sub.mgf

[queenslander]

I ran the emergency kit yesterday and it found - c:\windows\system32\sub,mgf.

 

There was a message that it could not be removed and to post in the support forum for help in removing it.

 

help please.

 

There were also two files (i forgot to write their names) that it was suggested that I submit them for analasys, which I did.

Will you guys know it came from me, and will I get feedback on them.

 

TIA

[ShadowPuterDude]

Hello, queenslander

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread also read the Emsisoft Support Forums Terms of Use

[queenslander]

I downloaded the Emergency Kit, and when I tried to unzip I got this error message.

 

 

Yet when I looked at the Properties it showed this:-

 

 

This 74yr old pensioner is now confused and lost, and doesn't know what to do.

 

All help will be much appreciated.

 

It will be tomorrow before I can come back here. Sorry for the trouble I'm causing.

[ShadowPuterDude]

Delete the copy of the Emergency Kit you downloaded and download a fresh copy.

[queenslander]

These are the reports requested. And the file in my original post did not appear in the list of files found??

 

Many thanks for ongoing assistance.

[ShadowPuterDude]

   Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. NOT supported for use in 9x or ME

Upgrading Java:

• Download the latest version of JRE 7 Update 21.
• Click the "Download JRE" button to the right.
• Accept the license agreement.
• Click on the download link for your system and save it to your desktop.
  

  Windows x86 Offline (jre-7u21-windows-i586.exe)

• Close any programs you may have running - especially your web browser.
• Then from your desktop double-click on the download to install the newest version.

Using Add or Remove Programs in the Control Panel; uninstall the following:

Java(TM) 6 Update 31
J2SE Runtime Environment 5.0

Run OTL.exe

• Copy & paste the entire contents of OTLfix.txt (ATTACHED BELOW) into the Custom Scans/Fixes box located at the bottom of OTL.
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Attach the new log produced by OTL (C:\_OTL). (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS)

Let me know of any problems you may have encountered with the above instructions and also let my know how things are running.

 

[queenslander]

All went well until I tried to attach C:\_OTL

 

I did a "Send to" to send it to My Documents.

There's a folder there called OTL and when I open it there's another folder called "Moved Files".

Open that and there's another folder 05042013 130221 and a text document  05042013 130221.

 

I'm assuming that it is the text document that you want, but when I try to attach it there is an error message "Error No file was selected for upload."

 

Clicking on the Moved file folder shows as per the attached file, and I have no idea what to do with that, or how to get the OTL file to you 

 

Trust me to stuff things up!

 

[ShadowPuterDude]

Copy & paste the contents of the 05042013 130221 text file to your reply.

[queenslander]

Done.

 

Computer running marginally quicker, but that could be due to

1. phone line problems in recent days. Telco says they are all fixed now

2. probably need to clean up the old machine.

 

 

All processes killed
========== OTL ==========
Service Yontoo Desktop Updater stopped successfully!
Service Yontoo Desktop Updater deleted successfully!
File   File not found not found.
Service WMPNetworkSvc stopped successfully!
Service WMPNetworkSvc deleted successfully!
File   File not found not found.
Service WDICA stopped successfully!
Service WDICA deleted successfully!
File   File not found not found.
Service SASENUM stopped successfully!
Service SASENUM deleted successfully!
File  C:\Program Files\SUPERAntiSpyware\SASENUM.SYS File not found not found.
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
File   File not found not found.
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
File   File not found not found.
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
File   File not found not found.
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
File   File not found not found.
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
File   File not found not found.
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
File   File not found not found.
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
File   File not found not found.
Service Changer stopped successfully!
Service Changer deleted successfully!
File   File not found not found.
Service BDRsDrv stopped successfully!
Service BDRsDrv deleted successfully!
File  C:\Program Files\Softwin\BitDefender10\bdrsdrv.sys File not found not found.
Service BDFsDrv stopped successfully!
Service BDFsDrv deleted successfully!
File  C:\Program Files\Softwin\BitDefender10\bdfsdrv.sys File not found not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Family Tree Builder Installer deleted successfully.
Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616}
C:\WINDOWS\Downloaded Program Files\DivXPlugin.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WPDShServiceObj deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}\ not found.
D:\Autorun.inf moved successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
Unable to delete ADS C:\Documents and Settings\HP_Administrator\My Documents\ZippedVideoCameraDriver.zip: SummaryInformation .
========== FILES ==========
C:\WINDOWS\system32\sub.mgf moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 728073 bytes
->Temporary Internet Files folder emptied: 517316 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 18150 bytes
->Temporary Internet Files folder emptied: 32768 bytes
->Flash cache emptied: 84 bytes
 
User: HP_Administrator
->Temp folder emptied: 273907 bytes
->Temporary Internet Files folder emptied: 5894458 bytes
->Java cache emptied: 109193855 bytes
->FireFox cache emptied: 504850950 bytes
->Flash cache emptied: 31891 bytes
 
User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 2936317 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: UpdatusUser
->Temp folder emptied: 18150 bytes
->Temporary Internet Files folder emptied: 32768 bytes
->Flash cache emptied: 84 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 283900982 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 150793754 bytes
 
Total Files Cleaned = 1,010.00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: HP_Administrator
->Flash cache emptied: 0 bytes
 
User: LocalService
 
User: NetworkService
 
User: UpdatusUser
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0.00 mb
 
 
[EMPTYJAVA]
 
User: Administrator
 
User: All Users
 
User: Default User
 
User: HP_Administrator
->Java cache emptied: 0 bytes
 
User: LocalService
 
User: NetworkService
 
User: UpdatusUser
 
Total Java Files Cleaned = 0.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 05042013_130221

Files\Folders moved on Reboot...
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\Word8.0\MSForms.exd moved successfully.
File\Folder C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF6372.tmp not found!
File\Folder C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF940.tmp not found!
File\Folder C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DFB9C.tmp not found!
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~WRD0001.doc moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~WRF0000.tmp moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\JGHUI74T\BFYYPB1F\Offline\0x00000001_R moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\JGHUI74T\BFYYPB1F\Offline\0x00000003_R moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\JGHUI74T\BFYYPB1F\Offline\HashFile.dat moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\10955CC2.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\1CC9B96C.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\58795A20.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\697D01DB.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\6DC4E693.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\8B394778.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\9B99652E.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\A53253A1.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\BA1B8A1F.jsp moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\C3879E5A.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\DF1A7119.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\E6987757.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\E8D8B446.wmf moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.MSO\F1AB727D.wmf moved successfully.
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[ShadowPuterDude]

Download ComboFix from Link

Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

!!! IMPORTANT !!! Save ComboFix to your Desktop

NOTE: ComboFix is an advanced utility, and is not like traditional automated tools. It will delete anything that it knows is bad without asking for confirmation, it will save backup copies in it's quarantine automatically, it will restart your computer, and it will produce a log that allows me to analyze and determine if there is anything left over. This log will not contain any personal information, or information about any of your documents, pictures, music, videos, etc. It only compiles information on which applications/drivers/etc were installed within the last 30 days, any applications that have certain properties that could be used for malicious purposes, and most of the load points on your system that can be abused by malicious software. If there is a false positive, and something gets deleted that should not, then I can write a script for ComboFix that will tell it to restore specific items that it deleted.

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  See HERE for help
• Double click on Combo-Fix & follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**NOTE: (This applies to Windows XP systems only) If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, ComboFix will produce a log.

NOTE:
1. Do not mouseclick combofix's window while it's running. That may cause it to stall!
2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Attach logs for: (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS)

• ComboFix (C:\combofix.txt)
  

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

[queenslander]

Combofix log, as requested. Gee I'm glad that you know what it all means

OA Premium said Combofix want to be added to the Autoruns. I said "Yes" - is that OK?

 

Using the Main Forum as a measure, not running any faster

 

ComboFix 13-05-04.01 - HP_Administrator 05/05/2013  16:31:38.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.61.1033.18.2046.1180 [GMT 10:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\EEK\Combo-Fix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Online Armor Firewall *Enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\HP_Administrator\WINDOWS
c:\documents and settings\UpdatusUser\WINDOWS
c:\program files\xp-AntiSpy
c:\program files\xp-AntiSpy\Uninstall.exe
c:\program files\xp-AntiSpy\xp-AntiSpy.chm
c:\program files\xp-AntiSpy\xp-AntiSpy.exe
c:\program files\xp-AntiSpy\xp-AntiSpy.url
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\FF05DA0D.dll
c:\windows\system32\ps2.bat
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_usnjsvc
.
.
(((((((((((((((((((((((((   Files Created from 2013-04-05 to 2013-05-05  )))))))))))))))))))))))))))))))
.
.
2013-05-04 03:02 . 2013-05-04 03:02 -------- d-----w- C:\_OTL
2013-05-04 02:48 . 2013-05-04 02:48 866720 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-05-04 02:48 . 2013-05-04 02:48 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-04 02:47 . 2013-05-04 02:47 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2013-04-26 06:14 . 2013-03-06 23:33 368176 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-04-26 06:14 . 2013-03-06 23:33 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-04-26 06:14 . 2013-03-06 23:33 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-04-26 06:13 . 2013-03-06 23:33 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-04-26 06:13 . 2013-03-06 23:33 62376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-04-26 06:13 . 2013-03-06 23:33 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-04-26 06:13 . 2013-03-06 23:33 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-04-26 06:13 . 2013-03-06 23:33 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-04-26 06:12 . 2013-03-06 23:32 41664 ----a-w- c:\windows\avastSS.scr
2013-04-26 00:21 . 2013-04-26 00:21 -------- d-----w- c:\windows\system32\wbem\Repository
2013-04-26 00:15 . 2013-04-26 00:15 -------- d-----w- C:\Driver
2013-04-26 00:15 . 2013-04-26 00:16 -------- d-----w- c:\program files\Common Files\Ulead Systems
2013-04-26 00:15 . 2013-04-26 00:15 -------- d-----w- c:\program files\Ulead Systems
2013-04-26 00:15 . 2013-04-26 00:28 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Yontoo
2013-04-26 00:15 . 2013-04-26 00:15 -------- d-----w- c:\program files\Yontoo
2013-04-26 00:14 . 2013-04-26 00:14 -------- d-----w- c:\windows\system32\searchplugins
2013-04-26 00:14 . 2013-04-26 00:14 -------- d-----w- c:\windows\system32\Extensions
2013-04-23 02:56 . 2013-04-26 00:15 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Foxit Software
2013-04-23 02:56 . 2013-04-23 02:56 -------- d-----w- c:\program files\Foxit Software
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-04 02:48 . 2012-04-21 03:44 788896 ----a-w- c:\windows\system32\deployJava1.dll
2013-05-04 02:48 . 2012-04-21 03:44 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-03-06 23:32 . 2013-03-04 03:12 228600 ----a-w- c:\windows\system32\aswBoot.exe
2012-12-28 01:52 . 2012-03-02 03:21 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-03-06 23:32 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yontoo Desktop"="c:\documents and settings\HP_Administrator\Application Data\Yontoo\YontooDesktop.exe" [2013-03-06 42784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"PinnacleDriverCheck"="c:\windows\system32\\PSDrvCheck.exe" [2004-03-10 406016]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2012-10-03 2415104]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-29 15494464]
"NvMediaCenter"="NvMCTray.dll" [2012-02-29 108352]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-02-29 1634112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-10-11 98304]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304]
.
c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
Samsung Auto Backup Guage.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFGuage.exe [2011-6-17 823296]
Samsung Auto Backup Real-Time Daemon.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2011-6-17 65536]
Samsung Auto Backup Scheduler.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFTimerD.exe [2011-6-17 102400]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2012-10-03 366440]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ    autocheck autochk *\0smrgdf c:\program files\iolo\System Mechanic 4"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk
backup=c:\windows\pss\Exif Launcher.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-04 01:43 69632 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
2005-08-02 13:19 77312 ----a-w- c:\windows\arpwrmsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 10:56 64512 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2010-06-09 10:55 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-02 06:35 49152 ----a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
1998-05-07 16:04 52736 ----a-w- c:\windows\system\hpsysdrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-10 11:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2005-05-04 14:21 278528 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
2005-05-11 00:50 253952 ----a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2004-08-10 11:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-02-29 20:30 15494464 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2004-08-10 11:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2004-08-10 11:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2004-04-14 20:43 233472 ----a-w- c:\windows\SMINST\Recguard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
