Page 1 of 4 1234 LastLast
Results 1 to 10 of 32

Thread: host errors, HJT errors

  1. #1
    Junior Member
    Join Date
    Feb 2010
    Posts
    26

    Question host errors, HJT errors

    Due to 4 days of inactivity (I was sick) my original post was closed. My original post is here:

    http://forums.spybot.info/showthread.php?t=55511

    I know the instructions said NOT to post logs that were requested, but please let me know if you'd like me to post the ComboFix log that Blade81 requested.

    I just reran the DDS log, as HJT was not working on my computer. Here are the DDS logs as of today:

    DDS log:

    DDS (Ver_09-09-29.01) - NTFSx86
    Run by Owner at 14:44:03.14 on Sun 02/28/2010
    Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.1395 [GMT -5:00]

    SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

    ============== Running Processes ===============

    C:\windows\system32\wininit.exe
    C:\windows\system32\lsm.exe
    C:\windows\system32\svchost.exe -k DcomLaunch
    C:\windows\system32\svchost.exe -k RPCSS
    C:\windows\system32\atiesrxx.exe
    C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\windows\system32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k LocalService
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\System32\spoolsv.exe
    C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
    C:\windows\system32\svchost.exe -k imgsvc
    C:\Windows\system32\TODDSrv.exe
    C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    C:\Program Files\TOSHIBA\TECO\TecoService.exe
    C:\windows\system32\SearchIndexer.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\windows\system32\atieclxx.exe
    C:\windows\system32\taskhost.exe
    C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
    C:\windows\Explorer.EXE
    C:\windows\system32\Dwm.exe
    C:\windows\system32\taskeng.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Users\Owner\AppData\Roaming\Google\Google Talk\googletalk.exe
    C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
    C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Program Files\TOSHIBA\TECO\TEco.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\windows\System32\svchost.exe -k secsvcs
    C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
    C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
    C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
    C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
    C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
    C:\windows\system32\wuauclt.exe
    C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\windows\system32\wbem\wmiprvse.exe
    C:\windows\system32\taskhost.exe
    C:\windows\system32\DllHost.exe
    C:\windows\system32\DllHost.exe
    C:\Users\Owner\Desktop\dds.com
    C:\windows\system32\conhost.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
    mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
    mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton security suite\engine\3.8.0.41\coIEPlg.dll
    BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton security suite\engine\3.8.0.41\IPSBHO.DLL
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton security suite\engine\3.8.0.41\coIEPlg.dll
    uRun: [MyTOSHIBA] "c:\program files\toshiba\my toshiba\MyToshiba.exe" /AUTO
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [googletalk] c:\users\owner\appdata\roaming\google\google talk\googletalk.exe /autostart
    uRun: [Security Antivirus] "c:\cd65301\SAcd65.exe" /s /d
    uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
    mRun: [<NO NAME>]
    mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
    mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
    mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
    mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
    mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
    mRun: [ToshibaServiceStation] "c:\program files\toshiba\toshiba service station\ToshibaServiceStation.exe" /hide:60
    mRun: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
    mRun: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
    mRun: [TosSENotify] c:\program files\toshiba\toshiba hdd ssd alert\TosWaitSrv.exe
    mRun: [NortonOnlineBackupReminder] "c:\program files\toshiba\toshiba online backup\activation\TobuActivation.exe" UNATTENDED
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    StartupFolder: c:\users\owner\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mif5ba~1\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton security suite\engine\3.8.0.41\CoIEPlg.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\xmmpllk7.default\
    FF - prefs.js: browser.search.selectedEngine - search
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
    FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\users\owner\appdata\local\google\update\1.2.183.13\npGoogleOneClick8.dll
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-10 310320]
    R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-10 259632]
    R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-10 482432]
    R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100224.002\IDSvix86.sys [2010-2-25 343088]
    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
    R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-12-14 176128]
    R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\toshiba\configfree\CFIWmxSvcs.exe [2009-8-10 185712]
    R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2009-3-10 46448]
    R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\3.8.0.41\ccSvcHst.exe [2010-2-10 117640]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-2-11 1153368]
    R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\toshiba\teco\TecoService.exe [2009-8-11 185712]
    R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [2009-6-19 12920]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-2-10 102448]
    R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2009-12-14 7680]
    R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-12-14 187392]
    R3 RTL8187Se;Realtek RTL8187SE Wireless LAN PCIE Network Adapter;c:\windows\system32\drivers\RTL8187Se.sys [2009-12-14 372736]
    R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\n360\0308000.029\symndisv.sys [2010-2-10 48688]
    R3 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2009-12-14 51512]
    R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\toshiba\toshiba hdd ssd alert\TosSmartSrv.exe [2009-8-3 111960]
    R3 TPCHSrv;TPCH Service;c:\program files\toshiba\tphm\TPCHSrv.exe [2009-8-6 685424]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

    =============== Created Last 30 ================

    2010-02-24 09:00 641,536 a------- c:\windows\system32\CPFilters.dll
    2010-02-24 09:00 465,408 a------- c:\windows\system32\psisdecd.dll
    2010-02-24 09:00 417,792 a------- c:\windows\system32\msdri.dll
    2010-02-24 09:00 204,288 a------- c:\windows\system32\MSNP.ax
    2010-02-24 09:00 2,048 a------- c:\windows\system32\tzres.dll
    2010-02-15 00:07 <DIR> --d----- c:\program files\TrendMicro
    2010-02-11 17:16 <DIR> --d----- c:\programdata\Lavasoft
    2010-02-11 15:28 <DIR> --d----- c:\programdata\Spybot - Search & Destroy
    2010-02-11 15:28 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2010-02-11 15:28 <DIR> --d----- c:\progra~2\Spybot - Search & Destroy
    2010-02-11 12:03 <DIR> --d--r-- c:\program files\Norton Support
    2010-02-10 15:36 <DIR> --d----- c:\programdata\Sun
    2010-02-10 15:35 411,368 a------- c:\windows\system32\deploytk.dll
    2010-02-10 14:01 <DIR> --d----- c:\programdata\RegCure
    2010-02-10 14:01 <DIR> --d----- c:\progra~2\RegCure
    2010-02-10 07:46 107,368 a----r-- c:\windows\system32\GEARAspi.dll
    2010-02-10 07:46 26,600 a----r-- c:\windows\system32\drivers\GEARAspiWDM.sys
    2010-02-10 07:46 25,648 a----r-- c:\windows\system32\drivers\SymIMV.sys
    2010-02-10 07:46 124,976 a------- c:\windows\system32\drivers\SYMEVENT.SYS
    2010-02-10 07:46 7,456 a------- c:\windows\system32\drivers\SYMEVENT.CAT
    2010-02-10 07:46 806 a------- c:\windows\system32\drivers\SYMEVENT.INF
    2010-02-10 07:45 <DIR> --d----- c:\program files\Symantec
    2010-02-10 07:45 <DIR> --d----- c:\program files\common files\Symantec Shared
    2010-02-10 07:44 <DIR> --d----- c:\windows\system32\drivers\N360
    2010-02-10 07:44 <DIR> --d----- c:\program files\Norton Security Suite
    2010-02-10 07:42 <DIR> --d----- c:\programdata\PCSettings
    2010-02-10 07:42 <DIR> --d----- c:\progra~2\PCSettings
    2010-02-10 07:29 118 a------- c:\windows\system32\MRT.INI
    2010-02-09 12:45 <DIR> --d----- c:\programdata\3fa8f
    2010-02-09 12:45 <DIR> --d----- c:\progra~2\3fa8f
    2010-02-09 12:45 <DIR> --dsh--- c:\users\owner\appdata\roaming\Security Antivirus
    2010-02-09 12:45 <DIR> --dsh--- c:\programdata\SABRV
    2010-02-09 12:45 <DIR> --dsh--- c:\progra~2\SABRV
    2010-02-09 12:45 <DIR> --dsh--- C:\cd65301
    2010-02-09 01:32 <DIR> --d----- c:\programdata\McAfee

    ==================== Find3M ====================

    2010-02-24 09:16 181,632 -------- c:\windows\system32\MpSigStub.exe
    2010-01-18 18:29 365,568 a------- c:\windows\system32\secproc_isv.dll
    2010-01-18 18:29 85,504 a------- c:\windows\system32\secproc_ssp_isv.dll
    2010-01-18 18:29 85,504 a------- c:\windows\system32\secproc_ssp.dll
    2010-01-18 18:29 369,152 a------- c:\windows\system32\secproc.dll
    2010-01-18 18:28 324,608 a------- c:\windows\system32\RMActivate_isv.exe
    2010-01-18 18:28 277,504 a------- c:\windows\system32\RMActivate_ssp_isv.exe
    2010-01-18 18:28 320,512 a------- c:\windows\system32\RMActivate.exe
    2010-01-18 18:28 280,064 a------- c:\windows\system32\RMActivate_ssp.exe
    2010-01-07 22:18 221,184 a------- c:\windows\system32\drivers\mrxsmb10.sys
    2010-01-07 22:17 123,392 a------- c:\windows\system32\drivers\mrxsmb.sys
    2010-01-01 18:51 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
    2009-12-19 04:02 977,920 a------- c:\windows\system32\wininet.dll
    2009-12-19 04:02 12,288 a------- c:\windows\system32\tsbyuv.dll
    2009-12-19 04:02 1,328,640 a------- c:\windows\system32\quartz.dll
    2009-12-19 04:02 22,016 a------- c:\windows\system32\msyuv.dll
    2009-12-19 04:02 31,744 a------- c:\windows\system32\msvidc32.dll
    2009-12-19 04:02 13,312 a------- c:\windows\system32\msrle32.dll
    2009-12-19 04:02 84,480 a------- c:\windows\system32\mciavi32.dll
    2009-12-19 04:02 50,176 a------- c:\windows\system32\iyuv_32.dll
    2009-12-19 04:02 91,648 a------- c:\windows\system32\avifil32.dll
    2009-12-08 06:40 3,955,288 a------- c:\windows\system32\ntkrnlpa.exe
    2009-12-08 06:40 3,899,464 a------- c:\windows\system32\ntoskrnl.exe
    2009-12-08 06:32 292,864 a------- c:\windows\system32\apphelp.dll
    2009-07-13 23:56 291,294 a------- c:\windows\inf\perflib\0409\perfi.dat
    2009-07-13 23:56 291,294 a------- c:\windows\inf\perflib\0409\perfh.dat
    2009-07-13 23:56 31,548 a------- c:\windows\inf\perflib\0409\perfd.dat
    2009-07-13 23:56 31,548 a------- c:\windows\inf\perflib\0409\perfc.dat
    2009-07-13 23:41 174 a--sh--- c:\program files\desktop.ini
    2009-07-13 19:34 291,294 a------- c:\windows\inf\perflib\0000\perfi.dat
    2009-07-13 19:34 291,294 a------- c:\windows\inf\perflib\0000\perfh.dat
    2009-07-13 19:34 31,548 a------- c:\windows\inf\perflib\0000\perfd.dat
    2009-07-13 19:34 31,548 a------- c:\windows\inf\perflib\0000\perfc.dat
    2009-06-10 16:26 9,633,792 a--shr-- c:\windows\fonts\StaticCache.dat
    2009-07-13 20:14 396,800 a--sh--- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

    ============= FINISH: 14:44:39.23 ===============


    Attach log:





    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-09-29.01)

    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/30/2009 2:38:36 PM
    System Uptime: 2/28/2010 1:50:58 PM (1 hours ago)

    Motherboard: TOSHIBA | | Portable PC
    Processor: AMD Athlon(tm) II Dual-Core M300 | Socket S1G3 | 2000/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 289 GiB total, 257.91 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP1: 12/30/2009 2:38:56 PM - TOSHIBA Default System Restore Point
    RP3: 12/30/2009 2:39:25 PM - Installed Toshiba Quality Application
    RP4: 12/30/2009 3:02:21 PM - Windows Update
    RP5: 12/31/2009 6:20:36 PM - Installed iTunes
    RP7: 1/3/2010 7:44:01 PM - Configured Microsoft Office Home and Student 2007
    RP9: 1/3/2010 7:48:43 PM - Configured Microsoft Office Home and Student 2007
    RP10: 1/13/2010 11:34:02 PM - Windows Update
    RP11: 1/14/2010 9:30:30 AM - Windows Modules Installer
    RP12: 1/14/2010 9:36:30 AM - Windows Update
    RP13: 1/16/2010 10:28:00 AM - Windows Update
    RP14: 1/22/2010 9:09:27 AM - Windows Update
    RP15: 1/27/2010 10:08:21 AM - Windows Update
    RP16: 1/30/2010 4:51:05 PM - Windows Update
    RP17: 2/1/2010 7:36:48 PM - Windows Update
    RP18: 2/5/2010 9:25:54 AM - Windows Update
    RP19: 2/8/2010 10:37:00 PM - Windows Update
    RP20: 2/10/2010 7:27:22 AM - Windows Update
    RP22: 2/10/2010 8:00:10 AM - Windows Defender Checkpoint
    RP23: 2/10/2010 3:33:57 PM - Installed Java(TM) 6 Update 18
    RP24: 2/11/2010 9:20:08 PM - Windows Update
    RP25: 2/15/2010 12:05:52 AM - Installed HiJackThis
    RP26: 2/15/2010 2:10:38 PM - Windows Update
    RP27: 2/18/2010 9:31:53 PM - Windows Update
    RP28: 2/18/2010 9:40:51 PM - Windows Update
    RP29: 2/19/2010 9:06:39 AM - Windows Update
    RP30: 2/22/2010 7:37:07 PM - Windows Update
    RP31: 2/25/2010 11:23:01 PM - Windows Update
    RP32: 2/25/2010 11:25:12 PM - Windows Update

    ==== Installed Programs ======================

    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.1
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Install Manager
    Bonjour
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    ccc-utility
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Compatibility Pack for the 2007 Office system
    ERUNT 1.1j
    Google Chrome
    Google Talk (remove only)
    Google Toolbar for Internet Explorer
    HiJackThis
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 18
    Junk Mail filter update
    Label@Once 1.0
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Suite Activation Assistant
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    Mozilla Firefox (3.6)
    MSVCRT
    MyToshiba
    NetZero Launcher
    Norton Internet Security
    Norton Security Suite
    PlayReady PC Runtime x86
    Quickbooks Financial Center
    QuickTime
    Realtek Ethernet Controller Driver
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    Realtek WLAN Driver
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB973704)
    Security Update for Microsoft Office Excel 2007 (KB973593)
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB969613)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Skype Launcher
    Spybot - Search & Destroy
    Synaptics Pointing Device Driver
    Toshiba Application and Driver Installer
    TOSHIBA Assist
    TOSHIBA ConfigFree
    TOSHIBA Disc Creator
    TOSHIBA DVD PLAYER
    TOSHIBA eco Utility
    TOSHIBA Extended Tiles for Windows Mobility Center
    TOSHIBA Hardware Setup
    TOSHIBA HDD/SSD Alert
    Toshiba Online Backup
    TOSHIBA PC Health Monitor
    Toshiba Quality Application
    TOSHIBA Recovery Media Creator
    TOSHIBA Service Station
    TOSHIBA Speech System Applications
    TOSHIBA Speech System SR Engine(U.S.) Version1.0
    TOSHIBA Speech System TTS Engine(U.S.) Version1.0
    TOSHIBA Supervisor Password
    TOSHIBA Value Added Package
    ToshibaRegistration
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office InfoPath 2007 (KB976416)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 (KB974561)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WildTangent Games
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Upload Tool
    Windows Live Writer

    ==== Event Viewer Messages From Past Week ========

    2/28/2010 2:36:54 PM, Error: Schannel [36888] - The following fatal alert was generated: 48. The internal error state is 552.
    2/28/2010 2:36:54 PM, Error: Schannel [36882] - The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate.
    2/28/2010 2:20:06 PM, Error: atikmdag [43029] - Display is not active
    2/26/2010 10:35:03 PM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter
    2/25/2010 11:27:42 PM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {F81CD990-910B-4BBF-9CB3-6A77F3D697B3}. The error: "2" Happened while starting this command: C:\Program Files\Windows Live\Messenger\msnmsgr.exe -Embedding
    2/24/2010 10:50:52 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} and APPID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Owner-PC\Owner SID (S-1-5-21-3957342637-2223780103-148138915-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

    ==== End Of File ========================

    I appreciate any help/advice you can offer. Thank you!!

  2. #2
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    Please post ComboFix log if you have it handy

    Post also a fresh dds log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Feb 2010
    Posts
    26

    Default

    Will do. I will work on this and post on Sunday. Thank you so much!

  4. #4
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Ok. Shall wait for your reply
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member
    Join Date
    Feb 2010
    Posts
    26

    Default

    Ack! I didn't realize ComboFix would take well over 12 hours to work through my computer...I hope it's finished by the time I return home tonight. I apologize for the delay!

  6. #6
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    If ComboFix hasn't finished see if there's PEV process running in task manager and kill the process if found. If even that doesn't make ComboFix to finish reboot and see if the log gets generated.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  7. #7
    Junior Member
    Join Date
    Feb 2010
    Posts
    26

    Default

    Hello,

    ComboFix was still running when I got home, 24 hours after I had started it. My Windows desktop disappeared, so my only option was to shut down and restart. When I did that, no log appeared. I will try running ComboFix again and see what happens this time.

    How long should I wait this time? And what is the next step if no log appears?

    Thanks, Blade81!

  8. #8
    Junior Member
    Join Date
    Feb 2010
    Posts
    26

    Default

    In addition, in case it helps, here are DDS logs I ran 5 minutes ago:

    DDS log:


    DDS (Ver_09-09-29.01) - NTFSx86
    Run by Owner at 19:25:28.79 on Mon 03/08/2010
    Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.1814 [GMT -5:00]

    SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

    ============== Running Processes ===============

    C:\windows\system32\wininit.exe
    C:\windows\system32\lsm.exe
    C:\windows\system32\svchost.exe -k DcomLaunch
    C:\windows\system32\svchost.exe -k RPCSS
    C:\windows\system32\atiesrxx.exe
    C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\windows\system32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k LocalService
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\system32\atieclxx.exe
    C:\windows\System32\spoolsv.exe
    C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\TODDSrv.exe
    C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    C:\Program Files\TOSHIBA\TECO\TecoService.exe
    C:\windows\system32\SearchIndexer.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\windows\system32\sppsvc.exe
    C:\windows\System32\svchost.exe -k secsvcs
    C:\windows\system32\wbem\wmiprvse.exe
    C:\windows\system32\taskhost.exe
    C:\windows\system32\Dwm.exe
    C:\windows\Explorer.EXE
    C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
    C:\Program Files\TOSHIBA\TECO\TEco.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Users\Owner\AppData\Roaming\Google\Google Talk\googletalk.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\windows\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\windows\system32\taskeng.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
    C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
    C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
    C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
    C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
    C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\windows\system32\DllHost.exe
    C:\windows\system32\DllHost.exe
    C:\Users\Owner\Desktop\dds.com
    C:\windows\system32\conhost.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
    mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
    mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    uRun: [MyTOSHIBA] "c:\program files\toshiba\my toshiba\MyToshiba.exe" /AUTO
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [googletalk] c:\users\owner\appdata\roaming\google\google talk\googletalk.exe /autostart
    uRun: [Security Antivirus] "c:\cd65301\SAcd65.exe" /s /d
    uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    mRun: [<NO NAME>]
    mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
    mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
    mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
    mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
    mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
    mRun: [ToshibaServiceStation] "c:\program files\toshiba\toshiba service station\ToshibaServiceStation.exe" /hide:60
    mRun: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
    mRun: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
    mRun: [TosSENotify] c:\program files\toshiba\toshiba hdd ssd alert\TosWaitSrv.exe
    mRun: [NortonOnlineBackupReminder] "c:\program files\toshiba\toshiba online backup\activation\TobuActivation.exe" UNATTENDED
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    StartupFolder: c:\users\owner\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mif5ba~1\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

    ================= FIREFOX ===================

    FF - ProfilePath -
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
    R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-12-14 176128]
    R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\toshiba\configfree\CFIWmxSvcs.exe [2009-8-10 185712]
    R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2009-3-10 46448]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-2-11 1153368]
    R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\toshiba\teco\TecoService.exe [2009-8-11 185712]
    R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [2009-6-19 12920]
    R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2009-12-14 7680]
    R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-12-14 187392]
    R3 RTL8187Se;Realtek RTL8187SE Wireless LAN PCIE Network Adapter;c:\windows\system32\drivers\RTL8187Se.sys [2009-12-14 372736]
    R3 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2009-12-14 51512]
    R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\toshiba\toshiba hdd ssd alert\TosSmartSrv.exe [2009-8-3 111960]
    R3 TPCHSrv;TPCH Service;c:\program files\toshiba\tphm\TPCHSrv.exe [2009-8-6 685424]
    S2 PEVSystemStart;PEVSystemStart;c:\combofix\PEV.cfxxe [2010-3-7 261632]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

    =============== Created Last 30 ================

    2010-03-08 19:10 <DIR> --dsh--- C:\$RECYCLE.BIN
    2010-03-07 21:32 261,632 a------- c:\windows\PEV.exe
    2010-03-07 21:32 161,792 a------- c:\windows\SWREG.exe
    2010-03-07 21:32 98,816 a------- c:\windows\sed.exe
    2010-03-07 21:32 77,312 a------- c:\windows\MBR.exe
    2010-03-07 21:32 <DIR> --ds---- C:\ComboFix
    2010-02-24 09:00 641,536 a------- c:\windows\system32\CPFilters.dll
    2010-02-24 09:00 465,408 a------- c:\windows\system32\psisdecd.dll
    2010-02-24 09:00 417,792 a------- c:\windows\system32\msdri.dll
    2010-02-24 09:00 204,288 a------- c:\windows\system32\MSNP.ax
    2010-02-24 09:00 2,048 a------- c:\windows\system32\tzres.dll
    2010-02-15 00:07 <DIR> --d----- c:\program files\TrendMicro
    2010-02-11 17:16 <DIR> --d----- c:\programdata\Lavasoft
    2010-02-11 15:28 <DIR> --d----- c:\programdata\Spybot - Search & Destroy
    2010-02-11 15:28 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2010-02-11 15:28 <DIR> --d----- c:\progra~2\Spybot - Search & Destroy
    2010-02-11 12:03 <DIR> --d--r-- c:\program files\Norton Support
    2010-02-10 15:36 <DIR> --d----- c:\programdata\Sun
    2010-02-10 15:35 411,368 a------- c:\windows\system32\deploytk.dll
    2010-02-10 14:01 <DIR> --d----- c:\programdata\RegCure
    2010-02-10 14:01 <DIR> --d----- c:\progra~2\RegCure
    2010-02-10 07:46 107,368 a----r-- c:\windows\system32\GEARAspi.dll
    2010-02-10 07:46 26,600 a----r-- c:\windows\system32\drivers\GEARAspiWDM.sys
    2010-02-10 07:45 <DIR> --d----- c:\program files\Symantec
    2010-02-10 07:44 <DIR> --d----- c:\windows\system32\drivers\N360
    2010-02-10 07:42 <DIR> --d----- c:\programdata\PCSettings
    2010-02-10 07:42 <DIR> --d----- c:\progra~2\PCSettings
    2010-02-10 07:29 118 a------- c:\windows\system32\MRT.INI
    2010-02-09 12:45 <DIR> --d----- c:\programdata\3fa8f
    2010-02-09 12:45 <DIR> --d----- c:\progra~2\3fa8f
    2010-02-09 12:45 <DIR> --dsh--- c:\programdata\SABRV
    2010-02-09 12:45 <DIR> --dsh--- c:\progra~2\SABRV
    2010-02-09 12:45 <DIR> --dsh--- C:\cd65301
    2010-02-09 01:32 <DIR> --d----- c:\programdata\McAfee

    ==================== Find3M ====================

    2010-02-24 09:16 181,632 -------- c:\windows\system32\MpSigStub.exe
    2010-01-18 18:29 365,568 a------- c:\windows\system32\secproc_isv.dll
    2010-01-18 18:29 85,504 a------- c:\windows\system32\secproc_ssp_isv.dll
    2010-01-18 18:29 85,504 a------- c:\windows\system32\secproc_ssp.dll
    2010-01-18 18:29 369,152 a------- c:\windows\system32\secproc.dll
    2010-01-18 18:28 324,608 a------- c:\windows\system32\RMActivate_isv.exe
    2010-01-18 18:28 277,504 a------- c:\windows\system32\RMActivate_ssp_isv.exe
    2010-01-18 18:28 320,512 a------- c:\windows\system32\RMActivate.exe
    2010-01-18 18:28 280,064 a------- c:\windows\system32\RMActivate_ssp.exe
    2010-01-07 22:18 221,184 a------- c:\windows\system32\drivers\mrxsmb10.sys
    2010-01-07 22:17 123,392 a------- c:\windows\system32\drivers\mrxsmb.sys
    2009-12-19 04:02 977,920 a------- c:\windows\system32\wininet.dll
    2009-12-19 04:02 12,288 a------- c:\windows\system32\tsbyuv.dll
    2009-12-19 04:02 1,328,640 a------- c:\windows\system32\quartz.dll
    2009-12-19 04:02 22,016 a------- c:\windows\system32\msyuv.dll
    2009-12-19 04:02 31,744 a------- c:\windows\system32\msvidc32.dll
    2009-12-19 04:02 13,312 a------- c:\windows\system32\msrle32.dll
    2009-12-19 04:02 84,480 a------- c:\windows\system32\mciavi32.dll
    2009-12-19 04:02 50,176 a------- c:\windows\system32\iyuv_32.dll
    2009-12-19 04:02 91,648 a------- c:\windows\system32\avifil32.dll
    2009-07-13 23:56 291,294 a------- c:\windows\inf\perflib\0409\perfi.dat
    2009-07-13 23:56 291,294 a------- c:\windows\inf\perflib\0409\perfh.dat
    2009-07-13 23:56 31,548 a------- c:\windows\inf\perflib\0409\perfd.dat
    2009-07-13 23:56 31,548 a------- c:\windows\inf\perflib\0409\perfc.dat
    2009-07-13 23:41 174 a--sh--- c:\program files\desktop.ini
    2009-07-13 19:34 291,294 a------- c:\windows\inf\perflib\0000\perfi.dat
    2009-07-13 19:34 291,294 a------- c:\windows\inf\perflib\0000\perfh.dat
    2009-07-13 19:34 31,548 a------- c:\windows\inf\perflib\0000\perfd.dat
    2009-07-13 19:34 31,548 a------- c:\windows\inf\perflib\0000\perfc.dat
    2009-06-10 16:26 9,633,792 a--shr-- c:\windows\fonts\StaticCache.dat
    2009-07-13 20:14 396,800 a--sh--- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

    ============= FINISH: 19:26:17.08 ===============

    Attach log:

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-09-29.01)

    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/30/2009 2:38:36 PM
    System Uptime: 3/8/2010 7:18:10 PM (0 hours ago)

    Motherboard: TOSHIBA | | Portable PC
    Processor: AMD Athlon(tm) II Dual-Core M300 | Socket S1G3 | 2000/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 289 GiB total, 258.371 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP7: 1/3/2010 7:44:01 PM - Configured Microsoft Office Home and Student 2007
    RP9: 1/3/2010 7:48:43 PM - Configured Microsoft Office Home and Student 2007
    RP10: 1/13/2010 11:34:02 PM - Windows Update
    RP11: 1/14/2010 9:30:30 AM - Windows Modules Installer
    RP12: 1/14/2010 9:36:30 AM - Windows Update
    RP13: 1/16/2010 10:28:00 AM - Windows Update
    RP14: 1/22/2010 9:09:27 AM - Windows Update
    RP15: 1/27/2010 10:08:21 AM - Windows Update
    RP16: 1/30/2010 4:51:05 PM - Windows Update
    RP17: 2/1/2010 7:36:48 PM - Windows Update
    RP18: 2/5/2010 9:25:54 AM - Windows Update
    RP19: 2/8/2010 10:37:00 PM - Windows Update
    RP20: 2/10/2010 7:27:22 AM - Windows Update
    RP22: 2/10/2010 8:00:10 AM - Windows Defender Checkpoint
    RP23: 2/10/2010 3:33:57 PM - Installed Java(TM) 6 Update 18
    RP24: 2/11/2010 9:20:08 PM - Windows Update
    RP25: 2/15/2010 12:05:52 AM - Installed HiJackThis
    RP26: 2/15/2010 2:10:38 PM - Windows Update
    RP27: 2/18/2010 9:31:53 PM - Windows Update
    RP28: 2/18/2010 9:40:51 PM - Windows Update
    RP29: 2/19/2010 9:06:39 AM - Windows Update
    RP30: 2/22/2010 7:37:07 PM - Windows Update
    RP31: 2/25/2010 11:23:01 PM - Windows Update
    RP32: 2/25/2010 11:25:12 PM - Windows Update
    RP33: 3/1/2010 8:30:09 PM - Windows Update
    RP34: 3/4/2010 10:23:16 PM - Windows Update
    RP35: 3/8/2010 7:13:50 PM - Windows Update

    ==== Installed Programs ======================

    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.1
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Install Manager
    Bonjour
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    ccc-utility
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Compatibility Pack for the 2007 Office system
    ERUNT 1.1j
    Google Chrome
    Google Talk (remove only)
    Google Toolbar for Internet Explorer
    HiJackThis
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 18
    Junk Mail filter update
    Label@Once 1.0
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Suite Activation Assistant
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    Mozilla Firefox (3.6)
    MSVCRT
    MyToshiba
    NetZero Launcher
    PlayReady PC Runtime x86
    Quickbooks Financial Center
    QuickTime
    Realtek Ethernet Controller Driver
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    Realtek WLAN Driver
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB973704)
    Security Update for Microsoft Office Excel 2007 (KB973593)
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB969613)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Skype Launcher
    Spybot - Search & Destroy
    Synaptics Pointing Device Driver
    Toshiba Application and Driver Installer
    TOSHIBA Assist
    TOSHIBA ConfigFree
    TOSHIBA Disc Creator
    TOSHIBA DVD PLAYER
    TOSHIBA eco Utility
    TOSHIBA Extended Tiles for Windows Mobility Center
    TOSHIBA Hardware Setup
    TOSHIBA HDD/SSD Alert
    Toshiba Online Backup
    TOSHIBA PC Health Monitor
    Toshiba Quality Application
    TOSHIBA Recovery Media Creator
    TOSHIBA Service Station
    TOSHIBA Speech System Applications
    TOSHIBA Speech System SR Engine(U.S.) Version1.0
    TOSHIBA Speech System TTS Engine(U.S.) Version1.0
    TOSHIBA Supervisor Password
    TOSHIBA Value Added Package
    ToshibaRegistration
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office InfoPath 2007 (KB976416)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 (KB974561)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WildTangent Games
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Upload Tool
    Windows Live Writer

    ==== Event Viewer Messages From Past Week ========

    3/8/2010 7:25:21 PM, Error: Schannel [36888] - The following fatal alert was generated: 48. The internal error state is 552.
    3/8/2010 7:25:21 PM, Error: Schannel [36882] - The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate.
    3/8/2010 7:18:29 PM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter
    3/8/2010 7:18:29 PM, Error: atikmdag [43029] - Display is not active
    3/7/2010 9:32:38 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    3/7/2010 9:21:25 PM, Error: Service Control Manager [7031] - The Norton Security Suite service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    3/6/2010 6:52:16 PM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {F81CD990-910B-4BBF-9CB3-6A77F3D697B3}. The error: "2" Happened while starting this command: C:\Program Files\Windows Live\Messenger\msnmsgr.exe -Embedding

    ==== End Of File ===========================

  9. #9
    Junior Member
    Join Date
    Feb 2010
    Posts
    26

    Default

    Hello again,

    I ran ComboFix again this morning and this time it worked!

    Here is the log:


    ComboFix 10-03-07.02 - Owner 03/09/2010 9:30.3.2 - x86
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.1968 [GMT -5:00]
    Running from: c:\users\Owner\Desktop\ComboFix.exe
    SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
    .

    ((((((((((((((((((((((((( Files Created from 2010-02-09 to 2010-03-09 )))))))))))))))))))))))))))))))
    .

    2010-03-09 14:34 . 2010-03-09 14:34 -------- d-----w- c:\users\Public\AppData\Local\temp
    2010-03-09 14:34 . 2010-03-09 14:34 -------- d-----w- c:\users\Default\AppData\Local\temp
    2010-03-09 14:34 . 2010-03-09 14:34 -------- d-----w- c:\users\Administrator\AppData\Local\temp
    2010-02-24 14:00 . 2009-12-13 09:30 641536 ----a-w- c:\windows\system32\CPFilters.dll
    2010-02-24 14:00 . 2009-12-13 09:30 465408 ----a-w- c:\windows\system32\psisdecd.dll
    2010-02-24 14:00 . 2009-12-13 09:29 417792 ----a-w- c:\windows\system32\msdri.dll
    2010-02-24 14:00 . 2010-02-02 07:45 2048 ----a-w- c:\windows\system32\tzres.dll
    2010-02-19 02:35 . 2010-02-19 02:35 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
    2010-02-15 05:07 . 2010-02-15 05:07 388096 ----a-r- c:\users\Owner\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
    2010-02-15 05:07 . 2010-02-15 05:07 -------- d-----w- c:\program files\TrendMicro
    2010-02-15 05:00 . 2010-02-15 05:00 -------- d-----w- c:\program files\ERUNT
    2010-02-11 22:16 . 2010-02-13 05:35 -------- d-----w- c:\programdata\Lavasoft
    2010-02-11 20:28 . 2010-02-15 04:10 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-02-11 20:28 . 2010-02-11 22:17 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2010-02-11 19:52 . 2010-02-11 19:52 103050 ----a-w- c:\programdata\Microsoft\Windows Defender\LocalCopy\{2D3A6BBC-41F4-1F50-18CC-9A77DAEA1AB8}-uninst.exe
    2010-02-11 17:03 . 2010-02-11 17:03 -------- d-----r- c:\program files\Norton Support
    2010-02-11 15:52 . 2010-02-11 15:52 -------- d-----w- c:\users\Owner\AppData\Local\Deployment
    2010-02-11 15:52 . 2010-02-11 15:52 -------- d-----w- c:\users\Owner\AppData\Local\Apps
    2010-02-10 20:36 . 2010-02-10 20:36 -------- d-----w- c:\program files\Common Files\Java
    2010-02-10 20:35 . 2009-12-17 22:14 411368 ----a-w- c:\windows\system32\deploytk.dll
    2010-02-10 19:01 . 2010-02-11 19:52 -------- d-----w- c:\programdata\RegCure
    2010-02-10 12:54 . 2010-02-10 19:51 -------- d-----w- c:\users\Owner\AppData\Local\Diagnostics
    2010-02-10 12:46 . 2010-02-10 12:45 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
    2010-02-10 12:46 . 2010-02-10 12:45 107368 ----a-r- c:\windows\system32\GEARAspi.dll
    2010-02-10 12:45 . 2010-03-08 02:23 -------- d-----w- c:\program files\Symantec
    2010-02-10 12:44 . 2010-02-10 19:55 -------- d-----w- c:\windows\system32\drivers\N360
    2010-02-10 12:42 . 2010-02-10 12:42 -------- d-----w- c:\programdata\PCSettings
    2010-02-10 12:34 . 2010-02-10 12:34 79 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\PE.dll
    2010-02-10 12:34 . 2010-02-10 12:34 72 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\energy.drv
    2010-02-10 12:34 . 2010-02-10 12:34 71 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys
    2010-02-10 12:34 . 2010-02-10 12:34 69 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\delfile.drv
    2010-02-10 12:34 . 2010-02-10 12:34 59 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\kernel32.dll
    2010-02-10 12:34 . 2010-02-10 12:34 5 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\snl2w.dll
    2010-02-10 12:34 . 2010-02-10 12:34 47 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\std.dll
    2010-02-10 12:34 . 2010-02-10 12:34 28 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\delfile.dll
    2010-02-10 12:34 . 2010-02-10 12:34 24 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\dudl.exe
    2010-02-10 12:34 . 2010-02-10 12:34 19 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\pal.sys
    2010-02-10 12:34 . 2010-02-10 12:34 13 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\PE.exe
    2010-02-09 17:55 . 2010-02-10 12:34 12 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\eb.sys
    2010-02-09 17:48 . 2010-02-09 17:51 38434288 ----a-w- c:\programdata\Toshiba\TSS\Plugins\SwUpdates\Packages\4d92cef8-7ed7-402d-aa91-6eda708f6bb8\171515_14.32.13.TC00143300K.exe
    2010-02-09 17:46 . 2010-02-10 12:34 23 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\eb.drv
    2010-02-09 17:46 . 2010-02-10 12:34 2 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\CLSV.exe
    2010-02-09 17:46 . 2010-02-09 17:46 41 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\tjd.drv
    2010-02-09 17:46 . 2010-02-10 12:34 61 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv
    2010-02-09 17:46 . 2010-02-10 12:34 3 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys
    2010-02-09 17:46 . 2010-02-09 17:46 35 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\fix.dll
    2010-02-09 17:46 . 2010-02-09 17:46 3 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\sld.drv
    2010-02-09 17:46 . 2010-02-09 17:46 43 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\hymt.exe
    2010-02-09 17:46 . 2010-02-09 17:46 24 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\cb.exe
    2010-02-09 17:45 . 2010-02-09 17:45 51 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.sys
    2010-02-09 17:45 . 2010-02-09 17:45 11 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\energy.sys
    2010-02-09 17:45 . 2010-02-09 17:46 34 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.dll
    2010-02-09 17:45 . 2010-02-10 12:34 6 ----a-w- c:\users\Owner\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.drv
    2010-02-09 17:45 . 2010-02-15 04:15 -------- d-----w- c:\programdata\3fa8f
    2010-02-09 17:45 . 2010-02-09 17:45 -------- d-sh--w- c:\programdata\SABRV
    2010-02-09 17:45 . 2010-02-10 12:49 -------- d-----w- C:\cd65301
    2010-02-09 06:32 . 2010-02-09 06:32 -------- d-----w- c:\programdata\McAfee

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-02-24 14:16 . 2009-12-30 20:03 181632 ------w- c:\windows\system32\MpSigStub.exe
    2010-02-20 18:34 . 2009-09-02 05:46 -------- d-----w- c:\program files\Microsoft Silverlight
    2010-02-19 02:40 . 2009-12-14 23:17 -------- d-----w- c:\programdata\Microsoft Help
    2010-02-19 02:39 . 2009-12-14 23:08 -------- d-----w- c:\program files\Microsoft Works
    2010-02-10 20:35 . 2009-09-02 05:29 -------- d-----w- c:\program files\Java
    2010-02-10 12:44 . 2009-12-14 23:49 -------- d-----w- c:\programdata\Norton
    2010-02-10 12:42 . 2009-12-14 23:49 -------- d-----w- c:\programdata\NortonInstaller
    2010-01-24 18:26 . 2010-01-02 03:35 1670624 ----a-w- c:\programdata\WildTangent\TOSHIBA Game Console\Downloads\en-us\Installers\SetupGamesClient.exe
    2010-01-23 03:07 . 2009-09-02 05:47 -------- d-----w- c:\programdata\Partner
    2010-01-18 23:29 . 2010-02-10 03:54 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
    2010-01-18 23:29 . 2010-02-10 03:54 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
    2010-01-18 23:29 . 2010-02-10 03:54 365568 ----a-w- c:\windows\system32\secproc_isv.dll
    2010-01-18 23:29 . 2010-02-10 03:54 369152 ----a-w- c:\windows\system32\secproc.dll
    2010-01-18 23:28 . 2010-02-10 03:54 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
    2010-01-18 23:28 . 2010-02-10 03:54 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
    2010-01-18 23:28 . 2010-02-10 03:54 320512 ----a-w- c:\windows\system32\RMActivate.exe
    2010-01-18 23:28 . 2010-02-10 03:54 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
    2010-01-08 03:18 . 2010-02-10 03:54 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2010-01-08 03:17 . 2010-02-10 03:54 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2010-01-03 07:42 . 2010-01-03 07:42 79367 ----a-w- c:\users\Owner\AppData\Roaming\Google\Google Talk\uninstall.exe
    2009-12-30 20:01 . 2009-12-30 20:01 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbBA5B.tmp.exe
    2009-12-30 19:41 . 2009-12-30 19:41 79136 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-12-30 19:39 . 2009-12-30 19:39 13 --sh--r- c:\windows\system32\drivers\fbd.sys
    2009-12-19 09:02 . 2010-01-22 03:55 977920 ----a-w- c:\windows\system32\wininet.dll
    2009-12-19 09:02 . 2010-02-10 03:54 12288 ----a-w- c:\windows\system32\tsbyuv.dll
    2009-12-19 09:02 . 2010-02-10 03:54 1328640 ----a-w- c:\windows\system32\quartz.dll
    2009-12-19 09:02 . 2010-02-10 03:54 22016 ----a-w- c:\windows\system32\msyuv.dll
    2009-12-19 09:02 . 2010-02-10 03:54 31744 ----a-w- c:\windows\system32\msvidc32.dll
    2009-12-19 09:02 . 2010-02-10 03:54 13312 ----a-w- c:\windows\system32\msrle32.dll
    2009-12-19 09:02 . 2010-02-10 03:54 84480 ----a-w- c:\windows\system32\mciavi32.dll
    2009-12-19 09:02 . 2010-02-10 03:54 50176 ----a-w- c:\windows\system32\iyuv_32.dll
    2009-12-19 09:02 . 2010-02-10 03:54 91648 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
    2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MyTOSHIBA"="c:\program files\TOSHIBA\My Toshiba\MyToshiba.exe" [2009-08-06 264048]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-02 39408]
    "googletalk"="c:\users\Owner\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "Google Update"="c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-02-11 135664]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-29 7625248]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-21 1545512]
    "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-08-21 476512]
    "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-07-28 460088]
    "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2009-08-05 738616]
    "ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-08-17 1294136]
    "TosWaitSrv"="c:\program files\TOSHIBA\TPHM\TosWaitSrv.exe" [2009-08-07 611672]
    "Teco"="c:\program files\TOSHIBA\TECO\Teco.exe" [2009-08-12 1324384]
    "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-08-04 611672]
    "NortonOnlineBackupReminder"="c:\program files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" [2009-07-16 529256]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

    c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorUser"= 2 (0x2)
    "EnableUIADesktopToggle"= 0 (0x0)

    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
    R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-30 176128]
    S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [2009-08-11 185712]
    S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2009-08-12 185712]
    S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-20 12920]
    S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2009-07-07 7680]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-31 187392]
    S3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-08-17 51512]
    S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-08-04 111960]
    S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2009-08-07 685424]


    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{01250B8F-D947-4F8A-9408-FE8E3EE2EC92}]
    2009-08-06 16:15 264048 ----a-w- c:\program files\TOSHIBA\My Toshiba\MyToshiba.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2010-03-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3957342637-2223780103-148138915-1000Core.job
    - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-11 15:52]

    2010-03-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3957342637-2223780103-148138915-1000UA.job
    - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-11 15:52]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
    FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\xmmpllk7.default\
    FF - prefs.js: browser.startup.homepage - www.google.com

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2010-03-09 09:35:52
    ComboFix-quarantined-files.txt 2010-03-09 14:35
    ComboFix2.txt 2010-03-09 14:25

    Pre-Run: 277,067,923,456 bytes free
    Post-Run: 277,016,489,984 bytes free

    - - End Of File - - C5465729298489B4BB5817C001802368

  10. #10
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    ComboFix run shouldn't take hours this time. If it gets stuck again try to run in safe mode.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •