:14 . 2013-03-06 23:33 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys2013-04-26 06:14 . 2013-03-06 23:33 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys2013-04-26 06:13 . 2013-03-06 23:33 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys2013-04-26 06:13 . 2013-03-06 23:33 62376 ----a-w- c:\windows\system32\drivers\aswTdi.sys2013-04-26 06:13 . 2013-03-06 23:33 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys2013-04-26 06:13 . 2013-03-06 23:33 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys2013-04-26 06:13 . 2013-03-06 23:33 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys2013-04-26 06:12 . 2013-03-06 23:32 41664 ----a-w- c:\windows\avastSS.scr2013-04-26 00:21 . 2013-04-26 00:21 -------- d-----w- c:\windows\system32\wbem\Repository2013-04-26 00:15 . 2013-04-26 00:15 -------- d-----w- C:\Driver2013-04-26 00:15 . 2013-04-26 00:16 -------- d-----w- c:\program files\Common Files\Ulead Systems2013-04-26 00:15 . 2013-04-26 00:15 -------- d-----w- c:\program files\Ulead Systems2013-04-26 00:15 . 2013-04-26 00:28 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Yontoo2013-04-26 00:15 . 2013-04-26 00:15 -------- d-----w- c:\program files\Yontoo2013-04-26 00:14 . 2013-04-26 00:14 -------- d-----w- c:\windows\system32\searchplugins2013-04-26 00:14 . 2013-04-26 00:14 -------- d-----w- c:\windows\system32\Extensions2013-04-23 02:56 . 2013-04-26 00:15 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Foxit Software2013-04-23 02:56 . 2013-04-23 02:56 -------- d-----w- c:\program files\Foxit Software...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-05-04 02:48 . 2012-04-21 03:44 788896 ----a-w- c:\windows\system32\deployJava1.dll2013-05-04 02:48 . 2012-04-21 03:44 144896 ----a-w- c:\windows\system32\javacpl.cpl2013-03-06 23:32 . 2013-03-04 03:12 228600 ----a-w- c:\windows\system32\aswBoot.exe2012-12-28 01:52 . 2012-03-02 03:21 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]@="{472083B0-C522-11CF-8763-00608CC02F24}"[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]2013-03-06 23:32 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Yontoo Desktop"="c:\documents and settings\HP_Administrator\Application Data\Yontoo\YontooDesktop.exe" [2013-03-06 42784].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]"PinnacleDriverCheck"="c:\windows\system32\\PSDrvCheck.exe" [2004-03-10 406016]"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2012-10-03 2415104]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-29 15494464]"NvMediaCenter"="NvMCTray.dll" [2012-02-29 108352]"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-02-29 1634112]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-10-11 98304]"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304].c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\Samsung Auto Backup Guage.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFGuage.exe [2011-6-17 823296]Samsung Auto Backup Real-Time Daemon.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2011-6-17 65536]Samsung Auto Backup Scheduler.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFTimerD.exe [2011-6-17 102400].[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2012-10-03 366440]"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024].[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\program files\iolo\System Mechanic 4".[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]@="".[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnkbackup=c:\windows\pss\Exif Launcher.lnkCommon Startup.[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnkbackup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup.[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnkbackup=c:\windows\pss\Microsoft Office.lnkCommon Startup.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]2005-05-04 01:43 69632 ----a-w- c:\windows\ALCMTR.EXE.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]2005-08-02 13:19 77312 ----a-w- c:\windows\arpwrmsg.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]2005-08-05 10:56 64512 ----a-w- c:\windows\ehome\ehtray.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]2010-06-09 10:55 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]2005-06-02 06:35 49152 ----a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]1998-05-07 16:04 52736 ----a-w- c:\windows\system\hpsysdrv.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]2004-08-10 11:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]2005-05-04 14:21 278528 ----a-w- c:\program files\iTunes\iTunesHelper.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]2005-05-11 00:50 253952 ----a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]2004-08-10 11:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]2012-02-29 20:30 15494464 ----a-w- c:\windows\system32\nvcpl.dll.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]2004-08-10 11:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]2004-08-10 11:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]2004-04-14 20:43 233472 ----a-w- c:\windows\SMINST\Recguard.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]2002-02-04 12:32 53248 ----a-w- c:\program files\REGSHAVE\Regshave.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]2004-12-13 15:23 663552 ----a-w- c:\windows\CREATOR\Remind_XP.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]2005-06-08 21:42 14565376 ----a-w- c:\windows\RTHDCPL.EXE.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]2005-10-11 06:39 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0).[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"="c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"="c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"="c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"="c:\\Program Files\\Adobe\\Photoshop Elements 4.0\\AdobePhotoshopElementsMediaServer.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\MSN Messenger\\msnmsgr.exe"="c:\\Program Files\\MSN Messenger\\livecall.exe"="c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=.R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [26/04/2013 4:13 PM 49248]R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [26/04/2013 4:13 PM 765736]R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26/04/2013 4:14 PM 368176]R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [11/10/2006 4:08 PM 4064]R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;c:\windows\system32\drivers\hcw88aud.sys [11/10/2005 4:19 PM 11970]R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [3/08/2009 11:55 AM 208320]R1 oahlpXX;Online Armor helper driver;c:\windows\system32\drivers\oahlp32.sys [20/09/2010 3:08 PM 44992]R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [3/08/2009 11:55 AM 27648]R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [3/08/2009 11:55 AM 31920]R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/07/2011 2:27 AM 12880]R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [13/07/2011 7:55 AM 67664]R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [12/08/2011 9:38 AM 116608]R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26/04/2013 4:14 PM 29816]R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [26/04/2013 4:13 PM 66336]R2 BrowserProtect;BrowserProtect;c:\documents and settings\All Users\Application Data\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [27/04/2013 11:14 AM 2569168]R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [3/08/2009 11:55 AM 216072]R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\OAsrv.exe [19/09/2011 11:47 AM 4463864]R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;c:\windows\system32\drivers\hcw88bda.sys [11/10/2005 4:19 PM 133696]R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;c:\windows\system32\drivers\hcw88tse.sys [11/10/2005 4:19 PM 296515]R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;c:\windows\system32\drivers\hcw88tun.sys [11/10/2005 4:19 PM 140865]R3 hcw88vid;Hauppauge WinTV 88x Video;c:\windows\system32\drivers\hcw88vid.sys [11/10/2005 4:19 PM 613204]R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;c:\windows\system32\drivers\hcw88bar.sys [11/10/2005 4:19 PM 30528]S3 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [26/04/2013 4:13 PM 164736]S3 SDVC05;USB SDVC05;c:\windows\system32\drivers\SDVC05.sys [18/03/2006 10:39 AM 18088].[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]2008-08-22 04:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe.Contents of the 'Scheduled Tasks' folder.2013-05-05 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 04:18].2013-05-05 c:\windows\Tasks\avast! Emergency Update.job- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-04-26 23:32].2006-04-09 c:\windows\Tasks\Easy Internet Sign-up.job- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-05-24 06:46].2013-05-05 c:\windows\Tasks\Google Software Updater.job- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-19 03:55].2013-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-08 14:49].2013-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-08 14:49].2013-05-04 c:\windows\Tasks\OGADaily.job- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04].2013-05-05 c:\windows\Tasks\OGALogon.job- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04].2013-05-05 c:\windows\Tasks\User_Feed_Synchronization-{544A588C-2ADA-42F4-A6D0-B0F583251023}.job- c:\windows\system32\msfeedssync.exe [2009-03-07 18:31]..------- Supplementary Scan -------.uStart Page = about:blankuDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_AU&c=Q405&bd=pavilion&pf=desktopuSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_AU&c=Q405&bd=pavilion&pf=desktopuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000TCP: Interfaces\{DE35CCC2-20D1-40DE-8806-54D8B888379D}: NameServer = 10.0.0.138FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\xycyw5aw.default\FF - prefs.js: browser.search.selectedEngine - Delta SearchFF - prefs.js: browser.startup.homepage - hxxp://go.bigpond.com/home/index.jspFF - user.js: extensions.delta.tlbrSrchUrl -FF - user.js: extensions.delta.id - 8ccd12370000000000000013d4d5e602FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}FF - user.js: extensions.delta.instlDay - 15772FF - user.js: extensions.delta.vrsn - 1.8.10.0FF - user.js: extensions.delta.vrsni - 1.8.10.0FF - user.js: extensions.delta.vrsnTs - 1.8.10.019:29FF - user.js: extensions.delta.prtnrId - deltaFF - user.js: extensions.delta.prdct - deltaFF - user.js: extensions.delta.aflt - babsstFF - user.js: extensions.delta.smplGrp - noneFF - user.js: extensions.delta.tlbrId - baseFF - user.js: extensions.delta.instlRef - sstFF - user.js: extensions.delta.dfltLng - enFF - user.js: extensions.delta.excTlbr - falseFF - user.js: extensions.delta.admin - falseFF - user.js: extensions.delta.autoRvrt - falseFF - user.js: extensions.delta.rvrt - falseFF - user.js: extensions.delta.newTab - false.- - - - ORPHANS REMOVED - - - -.HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre7\bin\jusched.exeMSConfigStartUp-nwiz - nwiz.exeMSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.5.0\bin\jusched.exeAddRemove-12133444-BF36-4d4e-B7FB-A3424C645DE4 - c:\program files\GemMaster\uninstallgemmaster.exeAddRemove-B3EE3001-DC24-4cd1-8743-5692C716659F - c:\program files\EnglishOtto\uninstallotto.exeAddRemove-HijackThis - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Temporary Directory 3 for HiJackThis.zip\HijackThis.exeAddRemove-NVIDIA nView Desktop Manager - c:\program files\NVIDIA Corporation\nView\nViewSetup.exeAddRemove-xp-AntiSpy - c:\program files\xp-AntiSpy\Uninstall.exe...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2013-05-05 16:46Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ....scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\S-1-5-21-614357371-1467982061-3277721984-1007\Software\Microsoft\SystemCertificates\AddressBook*]@Allowed: (Read) (RestrictedCode)@Allowed: (Read) (RestrictedCode).--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'explorer.exe'(3408)c:\windows\system32\WININET.dllc:\program files\NVIDIA Corporation\nView\nview.dllc:\windows\system32\ieframe.dllc:\windows\system32\webcheck.dll.------------------------ Other Running Processes ------------------------.c:\program files\AVAST Software\Avast\AvastSvc.exec:\program files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exec:\windows\arservice.exec:\windows\eHome\ehRecvr.exec:\windows\eHome\ehSched.exec:\program files\Java\jre7\bin\jqs.exec:\program files\Common Files\LightScribe\LSSrvc.exec:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exec:\windows\system32\nvsvc32.exec:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exec:\windows\system32\dllhost.exec:\windows\system32\RunDLL32.exec:\windows\system32\rundll32.exec:\program files\Tall Emu\Online Armor\OAhlp.exe.**************************************************************************.Completion time: 2013-05-05 16:55:01 - machine was rebootedComboFix-quarantined-files.txt 2013-05-05 06:54.Pre-Run: 91,124,756,480 bytes freePost-Run: 90,944,131,072 bytes free.- - End Of File - - 07D637BDAC706467027F157B382E3DDC Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 5, 2013 Report Share Posted May 5, 2013 I only asked you to copy & paste a log once. Attach your logs, unless I ask you to do otherwise. Read carefully and follow these steps. Download TDSSKiller and save it to your Desktop. Double-click on TDSSKiller.exe to run the application. Click Change parameters Check the boxes next to Verify Driver Digital Signature and Detect TDLFS file system, then click OK Click on the Start Scan button to begin the scan and wait for it to finish.NOTE: Do not use the computer during the scan! During the scan it will look similar to the image below: When it finishes, you will either see a report that no threats were found like below:If no threats are found at this point, just click the Report selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved. If any infection or suspected items are found, you will see a window similar to below:If you have files that are shown to fail signature check do not take any action on these. Make sure you select Skip. I will tell you what to do with these later. They may not be issues at all. If Suspicious objects are detected, the default action will be Skip. Leave the default set to Skip. If Malicious objects are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects Make sure that Cure is selected. Important! - If Cure is not available, please choose Skip instead. Do not choose Delete unless instructed to do so. [*]Click Continue to apply selected actions. [*]A reboot may be required to complete disinfection. A window like the below will appear:Reboot immediately if TDSSKiller states that one is needed. [*]Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. [*]Attach this log to your next reply. Link to comment Share on other sites More sharing options...
queenslander Posted May 6, 2013 Author Report Share Posted May 6, 2013 Sorry about pasting mate. This was my first port of call today. I got interupted and had to log off. When I came back, the screenshots TDSS.3, .5, and .7 wouldn't load. Anyway, I copied your post to a Word file to have it handy to refer to if needed. All the .png shots appeared in the Word file. Weird? TDSSKiller ran successfully, with 14 suspicious files found I also said "Yes" to TDSS being added to the Autoruns. Is that OK? And keep getting the window attached (called Warning) about leaving a secure site. Can I set that to "Ignore" with safety? Log dutifully attached Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 6, 2013 Report Share Posted May 6, 2013 The Unsigned files showing in the TDSSKiller log are nothing to be concerned. Run a fresh scan with OTL, attach the new OTL log to your reply. Link to comment Share on other sites More sharing options...
queenslander Posted May 7, 2013 Author Report Share Posted May 7, 2013 OTL scan with no changes in the settings Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 7, 2013 Report Share Posted May 7, 2013 Run OTL.exe Copy & paste the entire contents of OTLfix.txt (ATTACHED BELOW) into the Custom Scans/Fixes box located at the bottom of OTL.NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Attach the new log produced by OTL (C:\_OTL). (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS) Let me know of any problems you may have encountered with the above instructions and also let my know how things are running. Link to comment Share on other sites More sharing options...
queenslander Posted May 8, 2013 Author Report Share Posted May 8, 2013 File attached. This forum not any quicker. After each internet session I run CCleaner to remove Internet cookies and temp files and System temp files. Is this having a negtive effect on anything? I really appreciate all your ongoing help, and especially patience Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 8, 2013 Report Share Posted May 8, 2013 Running CCleaner after every net session is a little excessive, but won't harm anything. Let's double check. Run a fresh scan with OTL, attach the new OTL log to your reply. Link to comment Share on other sites More sharing options...
queenslander Posted May 9, 2013 Author Report Share Posted May 9, 2013 Done. To keep things the same, after logging off I ran CCleaner again before running OTL. I happened to notice that during the scan it showed a scan of Yontoo, which I thought I had used Remove Programs to get rid of it. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 9, 2013 Report Share Posted May 9, 2013 Download AdwCleaner and save it on your desktop. Close all open programs and internet browsers (you may want to print our or write down these instructions first). Double click on adwcleaner.exe to run the tool. Click on Delete. Confirm each time with Ok. You will be prompted to restart your computer. A text file will open n Notepad after the restart (this is the log of what was removed), which you can save on your desktop. Attach that log file to a reply by clicking the More Reply Options button to the lower-right of where you type in your reply. If you lose that log file for any reason, you can find it at C:\AdwCleaner[s1] on your computer. Download Junkware Removal Tool and save it on your desktop. Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts. Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator. The tool will open and start scanning your system. Please be patient as this can take a while to complete depending on your system's specifications. On completion, a log is saved to your desktop and will automatically open. Attach the JRT log file to a reply by clicking the More Reply Options button to the lower-right of where you type in your reply. Link to comment Share on other sites More sharing options...
queenslander Posted May 11, 2013 Author Report Share Posted May 11, 2013 Just a quick note Kevin. It's Mother's Day on Sunday here in Aus, and offspring have turned up to surprise Mum, so will be busy entertaining. I'll run the programs as soon as I can. Appologies for the delay. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 11, 2013 Report Share Posted May 11, 2013 No problem Link to comment Share on other sites More sharing options...
queenslander Posted May 13, 2013 Author Report Share Posted May 13, 2013 Files from ADW and JRT attached. This thread no quicker to open from IE favourites link. Edit Having said that, the main and other forums are much quicker Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 13, 2013 Report Share Posted May 13, 2013 The longer the thread gets the longer it takes to open. Run a fresh scan with OTL, attach the new OTL log to your reply. Link to comment Share on other sites More sharing options...
queenslander Posted May 14, 2013 Author Report Share Posted May 14, 2013 It's old age that made me label the OTL file as May19 instead of May14, well that's my excuse OTL run without a CCleaner run this time. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 14, 2013 Report Share Posted May 14, 2013 Your OTL log looks fine. How are things running? Link to comment Share on other sites More sharing options...
queenslander Posted May 15, 2013 Author Report Share Posted May 15, 2013 Still running slowly most of the time with the occassional web site being OK. I don't know if there is any significance - in the past, a site wouldn't load until the IE link was clicked a second time, or alternatively the Refresh button. The last two days this has happend more often. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 15, 2013 Report Share Posted May 15, 2013 Download avz4.zip from here Unzip it to your desktop to a folder named avz4 Double click on AVZ.exe to run it. Run an update by clicking the Auto Update button on the Right of the Log window: Click Start to begin the update Note: If you receive an error message, chose a different source, then click Start again After the update, from the "File" menu, choose "Standard Scripts" Put a check next to item 2: Advanced System Analysis Click Execute selected scripts At the next prompt, click the OK button Let the scan run and click "OK" when the completion prompt pops up Now Close out of the Standard Scripts window, and exit AVZ Navigate to the avz4 folder and locate the folder LOG Inside the LOG folder you will find virusinfo_syscheck.htm, virusinfo_syscheck.htm and virusinfo_syscheck.zip Attach the Compressed file, virusinfo_syscheck.zip, to your next reply. Link to comment Share on other sites More sharing options...
queenslander Posted May 16, 2013 Author Report Share Posted May 16, 2013 I hope that I got this attchment right Kevin as the zip icon didn't show on the "Log" folder when I browsed to it. Edit I tried to clear the wrong file, but it wouldn't go away. Appologies for the stuff up. It's as they say RTBI, - as in Read The Bloody Instructions. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 16, 2013 Report Share Posted May 16, 2013 Your logs aren't showing any malware. This could be a software conflict. Might be between Avast and OA. Disable OA a see if that makes a difference. Link to comment Share on other sites More sharing options...
queenslander Posted May 17, 2013 Author Report Share Posted May 17, 2013 Wow, OA disabled and it made a HUGE difference to the speed on internet loading. superxv.com was as painfully slow as a dial up connection, now it comes up in no time. I am reluctant to add Avast to OA exceptions as I am given to understand that doing so negates Banking Mode. Would adding OA to Avast exceptions do the same? Edit: So,this technically challenged and cowardly old fart took the bull by the horns and excluded OA in Avast and Avast in OA. It did make some difference to the speed (roughly half as quick), but not as much as disabling OA Link to comment Share on other sites More sharing options...
queenslander Posted May 17, 2013 Author Report Share Posted May 17, 2013 Another edit. I removed Avast from the OA exclusions and it all slowed down again, although not as much as removing the OA exclusion in Avast and having no exclusions in either. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 17, 2013 Report Share Posted May 17, 2013 You are going to get some slow down, caused by the firewall, as all incoming packets are analyzed. You can use the built in Windows Firewall, however it is not nearly as robust as OA. Link to comment Share on other sites More sharing options...
queenslander Posted May 18, 2013 Author Report Share Posted May 18, 2013 Do you have any ideas about where the OAP/Avast conflict is, and is there a workaround? I have done a search on Avast forum, but nothing came up. Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 18, 2013 Report Share Posted May 18, 2013 Excluding OA processes & services in Avast and vice versa, should help. The conflict is probably coming from the behavior blocker. Link to comment Share on other sites More sharing options...
queenslander Posted May 19, 2013 Author Report Share Posted May 19, 2013 Does Behaviour Shield do anything that OAP doesn't do, if I disable it as I don't understand the posts at this thread in the Avast forum. http://forum.avast.com/index.php?topic=96711.0 Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 19, 2013 Report Share Posted May 19, 2013 The Behavior Shield is what provides the Heuristic detections. Disabling it will actually reduce the effectiveness of Avast. Link to comment Share on other sites More sharing options...
queenslander Posted May 20, 2013 Author Report Share Posted May 20, 2013 Ok, thanks Kevin. It seems like we are done now, so once again many thanks for all your invaluable help and patience with me. Above and beyond the call of duty I reckon Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 20, 2013 Report Share Posted May 20, 2013 Unless you are having problems, it is time to do the final steps. Now to remove most of the tools that we have used in fixing your machine: Press the Windows key + R and this will open the Run text box. Copy/paste the following text into the Run box as shown and click OK. Combofix /Uninstall (Note: There is a space between the ..X and the /U that needs to be there.) Clean up with OTL: Double-click OTL.exe to start the program. Close all other programs apart from OTL as this step will require a reboot On the OTL main screen, press the CLEANUP button Say Yes to the prompt and then allow the program to reboot your computer. Delete the following from your Desktop: (If they exist) AdwCleaner.exe CFscript.txt JRT.exe JRT.txt TDSSKiller.exe Anything else I had you use Delete the following files: (If they exist) C:\ComboFix.txt Delete the following folders: (If they exist) C:\AdwCleaner[s1] C:\ComboFix C:\Qoobox C:\TDSSKiller_Quarantine Empty the Recycle Bin Download to your Desktop: - CCleaner Portable UnZip CCleaner Portable to a folder on your Desktop named CCleanerRun CCleanerOpen the CCleaner Folder on your Desktop and double click CCleaner.exe (32-bit) or CCleaner64.exe (64-bit) The following should be selected by default, if not, please select: Click and choose Uncheck Then go back to and click to run it. Exit CCleaner. Turn off System restore to flush all your restore points then turn system restore back on. See How To Enable and Disable System Restore. You can delete and uninstall any programs I had you download, that you do not wish to keep on the system. Run Windows Update and update your Windows Operating System. Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated. Articles to read: How to Protect Your Computer From Malware How to keep you and your Windows PC happy Web, email, chat, password and kids safety 10 Sources of Malware Infections That should take care of everything. Safe Surfing! Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted May 23, 2013 Report Share Posted May 23, 2013 Thread Closed Reason: Resolved The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread. Link to comment Share on other sites More sharing options...
Recommended Posts