2002-02-04 12:32 53248 ----a-w- c:\program files\REGSHAVE\Regshave.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
2004-12-13 15:23 663552 ----a-w- c:\windows\CREATOR\Remind_XP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2005-06-08 21:42 14565376 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2005-10-11 06:39 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"c:\\Program Files\\Adobe\\Photoshop Elements 4.0\\AdobePhotoshopElementsMediaServer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [26/04/2013 4:13 PM 49248]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [26/04/2013 4:13 PM 765736]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26/04/2013 4:14 PM 368176]
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [11/10/2006 4:08 PM 4064]
R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;c:\windows\system32\drivers\hcw88aud.sys [11/10/2005 4:19 PM 11970]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [3/08/2009 11:55 AM 208320]
R1 oahlpXX;Online Armor helper driver;c:\windows\system32\drivers\oahlp32.sys [20/09/2010 3:08 PM 44992]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [3/08/2009 11:55 AM 27648]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [3/08/2009 11:55 AM 31920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/07/2011 2:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [13/07/2011 7:55 AM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [12/08/2011 9:38 AM 116608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26/04/2013 4:14 PM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [26/04/2013 4:13 PM 66336]
R2 BrowserProtect;BrowserProtect;c:\documents and settings\All Users\Application Data\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [27/04/2013 11:14 AM 2569168]
R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [3/08/2009 11:55 AM 216072]
R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\OAsrv.exe [19/09/2011 11:47 AM 4463864]
R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;c:\windows\system32\drivers\hcw88bda.sys [11/10/2005 4:19 PM 133696]
R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;c:\windows\system32\drivers\hcw88tse.sys [11/10/2005 4:19 PM 296515]
R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;c:\windows\system32\drivers\hcw88tun.sys [11/10/2005 4:19 PM 140865]
R3 hcw88vid;Hauppauge WinTV 88x Video;c:\windows\system32\drivers\hcw88vid.sys [11/10/2005 4:19 PM 613204]
R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;c:\windows\system32\drivers\hcw88bar.sys [11/10/2005 4:19 PM 30528]
S3 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [26/04/2013 4:13 PM 164736]
S3 SDVC05;USB SDVC05;c:\windows\system32\drivers\SDVC05.sys [18/03/2006 10:39 AM 18088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-08-22 04:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 04:18]
.
2013-05-05 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-04-26 23:32]
.
2006-04-09 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-05-24 06:46]
.
2013-05-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-19 03:55]
.
2013-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-08 14:49]
.
2013-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-08 14:49]
.
2013-05-04 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04]
.
2013-05-05 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04]
.
2013-05-05 c:\windows\Tasks\User_Feed_Synchronization-{544A588C-2ADA-42F4-A6D0-B0F583251023}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 18:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_AU&c=Q405&bd=pavilion&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_AU&c=Q405&bd=pavilion&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
TCP: Interfaces\{DE35CCC2-20D1-40DE-8806-54D8B888379D}: NameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\xycyw5aw.default\
FF - prefs.js: browser.search.selectedEngine - Delta Search
FF - prefs.js: browser.startup.homepage - hxxp://go.bigpond.com/home/index.jsp
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 8ccd12370000000000000013d4d5e602
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15772
FF - user.js: extensions.delta.vrsn - 1.8.10.0
FF - user.js: extensions.delta.vrsni - 1.8.10.0
FF - user.js: extensions.delta.vrsnTs - 1.8.10.019:29
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre7\bin\jusched.exe
MSConfigStartUp-nwiz - nwiz.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.5.0\bin\jusched.exe
AddRemove-12133444-BF36-4d4e-B7FB-A3424C645DE4 - c:\program files\GemMaster\uninstallgemmaster.exe
AddRemove-B3EE3001-DC24-4cd1-8743-5692C716659F - c:\program files\EnglishOtto\uninstallotto.exe
AddRemove-HijackThis - c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Temporary Directory 3 for HiJackThis.zip\HijackThis.exe
AddRemove-NVIDIA nView Desktop Manager - c:\program files\NVIDIA Corporation\nView\nViewSetup.exe
AddRemove-xp-AntiSpy - c:\program files\xp-AntiSpy\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-05 16:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ...
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-614357371-1467982061-3277721984-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3408)
c:\windows\system32\WININET.dll
c:\program files\NVIDIA Corporation\nView\nview.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
c:\windows\arservice.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\RunDLL32.exe
c:\windows\system32\rundll32.exe
c:\program files\Tall Emu\Online Armor\OAhlp.exe
.
**************************************************************************
.
Completion time: 2013-05-05  16:55:01 - machine was rebooted
ComboFix-quarantined-files.txt  2013-05-05 06:54
.
Pre-Run: 91,124,756,480 bytes free
Post-Run: 90,944,131,072 bytes free
.
- - End Of File - - 07D637BDAC706467027F157B382E3DDC
 

[ShadowPuterDude]

I only asked you to copy & paste a log once.  Attach your logs, unless I ask you to do otherwise.

 

Read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Double-click on TDSSKiller.exe to run the application.
  
• Click Change parameters
  
• Check the boxes next to Verify Driver Digital Signature and Detect TDLFS file system, then click OK
  
• Click on the Start Scan button to begin the scan and wait for it to finish.
  NOTE: Do not use the computer during the scan!
• During the scan it will look similar to the image below:
  
• When it finishes, you will either see a report that no threats were found like below:
  
  If no threats are found at this point, just click the Report selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.
• If any infection or suspected items are found, you will see a window similar to below:
  
  
  • If you have files that are shown to fail signature check do not take any action on these. Make sure you select Skip. I will tell you what to do with these later. They may not be issues at all.
  • If Suspicious objects are detected, the default action will be Skip. Leave the default set to Skip.
  • If Malicious objects are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
  • Make sure that Cure is selected. Important! - If Cure is not available, please choose Skip instead. Do not choose Delete unless instructed to do so.
    

  [*]Click Continue to apply selected actions. [*]A reboot may be required to complete disinfection. A window like the below will appear:
  
  Reboot immediately if TDSSKiller states that one is needed. [*]Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. [*]Attach this log to your next reply.
  

[queenslander]

Sorry about pasting mate.

 

This was my first port of call today. I got interupted and had to log off.

When I came back, the screenshots TDSS.3, .5, and .7 wouldn't load. Anyway, I copied your post to a Word file to have it handy to refer to if needed. All the .png shots appeared in the Word file. Weird?

 

TDSSKiller ran successfully, with 14 suspicious files found

 

I also said "Yes" to TDSS being added to the Autoruns. Is that OK?

 

And keep getting the window attached (called Warning) about leaving a secure site. Can I set that to "Ignore" with safety?

 

Log dutifully attached

[ShadowPuterDude]

The Unsigned files showing in the TDSSKiller log are nothing to be concerned.

 

Run a fresh scan with OTL, attach the new OTL log to your reply.

[queenslander]

OTL scan with no changes in the settings

[ShadowPuterDude]

Run OTL.exe

• Copy & paste the entire contents of OTLfix.txt (ATTACHED BELOW) into the Custom Scans/Fixes box located at the bottom of OTL.
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Attach the new log produced by OTL (C:\_OTL). (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS)

Let me know of any problems you may have encountered with the above instructions and also let my know how things are running.

 

 

[queenslander]

File attached.

 

This forum not any quicker.

 

After each internet session I run CCleaner to remove

Internet cookies and temp files and

System temp files.

 

Is this having a negtive effect on anything?

 

I really appreciate all your ongoing help, and especially patience

[ShadowPuterDude]

Running CCleaner after every net session is a little excessive, but won't harm anything.

 

Let's double check.

 

Run a fresh scan with OTL, attach the new OTL log to your reply.

[queenslander]

Done.

 

To keep things the same, after logging off I ran CCleaner again before running OTL.

 

I happened to notice that during the scan it showed a scan of Yontoo, which I thought I had used Remove Programs to get rid of it.

[ShadowPuterDude]

Download AdwCleaner and save it on your desktop.

1. Close all open programs and internet browsers (you may want to print our or write down these instructions first).
2. Double click on adwcleaner.exe to run the tool.
3. Click on Delete.
4. Confirm each time with Ok.
5. You will be prompted to restart your computer. A text file will open n Notepad after the restart (this is the log of what was removed), which you can save on your desktop.
6. Attach that log file to a reply by clicking the More Reply Options button to the lower-right of where you type in your reply.
7. If you lose that log file for any reason, you can find it at C:\AdwCleaner[s1] on your computer.
   

Download Junkware Removal Tool and save it on your desktop.

1. Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.
2. Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.
3. The tool will open and start scanning your system.
4. Please be patient as this can take a while to complete depending on your system's specifications.
5. On completion, a log is saved to your desktop and will automatically open.
6. Attach the JRT log file to a reply by clicking the More Reply Options button to the lower-right of where you type in your reply.
   

[queenslander]

Just a quick note Kevin.

 

It's Mother's Day on Sunday here in Aus, and offspring have turned up to surprise Mum, so will be busy entertaining.

 

I'll run the programs as soon as I can. Appologies for the delay.

[ShadowPuterDude]

No problem

[queenslander]

Files from ADW and JRT attached.

 

This thread no quicker to open from IE favourites link.

 

Edit Having said that, the main and other forums are much quicker

[ShadowPuterDude]

The longer the thread gets the longer it takes to open.

Run a fresh scan with OTL, attach the new OTL log to your reply.

[queenslander]

It's old age that made me label the OTL file as May19 instead of May14, well that's my excuse 

 

OTL run without a CCleaner run this time.

[ShadowPuterDude]

Your OTL log looks fine.

How are things running?

[queenslander]

Still running slowly most of the time with the occassional web site being OK.

 

 I don't know if there is any significance -  in the past, a site wouldn't load until the IE link was clicked a second time, or alternatively the Refresh button. The last two days this has happend more often.

[ShadowPuterDude]

Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window:
• Click Start to begin the update

  Note: If you receive an error message, chose a different source, then click Start again

• After the update, from the "File" menu, choose "Standard Scripts"
• Put a check next to item 2: Advanced System Analysis
• Click Execute selected scripts
• At the next prompt, click the OK button
• Let the scan run and click "OK" when the completion prompt pops up
• Now Close out of the Standard Scripts window, and exit AVZ
• Navigate to the avz4 folder and locate the folder LOG
• Inside the LOG folder you will find virusinfo_syscheck.htm, virusinfo_syscheck.htm and virusinfo_syscheck.zip
• Attach the Compressed file, virusinfo_syscheck.zip, to your next reply.

[queenslander]

I hope that I got this attchment right Kevin as the zip icon didn't show on the "Log" folder when I browsed to it.

 

Edit I tried to clear the wrong file, but it wouldn't go away.

 

Appologies for the stuff up. It's as they say RTBI, - as in Read The Bloody Instructions.

 

 

[ShadowPuterDude]

Your logs aren't showing any malware.

This could be a software conflict. Might be between Avast and OA. Disable OA a see if that makes a difference.

[queenslander]

Wow, OA disabled and it made a HUGE difference to the speed on internet loading.

superxv.com was as painfully slow as a dial up connection, now it comes up in no time.

 

I am reluctant to add Avast to OA exceptions as I am given to understand that doing so negates Banking Mode.

 

Would adding OA to Avast exceptions do the same?

 

Edit: So,this technically challenged and cowardly old fart took the bull by the horns and excluded OA in Avast and Avast in OA.

 

It did make some difference to the speed (roughly half as quick), but not as much as disabling OA

[queenslander]

Another edit.

 

I removed Avast from the OA exclusions and it all slowed down again, although not as much as removing the OA exclusion in Avast and having no exclusions in either.

[ShadowPuterDude]

You are going to get some slow down, caused by the firewall, as all incoming packets are analyzed. You can use the built in Windows Firewall, however it is not nearly as robust as OA.

[queenslander]

Do you have any ideas about where the OAP/Avast conflict is, and is there a workaround?

 

I have done a search on Avast forum, but nothing came up.

[ShadowPuterDude]

Excluding OA processes & services in Avast and vice versa, should help. The conflict is probably coming from the behavior blocker.

[queenslander]

Does Behaviour Shield do anything that OAP doesn't do, if I disable it as I don't understand the posts at this thread in the Avast forum.

 

http://forum.avast.com/index.php?topic=96711.0

[ShadowPuterDude]

The Behavior Shield is what provides the Heuristic detections. Disabling it will actually reduce the effectiveness of Avast.

[queenslander]

Ok, thanks Kevin.

 

It seems like we are done now, so once again many thanks for all your invaluable help and patience with me.

 

Above and beyond the call of duty I reckon

[ShadowPuterDude]

Unless you are having problems, it is time to do the final steps.

Now to remove most of the tools that we have used in fixing your machine:

Press the Windows key + R and this will open the Run text box. Copy/paste the following text into the Run box as shown and click OK.

Combofix /Uninstall

(Note: There is a space between the ..X and the /U that needs to be there.)

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

Delete the following from your Desktop: (If they exist)

AdwCleaner.exe

CFscript.txt

JRT.exe

JRT.txt

TDSSKiller.exe

Anything else I had you use

Delete the following files: (If they exist)

C:\ComboFix.txt

Delete the following folders: (If they exist)

C:\AdwCleaner[s1]

C:\ComboFix

C:\Qoobox

C:\TDSSKiller_Quarantine

Empty the Recycle Bin

Download to your Desktop:

- CCleaner Portable

• UnZip CCleaner Portable to a folder on your Desktop named CCleaner

Run CCleaner

• Open the CCleaner Folder on your Desktop and double click CCleaner.exe (32-bit) or CCleaner64.exe (64-bit)
• The following should be selected by default, if not, please select:

  

• Click and choose
• Uncheck
• Then go back to and click to run it.
• Exit CCleaner.

Turn off System restore to flush all your restore points then turn system restore back on. See How To Enable and Disable System Restore.

You can delete and uninstall any programs I had you download, that you do not wish to keep on the system.

Run Windows Update and update your Windows Operating System.

Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated.

Articles to read:

How to Protect Your Computer From Malware

How to keep you and your Windows PC happy

Web, email, chat, password and kids safety

10 Sources of Malware Infections

That should take care of everything.

Safe Surfing!

[ShadowPuterDude]

Thread Closed

Reason: Resolved

The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread.