Sister Pc continuation.

Discussion in 'Windows Vista and Windows 7' started by ROBPQ75651, Apr 16, 2012.

Recommended: Click here to Fix Errors and Optimize Windows

Page 1 of 3

  1. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    Hello agin,
    This is the toshiba laptop running vista 64 that I previously recieved help on. The computer was never completely "back to normal". However, my sister needed it back and it worked well enough. That is untill it completely crashed. It wouldn't start up vista, It would only show a blank black screen. After some research I reset the computer by unpluging and taking out the battery and holding the power button for a min. After that I could get it to start up. Very touchy and glitchy. I ran malwarebytes and it found 21 threats. I erased those and the computer works a little better now. Still glitchy though and not normal.



    I then did the OTL scan that came up with an error, I attatched a screen shot of what the computer error. Then I ran aswMBR and I have also attatched that log. Thank you for your time. -Rob

    Attached Files:

    ROBPQ75651, Apr 16, 2012
    #1

  2. Crush Administrator & Security Team Leader

    Manager
    PCHF Staff
    Message Count:
    39,892
    Likes Received:
    3,660
    My System
    Loading...
    Hi,

    Can you attach the Malwarebytes Anti-Malware log please?
    Crush, Apr 16, 2012
    #2

  3. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    Thank you for the quick reply!

    Attached Files:

    ROBPQ75651, Apr 16, 2012
    #3

  4. Google Advertisement

  5. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    593
    My System
    Loading...
    Can you run the aswMBR again please.
    Pancake, Apr 16, 2012
    #4

  6. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    This is the rescan

    Attached Files:

    ROBPQ75651, Apr 16, 2012
    #5

  7. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    593
    My System
    Loading...
    Download Combofix from any of the links below, and save it to your desktop.
    Link 1
    Link 2
    Link 3
    When saving ComboFix rename it to PCHelpForum.exe to prevent it from being blocked by malware.

    Refer to this image:
    To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.
    • Close any open windows and double click PCHelpForum.exe to run it.
      You will see the following image:
    [IMG]

    Click I Agree to start the program.
    ComboFix will then extract the necessary files and you will see this:

    [IMG]

    As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7
    It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    If you did not have it installed, you will see the prompt below. Choose YES.

    [IMG]

    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [IMG]

    Click on Yes, to continue scanning for malware.
    When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
    Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.
    Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
    Pancake, Apr 16, 2012
    #6

  8. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    I am just wondering how long this combo fix should take. It has been on the same screen for over an hour. "Attempting to create a new system restore point."
    ROBPQ75651, Apr 16, 2012
    #7

  9. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    593
    My System
    Loading...
    If it takes to long ,stop it and run it in safe mode.
    Pancake, Apr 16, 2012
    #8

  10. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    Alright. I stopped it and booted it safe mode, and ran combo fix again. It is now scanning but in the beginning it said that access was denied because I did not have administrator rights? Is there anything I should do now? or just wait for it to finish scanning?
    ROBPQ75651, Apr 16, 2012
    #9

  11. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    593
    My System
    Loading...
    Just let it run...
    Pancake, Apr 16, 2012
    #10

  12. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    This is the cobofix log.

    Attached Files:

    ROBPQ75651, Apr 16, 2012
    #11

  13. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    593
    My System
    Loading...
    ========================================
    WARNING these fixes are designed for this user only and may cause damage if run on any other machine.


    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
    It's IMPORTANT to carry out the instructions in the sequence listed below.
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    Open *notepad* and copy/paste the the text in the quotebox below into it:
    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.

    [IMG]
    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt
    Please copy and paste the ComboFix.txt in your next reply please.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*
    Pancake, Apr 16, 2012
    #12

  14. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    Thanks so much for the help. Here is the log

