Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
18-Apr-2008, 06:20 PM
#2 | |||||
| Hi, jeff1111.  Welcome to TSG.  Click here to download HJTInstall.exe
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
19-Apr-2008, 11:20 AM
#4 | |||||
| Hi, jeff1111 Please re-open HijackThis and scan. Check the boxes next to all the entries listed below. R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\RunOnce: [*Restore] C:\WINDOWS\system32\restore\rstrui.exe -i Now close all windows and browsers, other than HiJackThis, then click Fix Checked. Close Hijackthis. Please then reboot your computer in Safe Mode by doing the following :
Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present): MyWebSearch Please note any other programs that you dont recognize in that list in your next response Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these folders (if present): C:\Program Files\MyWebSearch Restart the computer.  Download Deckard's System Scanner (DSS) from here or here to your Desktop. Note: You must be logged onto an account with administrator privileges.
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
19-Apr-2008, 03:16 PM
#7 | |||||
| Hi, jeff1111 Download the enclosed folder. Save and extract its contents to the desktop. It is a folder containing a batch file. Once extracted, double click on the RunMe.bat and post the contents of resulting report. Download OTScanit.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanit on your desktop. OTScanit can be detected as malware by your firewall and Ativirus. Chose Ignore on any warning alert.
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
19-Apr-2008, 08:54 PM
#9 | |||||
| Hi, jeff1111 You have been running programs from the temporary folders. Nothing should be ran from these. If you need to download and run a program, make sure you run that program from a Permanent folder such as, your desktop. Start OTScanit. Copy/Paste the information in the Quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button. Code: [Kill Explorer]
[Unregister Dlls]
[Registry - Non-Microsoft Only]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> Capture Text -> []
< User Agent Post Platform [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
YN -> FunWebProducts ->
YN -> SU 3.011 -> StumbleUpon Version String
< Protocol Handlers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
YY -> ic32pp:{BBCA9F81-8F4F-11D2-90FF-0080C83D3571} [HKEY_LOCAL_MACHINE] -> %SystemRoot%\wc98pp.dll[Reg Error: Value does not exist or could not be read.]
< Module Usage Keys [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/DownloadManagerV2.ocx\\.Owner -> {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1}
[Files/Folders - Created Within 30 days]
YY -> 6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
[Files/Folders - Modified Within 30 days]
NY -> 2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY -> 6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY -> qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
NY -> qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
NY -> opa11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa11.dat
NY -> 16 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZD8DN9NW\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZD8DN9NW\*.tmp
NY -> CF06674C-EDA6-48df-B12C-F810984ACF54.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\CF06674C-EDA6-48df-B12C-F810984ACF54.exe
NY -> dotnetfx3setup.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\dotnetfx3setup.exe
NY -> install.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\install.exe
NY -> JingSetup1.2.5.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\JingSetup1.2.5.exe
NY -> msgup810_249_us.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\msgup810_249_us.exe
NY -> msgup810_401_us.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\msgup810_401_us.exe
NY -> msgup810_421_us.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\msgup810_421_us.exe
NY -> msgup_us.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\msgup_us.exe
NY -> WiseUpdX.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\WiseUpdX.exe
NY -> ymsgr.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\ymsgr.exe
NY -> 4023 C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp
NY -> uninstall.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\{257079CA-2FFD-4C92-A1B5-3AE466ECEF22}\uninstall.exe
NY -> update.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\{257079CA-2FFD-4C92-A1B5-3AE466ECEF22}\update.exe
NY -> 3 C:\Documents and Settings\Jeff\Local Settings\Temp\{257079CA-2FFD-4C92-A1B5-3AE466ECEF22}\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\{257079CA-2FFD-4C92-A1B5-3AE466ECEF22}\*.tmp
NY -> QuickTimeInstaller.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\{336C06E7-0219-44AF-8593-E2009E24FCCD}\QuickTimeInstaller.exe
NY -> Drvldr.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\{D0B62912-F69C-4F35-BAC6-8460F7DF6C3C}\{BBBCAE4B-B416-4182-A6F2-438180894A81}\Roxio\Drvldr.exe
NY -> setup.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\{D0B62912-F69C-4F35-BAC6-8460F7DF6C3C}\{BBBCAE4B-B416-4182-A6F2-438180894A81}\Roxio\setup.exe
NY -> md5deep.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~aidlpks.tmp\md5deep.exe
NY -> sed.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~aidlpks.tmp\sed.exe
NY -> swreg.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~aidlpks.tmp\swreg.exe
NY -> md5deep.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~dykoriw.tmp\md5deep.exe
NY -> sed.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~dykoriw.tmp\sed.exe
NY -> md5deep.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~eijtxmu.tmp\md5deep.exe
NY -> sed.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~eijtxmu.tmp\sed.exe
NY -> swreg.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~eijtxmu.tmp\swreg.exe
NY -> md5deep.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~fyivshr.tmp\md5deep.exe
NY -> sed.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~fyivshr.tmp\sed.exe
NY -> swreg.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~fyivshr.tmp\swreg.exe
NY -> md5deep.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~mjgjgtc.tmp\md5deep.exe
NY -> sed.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~mjgjgtc.tmp\sed.exe
NY -> swreg.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~mjgjgtc.tmp\swreg.exe
NY -> md5deep.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~smqgbhg.tmp\md5deep.exe
NY -> sed.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~smqgbhg.tmp\sed.exe
NY -> swreg.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\~smqgbhg.tmp\swreg.exe
NY -> INVISUSSpywareScan.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\is-MCQER.tmp\INVISUSSpywareScan.exe
NY -> SetupX.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\SetupX.exe
NY -> 50comupd.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\50comupd.exe
NY -> instmsia.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\instmsia.exe
NY -> instmsiw.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\instmsiw.exe
NY -> ShFolder.Exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\ShFolder.Exe
NY -> NeroDelTmp.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Setup\NeroDelTmp.exe
NY -> UninstallNero.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Setup\UninstallNero.exe
NY -> Secret Crystals and Gemstones Vol I eBook.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Directory 1 for Secret_Crystals_and_Gemstones_Vol_I_eBook.zip\Secret Crystals and Gemstones Vol I eBook.exe
NY -> @Alternate Data Stream - 0 bytes -> %UserProfile%\Local Settings\Temp\Temporary Directory 1 for Secret_Crystals_and_Gemstones_Vol_I_eBook.zip\Secret Crystals and Gemstones Vol I eBook.exe:Zone.Identifier
NY -> Setup.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Directory 1 for sothink-free-menu-builder.zip\Disk1\Setup.exe
NY -> @Alternate Data Stream - 0 bytes -> %UserProfile%\Local Settings\Temp\Temporary Directory 1 for sothink-free-menu-builder.zip\Disk1\Setup.exe:Zone.Identifier
NY -> Secret Crystals and Gemstones Vol I eBook.exe -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Directory 2 for Secret_Crystals_and_Gemstones_Vol_I_eBook.zip\Secret Crystals and Gemstones Vol I eBook.exe
NY -> @Alternate Data Stream - 0 bytes -> %UserProfile%\Local Settings\Temp\Temporary Directory 2 for Secret_Crystals_and_Gemstones_Vol_I_eBook.zip\Secret Crystals and Gemstones Vol I eBook.exe:Zone.Identifier
NY -> AcsInstall.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\AcsInstall.dll
NY -> AOLFirewallMgr.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\AOLFirewallMgr.dll
NY -> AOLInstallerfw.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\AOLInstallerfw.dll
NY -> insmac2k.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\insmac2k.dll
NY -> instph.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\instph.dll
NY -> QTInstallerHelper.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\QTInstallerHelper.dll
NY -> SHFOLDER.DLL -> C:\Documents and Settings\Jeff\Local Settings\Temp\SHFOLDER.DLL
NY -> uninst.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\uninst.dll
NY -> ywiseext.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\ywiseext.dll
NY -> 4023 C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp
NY -> 5596adc.DLL -> C:\Documents and Settings\Jeff\Local Settings\Temp\_ISTMP1.DIR\_ISTMP1.DIR\5596adc.DLL
NY -> Adobeisf.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\_ISTMP1.DIR\_ISTMP1.DIR\Adobeisf.dll
NY -> Adobeupd.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\_ISTMP1.DIR\_ISTMP1.DIR\Adobeupd.dll
NY -> patchw32.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\_ISTMP1.DIR\_ISTMP1.DIR\patchw32.dll
NY -> CondMgr.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\{45BA7145-64B0-4B5D-BDC2-40E20FCDC6DC}\CondMgr.dll
NY -> HSAPI.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\{45BA7145-64B0-4B5D-BDC2-40E20FCDC6DC}\HSAPI.dll
NY -> dss.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~aidlpks.tmp\dss.dll
NY -> dss.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~dykoriw.tmp\dss.dll
NY -> dss.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~eijtxmu.tmp\dss.dll
NY -> dss.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~fyivshr.tmp\dss.dll
NY -> dss.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~mjgjgtc.tmp\dss.dll
NY -> pncrt.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~rnsetup\pncrt.dll
NY -> pnrs3260.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~rnsetup\pnrs3260.dll
NY -> dss.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\~smqgbhg.tmp\dss.dll
NY -> asycfilt.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\MS\System\asycfilt.dll
NY -> mfc42.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\MS\System\mfc42.dll
NY -> msvcirt.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\MS\System\msvcirt.dll
NY -> msvcp60.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\MS\System\msvcp60.dll
NY -> msvcrt.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\MS\System\msvcrt.dll
NY -> oleaut32.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\MS\System\oleaut32.dll
NY -> olepro32.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Redist\MS\System\olepro32.dll
NY -> APATCH.DLL -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Setup\APATCH.DLL
NY -> nps.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Setup\nps.dll
NY -> unrar.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\NeroDemo9598\Setup\unrar.dll
NY -> AdvrCntr2.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nro.tmp\AdvrCntr2.dll
NY -> ShellManager.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nro.tmp\ShellManager.dll
NY -> ShellManager10E2D762.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nro.tmp\ShellManager10E2D762.dll
NY -> 1 C:\Documents and Settings\Jeff\Local Settings\Temp\nro.tmp\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\nro.tmp\*.tmp
NY -> System.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsi414.tmp\System.dll
NY -> InetLoad.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsvD74.tmp\InetLoad.dll
NY -> InstallOptions.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsvD74.tmp\InstallOptions.dll
NY -> System.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsvD74.tmp\System.dll
NY -> UserInfo.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsvD74.tmp\UserInfo.dll
NY -> InetLoad.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsxD70.tmp\InetLoad.dll
NY -> InstallOptions.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsxD70.tmp\InstallOptions.dll
NY -> System.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsxD70.tmp\System.dll
NY -> UserInfo.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsxD70.tmp\UserInfo.dll
NY -> rhaplog.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\Rhapsody\rhaplog.dll
NY -> rspov2701.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\RSPSoftware\rspov2701.dll
NY -> js3250.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\js3250.dll
NY -> nspr4.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\nspr4.dll
NY -> plc4.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\plc4.dll
NY -> plds4.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\plds4.dll
NY -> xpcom_compat.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\xpcom_compat.dll
NY -> xpcom_core.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\xpcom_core.dll
NY -> jar50.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\components\jar50.dll
NY -> jsd3250.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\components\jsd3250.dll
NY -> xpinstal.dll -> C:\Documents and Settings\Jeff\Local Settings\Temp\tb_temp\xpcom.ns\bin\components\xpinstal.dll
NY -> pcp.dat -> C:\Documents and Settings\Jeff\Local Settings\Temp\pcp.dat
NY -> Perflib_Perfdata_1e4.dat -> C:\Documents and Settings\Jeff\Local Settings\Temp\Perflib_Perfdata_1e4.dat
NY -> Perflib_Perfdata_d08.dat -> C:\Documents and Settings\Jeff\Local Settings\Temp\Perflib_Perfdata_d08.dat
NY -> Perflib_Perfdata_e9c.dat -> C:\Documents and Settings\Jeff\Local Settings\Temp\Perflib_Perfdata_e9c.dat
NY -> 4023 C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp
NY -> 1a162918f4e459e3f12678cf55c8c460.dat -> C:\Documents and Settings\Jeff\Local Settings\Temp\{257079CA-2FFD-4C92-A1B5-3AE466ECEF22}\cache\1a162918f4e459e3f12678cf55c8c460.dat
NY -> 4194-1~3.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\4194-1~3.ini
NY -> addonsb.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\addonsb.ini
NY -> AOLFirewallMgr.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\AOLFirewallMgr.ini
NY -> aolsetup.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\aolsetup.ini
NY -> Dll_.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\Dll_.ini
NY -> setup.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\setup.ini
NY -> {AC76BA86-1033-F400-7760-000000000003}.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\{AC76BA86-1033-F400-7760-000000000003}.ini
NY -> 4023 C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\*.tmp
NY -> AdobeIns.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\_ISTMP1.DIR\_ISTMP1.DIR\AdobeIns.ini
NY -> 0x0409.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\{D0B62912-F69C-4F35-BAC6-8460F7DF6C3C}\{BBBCAE4B-B416-4182-A6F2-438180894A81}\Roxio\0x0409.ini
NY -> Setup.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\{D0B62912-F69C-4F35-BAC6-8460F7DF6C3C}\{BBBCAE4B-B416-4182-A6F2-438180894A81}\Roxio\Setup.ini
NY -> vtipres.INI -> C:\Documents and Settings\Jeff\Local Settings\Temp\FrontPageTempDir\vtipres.INI
NY -> 106 C:\Documents and Settings\Jeff\Local Settings\Temp\FrontPageTempDir\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\FrontPageTempDir\*.tmp
NY -> ioSpecial.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsvD74.tmp\ioSpecial.ini
NY -> ioSpecial.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\nsxD70.tmp\ioSpecial.ini
NY -> z-BornRich.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Directory 1 for bornrich.zip\z-BornRich.ini
NY -> z-BornRich.ini -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Directory 2 for bornrich.zip\z-BornRich.ini
NY -> 1 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\0HMRGLQJ\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\0HMRGLQJ\*.tmp
NY -> 57 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\1V7FH1KU\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\1V7FH1KU\*.tmp
NY -> 54 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\8PIV8D2N\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\8PIV8D2N\*.tmp
NY -> 6 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\AJEBIHUB\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\AJEBIHUB\*.tmp
NY -> 80 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\AXO769M9\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\AXO769M9\*.tmp
NY -> 23 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\DZIPVR1T\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\DZIPVR1T\*.tmp
NY -> 13 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\GDE3STU3\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\GDE3STU3\*.tmp
NY -> 3 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\HBNZ2FLN\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\HBNZ2FLN\*.tmp
NY -> 15 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\N0YFAG1Y\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\N0YFAG1Y\*.tmp
NY -> 18 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\OHYRO9YN\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\OHYRO9YN\*.tmp
NY -> 7 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\S54JW3SJ\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\S54JW3SJ\*.tmp
NY -> 15 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\SNH3A2FP\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\SNH3A2FP\*.tmp
NY -> 3 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\UOD5RRZN\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\UOD5RRZN\*.tmp
NY -> 66 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\W5U3CP6B\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\W5U3CP6B\*.tmp
NY -> 15 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\YX523QLS\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\YX523QLS\*.tmp
NY -> 16 C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZD8DN9NW\*.tmp files -> C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZD8DN9NW\*.tmp
NY -> capture.exe -> C:\WINDOWS\Temp\capture.exe
NY -> ~GL_1476.EXE -> C:\WINDOWS\Temp\~GL_1476.EXE
NY -> 97 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp
NY -> saver.dll -> C:\WINDOWS\Temp\saver.dll
NY -> 97 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp
[Extra Files]
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\0HMRGLQJ\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\1V7FH1KU\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\8PIV8D2N\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\AJEBIHUB\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\DZIPVR1T\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\EDELOXGZ\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\GDE3STU3\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\HBNZ2FLN\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\N0YFAG1Y\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\N8H5F08C\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\OHYRO9YN\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\OLW56NK1\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q7GTADSR\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\S54JW3SJ\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\S54JW3SJ\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\SNH3A2FP\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\SNH3A2FP\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\UOD5RRZN\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\UOD5RRZN\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\W5U3CP6B\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\YX523QLS\*.*
C:\Documents and Settings\Jeff\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZD8DN9NW\*.*
[Empty Temp Folders]
[Start Explorer]
[Reboot] The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTScanit scan. I will review the information when it comes back in. Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
20-Apr-2008, 10:48 AM
#13 | |||||
| Hi, jeff1111 It looks much better. Please do an online scan with Kaspersky WebScanner (Use internet Explorer) Click on Accept You will be promted to install an ActiveX component from Kaspersky, Click Yes.
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
20-Apr-2008, 06:07 PM
#15 | |||||
| Hi, jeff1111 Try DSS.exe once again, if the issue persists, please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 02:19 AM. Copyright © 1996 - 2008 TechGuy, Inc. All rights reserved. Powered by vBulletin, Copyright © 2000 - 2008, Jelsoft Enterprises Ltd. Search Engine Optimization by vBSEO 3.1.0 |  |