    ComboFix 12-04-15.02 - Owner 04/16/2012 1:14.1.2 - x64 NETWORK
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3960.3174 [GMT -7:00]
    Running from: c:\users\Owner\Desktop\PCHelpForum.exe
    Command switches used :: c:\users\Owner\Desktop\CFScript.txt
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    FILE ::
    "c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\OFFLINE\15D3A7BB\3E688669\stbappHelper.exe"
    "c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\OFFLINE\29A73ACD\3E688669\stb0.dll"
    "c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\OFFLINE\mFileBagIDE.dll\bag\stbpx.exe"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\OFFLINE\15D3A7BB\3E688669\stbappHelper.exe
    c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\OFFLINE\29A73ACD\3E688669\stb0.dll
    c:\programdata\{FB94CE54-2703-4BFF-8E94-A0AD14C0FA22}\OFFLINE\mFileBagIDE.dll\bag\stbpx.exe
    c:\windows\system32\wbem\Performance\WmiApRpl_new.ini
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-03-16 to 2012-04-16 )))))))))))))))))))))))))))))))
    .
    .
    2012-04-16 08:26 . 2012-04-16 08:26 -------- d-----w- C:\found.006
    2012-04-16 08:21 . 2012-04-16 08:44 -------- d-----w- c:\users\Owner\AppData\Local\temp
    2012-04-16 08:21 . 2012-04-16 08:21 -------- d-----w- c:\users\Public\AppData\Local\temp
    2012-04-16 08:21 . 2012-04-16 08:21 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
    2012-04-16 08:21 . 2012-04-16 08:21 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-04-16 08:21 . 2012-04-16 08:21 -------- d-----w- c:\users\AppData\AppData\Local\temp
    2012-04-15 23:17 . 2012-04-15 23:17 -------- d-----w- c:\users\Owner\AppData\Roaming\Uniblue
    2012-04-15 23:17 . 2012-04-15 23:17 -------- d-----w- c:\program files (x86)\Uniblue
    2012-04-14 06:01 . 2012-04-14 06:01 -------- d-----w- C:\found.005
    2012-04-14 05:44 . 2012-04-14 05:44 -------- d-----w- C:\5c865e3a68daa8f6a87af6664c
    2012-04-13 23:11 . 2012-04-13 23:11 -------- d-----w- C:\ebf1cf959fddc723049dc6a5
    2012-04-13 22:36 . 2012-04-13 22:36 -------- d-----w- C:\found.004
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-04-04 22:56 . 2011-12-28 05:58 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-03-07 00:15 . 2011-12-29 03:03 41184 ----a-w- c:\windows\avastSS.scr
    2012-03-07 00:15 . 2011-12-29 03:03 201352 ----a-w- c:\windows\SysWow64\aswBoot.exe
    2012-03-07 00:15 . 2011-12-29 05:20 258520 ----a-w- c:\windows\system32\aswBoot.exe
    2012-03-07 00:04 . 2011-12-29 05:20 819032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2012-03-07 00:04 . 2011-12-29 05:20 337240 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2012-03-07 00:02 . 2011-12-29 05:20 43864 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2012-03-07 00:01 . 2011-12-29 05:20 59224 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2012-03-07 00:01 . 2011-12-29 05:20 69976 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2012-03-07 00:01 . 2011-12-29 05:20 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-04-16_03.58.31 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-01-21 03:20 . 2012-04-16 08:41 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-01-21 03:20 . 2012-04-16 03:56 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-01-21 03:20 . 2012-04-16 03:56 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2008-01-21 03:20 . 2012-04-16 08:41 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-01-21 03:20 . 2012-04-16 03:56 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-01-21 03:20 . 2012-04-16 08:41 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-09-10 00:20 . 2009-08-14 14:16 19968 c:\windows\SysWOW64\ARP.EXE
    + 2006-11-02 15:45 . 2012-04-16 08:04 85550 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin
    + 2008-10-28 19:54 . 2012-04-16 08:04 13200 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1116967322-1370510870-1547881038-1000_UserData.bin
    + 2008-10-28 21:14 . 2012-04-16 08:43 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-10-28 21:14 . 2012-04-16 03:58 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2008-10-28 19:51 . 2012-04-16 03:58 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2008-10-28 19:51 . 2012-04-16 08:43 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2008-10-28 19:51 . 2012-04-16 03:58 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2008-10-28 19:51 . 2012-04-16 08:43 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2011-02-28 10:00 . 2009-10-12 21:55 40960 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Gpowershell.resources.dll
    + 2012-04-16 08:38 . 2012-04-16 08:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2012-04-16 03:55 . 2012-04-16 03:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2012-04-16 03:55 . 2012-04-16 03:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2012-04-16 08:38 . 2012-04-16 08:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2006-11-02 12:46 . 2012-04-15 22:02 608644 c:\windows\system32\perfh009.dat
    + 2006-11-02 12:46 . 2012-04-16 05:34 608644 c:\windows\system32\perfh009.dat
    - 2006-11-02 12:46 . 2012-04-15 22:02 106114 c:\windows\system32\perfc009.dat
    + 2006-11-02 12:46 . 2012-04-16 05:34 106114 c:\windows\system32\perfc009.dat
    - 2011-12-13 21:27 . 2012-04-16 03:58 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    + 2011-12-13 21:27 . 2012-04-16 08:43 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    + 2011-02-28 10:00 . 2009-10-09 21:39 651264 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.GPowerShell.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-02-02 1487240]
    .
    [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    2011-02-02 02:17 1487240 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-02-02 1487240]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files (x86)\Windows Sidebar\Sidebar.exe" [2008-01-21 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2009-03-28 24103720]
    "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-30 39408]
    "SpeedUpMyPC"="c:\program files (x86)\Uniblue\SpeedUpMyPC\launcher.exe" [2012-04-09 67960]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
    "PCMAgent"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360]
    "CLMLServer"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-07-11 188416]
    "Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-07-31 417792]
    "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
    "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
    "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-14 421160]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
    .
    c:\users\Owner\Pictures\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
    VZAccess Manager.lnk - c:\program files (x86)\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [N/A]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-04-08 17:12]
    .
    2012-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-04-08 17:12]
    .
    2012-04-16 c:\windows\Tasks\SpeedUpMyPC.job
    - c:\program files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe [2012-04-15 20:18]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2012-03-07 00:15 135408 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-25 151064]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-25 209432]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-25 181784]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-30 1216808]
    "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-02-06 431968]
    "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-12-06 52560]
    "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-12-11 519544]
    "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 865280]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.yahoo.com/
    mLocal Page = %SystemRoot%\system32\blank.htm
    uInternet Settings,ProxyOverride = *.local
    TCP: DhcpNameServer = 192.168.1.1
    CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
    .
    - - - - ORPHANS REMOVED - - - -
    .
    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
    @="Shockwave Flash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
    @Denied: (A 2) (Everyone)
    @=""
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
    @="FlashBroker"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVAST Software\Avast\AvastSvc.exe
    c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
    c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
    c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    .
    **************************************************************************
    .
    Completion time: 2012-04-16 01:47:45 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-04-16 08:47
    ComboFix2.txt 2012-04-16 04:06
    .
    Pre-Run: 121,353,515,008 bytes free
    Post-Run: 122,656,436,224 bytes free
    .
    - - End Of File - - 83B590473A5D361BE603015F928B8875
    ROBPQ75651, Apr 16, 2012
    #13

  15. Pancake Security Team

    PCHF Staff
    Message Count:
    13,484
    Likes Received:
    593
    My System
    Loading...
    Ok.All done.I see no more malware.Log looks good! All that was detected is now either in quarantine or system restore, both of which we'll be cleaning out in just a minute. Congratulations, well done.

    You can now uninstall ComboFix

    • Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
    • In the field, type in ComboFix /uninstall
    [IMG]

    (Note: Make sure there's a space between the word ComboFix and the forward-slash.)

    • Then, press Enter, or click OK.
    • This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.

    Over the course of the fix you've used a variety of special tools to help with the cleaning process - none of these are of any use to you now that you're clean, and it's best not to have them hanging around on your computer. OTC is a small program that removes all the leftover tools and logs from cleanup of malware.

    Please download OTC to your desktop.

    Double-click OTC to run it. (Vista users, please right click on OTC and select "Run as an Administrator")
    Click on the CleanUp! button and follow the prompts.
    You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
    After the reboot all the tools we used should be gone.
    Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

    Here are some tips to reduce the potential for malware infection in the future; I strongly suggest that you read them and take them to heart so that you don't have to endure the process of cleaning your computer again.
    Afterwork
    Malware Prevention
    How Did I Get Infected
    More Tips on Prevention

    =============================
    Pancake, Apr 16, 2012
    #14

  16. ROBPQ75651 Bronze Member

    I've Donated!
    Bronze
    Message Count:
    38
    Likes Received:
    0
    My System
    Loading...
    Thank you so much for the help. I feel that I am now malware free! I was wondering if I needed to talk with someone else about how to clean this thing up. Make sure registries are right? If i am even using that terminology correctly. The computer doesn't seem to be completely right. I tried to uninstall a toolbar and it took like 12 minutes, and tried to unistall safari and it took like and hour and never actually did. The computer froze. I can't bring up the task bar when the computer freezes. I have tried control+shift+esc & control+alt+delete to no avail. I end up just holding down the power button. I also keep getting errors like "apple sync" and "microsoft windows search protocol host stopped working and was closed". Thanks again for any help
    ROBPQ75651, Apr 17, 2012
    #15
Page 1 of 3

Sister Pc continuation.

Recommended: Click here to Fix Errors and Optimize Windows