Go Back   Cyber Tech Help Support Forums > Software > Malware Removal Forum

Notices

Reply
 
Topic Tools
  #16  
Old June 17th, 2012, 03:35 PM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.60.1
"EPSON SX130 Series" = EPSON SX130 Series Printer Uninstall
"EPSON SX410 Series" = EPSON SX410 Series Printer Uninstall
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{15EB20D6-5F13-41D0-BEF9-C9C44D6AC620}" = SDFormatter
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1D53B6F9-E66E-42D8-A221-4FF8AC134FD7}" = Roxio Activation Module
"{1DB67D53-4CC1-D7A7-C635-50872D7BDA26}" = CCC Help English
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{287EAC0F-6C96-4712-97A6-958510872CBB}" = Utility
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3383136B-4F86-4F05-8612-DD4BB16A1EAE}" = Roxio Creator 2009
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{36890640-0DE9-0456-9065-23F34828D849}" = Catalyst Control Center InstallProxy
"{3717C4F2-7412-4793-9BB8-D73D2817B3D6}" = Compro VideoMate C200 Plus
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{57AC79C8-157E-403A-A8D0-DD74EF71BAE2}" = Catalyst Control Center - Branding
"{59C8E590-AE35-F424-DFE4-2698C89EC118}" = Catalyst Control Center Localization All
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{5E06C076-E4E7-4239-A886-B3D8AC84C166}" = HP Print Diagnostic Utility
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7919D8D9-69FB-4E94-B330-04C4AF251867}" = Roxio Creator 2009
"{7A7B3764-7F17-4AB1-A1D3-3B01F5F07445}" = Roxio Creator 2009
"{7F88C9E5-12BD-404F-AC6A-108BAAC9B708}" = ASUS Gamer OSD
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{809D7E6D-915D-4EAD-821F-E13D93F37161}" = ASUS Smart Doctor
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A17C27D-0325-400C-8AA9-DAA6B16CBD74}" = Epson Event Manager
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}" = iLivid
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90157C5D-D791-4D36-8C2B-7553DC01D601}" = ASUS VGA Driver
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}" = Epson Easy Photo Print 2
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA749D64-3741-4D5F-B804-B0BC05D179D1}" = Roxio CinePlayer
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{C0FE37FA-0886-4B66-B01B-76CF70FB77AB}" = Roxio CinePlayer Decoder Pack
"{C268B5E1-A5DA-11DF-A289-005056C00008}" = Paragon Backup & Recovery™ 2010 Free Advanced
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CC208C6B-D80A-66A9-2BFC-5EF7E795DBD1}" = Catalyst Control Center Profiles Desktop
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BE}" = WinZip 15.0
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
Reply With Quote


  #17  
Old June 17th, 2012, 03:35 PM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E6E2D4C8-BB56-9B8D-6D05-D9055F109B76}" = HydraVision
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{F0457E70-5D48-42DC-840F-2C30F1BD7E21}" = AMD VISION Engine Control Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F9000000-0018-0000-0000-074957833700}" = ABBYY FineReader 9.0 Sprint
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"ABBYY FineReader 9.0 Sprint" = ABBYY FineReader 9.0 Sprint
"AC3Filter" = AC3Filter (remove only)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Battlelog Web Plugins" = Battlelog Web Plugins
"conduitEngine" = Conduit Engine
"DivX Setup" = DivX Setup
"EPSON Scanner" = EPSON Scan
"EPSON SX130 Series Useg" = User's Guide EPSON SX130 Series
"ESN Sonar-0.70.0" = ESN Sonar
"Guffinsbar Uninstall" = Guffins Toolbar
"iLivid" = iLivid
"InstallShield_{809D7E6D-915D-4EAD-821F-E13D93F37161}" = ASUS Smart Doctor
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Mozilla Firefox 13.0 (x86 en-GB)" = Mozilla Firefox 13.0 (x86 en-GB)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"N360" = Norton 360
"Picasa 3" = Picasa 3
"PowerDesk4.0" = My PowerDesk
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 12.0" = RealPlayer
"Registry Mechanic_is1" = PC Tools Registry Mechanic 11.0
"Smart Defrag 2_is1" = Smart Defrag 2
"StarCraft II" = StarCraft II
"WinLiveSuite" = Windows Live Essentials
"WRUNINST" = Webroot SecureAnywhere
"xvid" = XviD MPEG-4 Video Codec
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-227480352-21878563-2006682344-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for Family
"Google Chrome" = Google Chrome
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 13/06/2012 22:20:50 | Computer Name = Loft | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 15/06/2012 03:06:38 | Computer Name = Loft | Source = Application Error | ID = 1000
Description = Faulting application name: plugin-container.exe, version: 13.0.0.4535,
time stamp: 0x4fc8de63 Faulting module name: NPSWF32_11_3_300_257.dll_unloaded,
version: 0.0.0.0, time stamp: 0x4fc821fc Exception code: 0xc0000005 Fault offset:
0x6c879903 Faulting process id: 0x12d4 Faulting application start time: 0x01cd4ac4f39c6c08
Faulting
application path: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe Faulting
module path: NPSWF32_11_3_300_257.dll Report Id: a5f4d142-b6b8-11e1-acd9-001fc6889cd5

Error - 15/06/2012 13:08:42 | Computer Name = Loft | Source = MsiInstaller | ID = 1013
Description =

Error - 15/06/2012 13:16:28 | Computer Name = Loft | Source = Application Error | ID = 1000
Description = Faulting application name: ATKFUSService.exe, version: 7.14.10.305,
time stamp: 0x4b14b641 Faulting module name: ATKDispCPL.dll, version: 7.14.10.305,
time stamp: 0x4bb492f3 Exception code: 0x40000015 Fault offset: 0x0000000000033ede
Faulting
process id: 0x304 Faulting application start time: 0x01cd4b1a5b5313cf Faulting application
path: C:\Windows\system32\ATKFUSService.exe Faulting module path: C:\Windows\system32\ATKDispCPL.dll
Report
Id: d72fc893-b70d-11e1-be27-001fc6889cd5

Error - 15/06/2012 13:30:44 | Computer Name = Loft | Source = MsiInstaller | ID = 1013
Description =

Error - 15/06/2012 17:04:47 | Computer Name = Loft | Source = VSS | ID = 8194
Description =

Error - 16/06/2012 09:50:13 | Computer Name = Loft | Source = Application Hang | ID = 1002
Description = The program wmplayer.exe version 12.0.7601.17514 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1ac Start
Time: 01cd4bc69e7ac765 Termination Time: 60000 Application Path: C:\Program Files
(x86)\Windows Media Player\wmplayer.exe Report Id: fd6c1086-b7b9-11e1-beb1-001fc6889cd5


Error - 16/06/2012 10:02:45 | Computer Name = Loft | Source = Application Hang | ID = 1002
Description = The program Explorer.EXE version 6.1.7601.17567 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: c08 Start
Time: 01cd4bc79108de3e Termination Time: 0 Application Path: C:\Windows\Explorer.EXE

Report
Id: ec1133cc-b7bb-11e1-85d1-001fc6889cd5

Error - 16/06/2012 10:36:51 | Computer Name = Loft | Source = Application Error | ID = 1000
Description = Faulting application name: explorer.exe, version: 6.1.7601.17567,
time stamp: 0x4d672ee4 Faulting module name: SHLWAPI.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c9ab Exception code: 0xc0000005 Fault offset: 0x0000000000007306
Faulting
process id: 0x1270 Faulting application start time: 0x01cd4bcb70a17fb1 Faulting application
path: C:\Windows\explorer.exe Faulting module path: C:\Windows\system32\SHLWAPI.dll
Report
Id: b57424ca-b7c0-11e1-85d1-001fc6889cd5

Error - 16/06/2012 14:30:27 | Computer Name = Loft | Source = VSS | ID = 8194
Description =

[ Media Center Events ]
Error - 05/02/2011 17:26:38 | Computer Name = Lounge | Source = MCUpdate | ID = 0
Description = 21:26:20 - Failed to retrieve EpgListings (Error: The underlying connection
was closed: An unexpected error occurred on a receive.)

[ System Events ]
Error - 16/06/2012 12:50:19 | Computer Name = Loft | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\ASUS\SmartDoctor\atidgllk.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 16/06/2012 12:50:19 | Computer Name = Loft | Source = Service Control Manager | ID = 7000
Description = The atidgllk service failed to start due to the following error: %%1275

Error - 16/06/2012 12:50:20 | Computer Name = Loft | Source = Service Control Manager | ID = 7000
Description = The atillk64 service failed to start due to the following error: %%577

Error - 16/06/2012 12:50:21 | Computer Name = Loft | Source = Service Control Manager | ID = 7000
Reply With Quote
  #18  
Old June 17th, 2012, 03:36 PM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
Description = The atillk64 service failed to start due to the following error: %%577

Error - 16/06/2012 12:50:51 | Computer Name = Loft | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\ASUS\SmartDoctor\atidgllk.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 16/06/2012 12:50:51 | Computer Name = Loft | Source = Service Control Manager | ID = 7000
Description = The atidgllk service failed to start due to the following error: %%1275

Error - 16/06/2012 12:50:52 | Computer Name = Loft | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\ASUS\SmartDoctor\atidgllk.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 16/06/2012 12:50:52 | Computer Name = Loft | Source = Service Control Manager | ID = 7000
Description = The atidgllk service failed to start due to the following error: %%1275

Error - 16/06/2012 12:50:53 | Computer Name = Loft | Source = Service Control Manager | ID = 7000
Description = The atillk64 service failed to start due to the following error: %%577

Error - 16/06/2012 12:50:54 | Computer Name = Loft | Source = Service Control Manager | ID = 7000
Description = The atillk64 service failed to start due to the following error: %%577


< End of report >
Reply With Quote
  #19  
Old June 17th, 2012, 03:36 PM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-17 12:35:23
-----------------------------
12:35:23.136 OS Version: Windows x64 6.1.7601 Service Pack 1
12:35:23.136 Number of processors: 3 586 0x203
12:35:23.137 ComputerName: LOFT UserName:
12:35:24.001 Initialize success
12:36:47.594 AVAST engine defs: 12061700
12:36:57.485 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:36:57.491 Disk 0 Vendor: SAMSUNG_HD103SJ 1AJ10001 Size: 953869MB BusType: 3
12:36:57.510 Disk 0 MBR read successfully
12:36:57.519 Disk 0 MBR scan
12:36:57.529 Disk 0 Windows 7 default MBR code
12:36:57.544 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 712068 MB offset 495203625
12:36:57.555 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 241798 MB offset 63
12:36:57.587 Disk 0 scanning C:\Windows\system32\drivers
12:37:12.156 Service scanning
12:37:42.931 Modules scanning
12:37:42.952 Disk 0 trace - called modules:
12:37:42.965 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
12:37:42.975 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80046286b0]
12:37:42.988 3 CLASSPNP.SYS[fffff88001b8c43f] -> nt!IofCallDriver -> [0xfffffa80037bb520]
12:37:43.001 5 ACPI.sys[fffff88000eff7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80037c2060]
12:37:43.913 AVAST engine scan C:\Windows
12:37:46.564 AVAST engine scan C:\Windows\system32
12:42:23.218 AVAST engine scan C:\Windows\system32\drivers
12:42:46.576 AVAST engine scan C:\Users\Family
12:59:03.998 AVAST engine scan C:\ProgramData
13:03:18.718 Scan finished successfully
13:05:49.886 Disk 0 MBR has been saved successfully to "C:\Users\Family\Desktop\MBR.dat"
13:05:49.898 The log file has been saved successfully to "C:\Users\Family\Desktop\aswMBR.txt"
Reply With Quote
  #20  
Old June 18th, 2012, 01:00 AM
Jintan's Avatar
Jintan Jintan is offline
Cyber Tech Help Moderator
 
Join Date: Dec 2004
Posts: 49,162
Blog Entries: 1
Worst thing there is you have two antivirus programs, attacking each other and causing system damage. Need to deal with that fright off, then do other repairs. If either of these are paid versions, be sure to save any registration info so you can reinstall them later.

Go to Start - Control Panel - Programs - Programs and Features, then click on each of the following programs, if they show there, and click "Uninstall/Change".

Webroot SecureAnywhere

Reboot. Then uninstall:

Norton 360

And reboot. Then Go here and download the Norton Removal Tool that is appropriate for your version. Then close all open windows and disable all protective software, and click the downloaded file to completely remove Norton from your system. If the removal does not cause a reboot, reboot after the tool has completed the removal. Be sure to save all registration keys before running the tool if you plan to reinstall Norton later.

If you do not recall the version that is okay - the same tool is used for most versions. The exception is Norton 360, which requires you run a BUdump.exe tool first.

------------

After the reboot, go to Start - Control Panel - Programs - Programs and Features, then click on each of the following programs, if they show there, and click "Uninstall/Change".

Guffins Toolbar - Adware, spyware, search hijacker.
Conduit Engine - Adware, spyware, search hijacker.
iLivid - Adware.
Mozilla Maintenance Service - Installs a problematic function that most Firefox users try to get rid of.
My PowerDesk - Avanquest programs are all scams.
PC Tools Registry Mechanic - There are no "fixit" programs that actually do beneficial changes. Snappy scans a reports, do little, demand payment usually.
Smart Defrag 2 - Regular defragging hasn't been important since Windows 98. The newer NTFS file system and hardware advances make running frequent defrags kinda useless. Once every 6 months might be a good idea.

----------

Download the latest version of Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup-1.61.0.1400.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform quick scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
* The log is automatically saved by Malwarebytes and can be viewed by clicking the Logs tab in Malwarebytes.
* Copy and Paste the entire report in your next reply. If it calls for a reboot to complete the repairs do that as well then.

----------

Disable your antivirus program and click here and download the esetsmartinstaller_enu.exe Eset installer. Then click that file to run the scanner.

If you accept the Terms of Use, check the box and click Start. It will take a couple minutes for the scanner to get ready. When the Computer scan settings display shows, check the following boxes:

Remove found threats
Scan unwanted applications


Next to "Current scan targets: Operating memory, Local drives", click the "Change" word. Make sure you place a check next to all disk drives, including any external drives that are attached (no need to check off the floppy or DVD/CD-Rom drives).

Then click the Advanced option, the place a check next to the following (if it is not already checked):

Enable Anti-Stealth technology

Click Start. This scan may take a while, so please be patient.

If infection is found, at the end of the scan click "List of found threats".

In that display, at the bottom, select the option to save the results as a text file, and save that to your desktop. Post that back here please.

Post that log and the Malwarebytes log please.

Last edited by Jintan; June 18th, 2012 at 01:05 AM.
Reply With Quote
  #21  
Old June 18th, 2012, 05:14 PM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
Hi,
I have done all you asked.
Thank you very much for your help.


C:\Users\Family\Downloads\cnet2_DivXInstaller_exe. exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
D:\LOFT\Backup Set 2012-05-27 190007\Backup Files 2012-05-27 190007\Backup files 11.zip a variant of Win32/InstallCore.D application deleted - quarantined
D:\LOFT\Backup Set 2012-05-27 190007\Backup Files 2012-05-27 190007\Backup files 12.zip a variant of Win32/InstallCore.Q application deleted - quarantined
D:\LOFT\Backup Set 2012-05-27 190007\Backup Files 2012-06-10 190013\Backup files 3.zip Win32/SoftonicDownloader.D application deleted - quarantined
D:\LOFT\Backup Set 2012-06-17 190004\Backup Files 2012-06-17 190004\Backup files 11.zip a variant of Win32/InstallCore.D application deleted - quarantined
D:\LOFT\Backup Set 2012-06-17 190004\Backup Files 2012-06-17 190004\Backup files 12.zip multiple threats deleted - quarantined
Reply With Quote
  #22  
Old June 18th, 2012, 05:18 PM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.18.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Trianni Family :: LOFT [administrator]

Protection: Enabled

18/06/2012 14:21:34
mbam-log-2012-06-18 (14-21-34).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 253143
Time elapsed: 2 minute(s), 32 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 3
C:\Program Files (x86)\u4Uninstall Guffins.dll (PUP.MyWebSearch) -> Quarantined and deleted successfully.
C:\Users\Family\Downloads\PDFCreatorSetup.exe (PUP.Adware.InstallCore) -> Quarantined and deleted successfully.
C:\Users\Family\Downloads\SoftonicDownloader_for_d irectx.exe (PUP.ToolbarDownloader) -> Quarantined and deleted successfully.

(end)
Reply With Quote
  #23  
Old June 19th, 2012, 01:51 AM
Jintan's Avatar
Jintan Jintan is offline
Cyber Tech Help Moderator
 
Join Date: Dec 2004
Posts: 49,162
Blog Entries: 1
Just finding adware bundled installers, so no active infection there, and looking clean. What issues are there we still need to address please?
Reply With Quote
  #24  
Old June 19th, 2012, 11:53 AM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
Hi,
Everything is working except WAN Mini port (PPPOE) when I click on it this is the message I get

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)

Also in my documents there is lots of documents such as ~WRL0017.tmp and 2012-06-12 13.09.06 LOFT B16117 Error DXDiag.txt
Thank you very much for all your help.
Reply With Quote
  #25  
Old June 20th, 2012, 12:40 AM
Jintan's Avatar
Jintan Jintan is offline
Cyber Tech Help Moderator
 
Join Date: Dec 2004
Posts: 49,162
Blog Entries: 1
Those documents are just the results of Windows and programs running things like installs. If they are .tmp files, you can feel comfortable deleting them.

WAN Mini port (PPPOE)

Do you use something like DSL, where PPPOE might be involved?

Right click My Computer, left click Manage.

In that menu click Device Manager. Click the + symbol next to Network Adapters.

Is there a yellow or red icon next to anything there?
Reply With Quote
  #26  
Old June 20th, 2012, 09:50 AM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
I have adsl2 and wanted to set up my ethernet cable to my modem for faster broadband speeds ie for gaming. Yes there is a yellow icon next to WAN Mini port (PPPOE), but none on wifi adapter.
Thank you very much for all your help.
Reply With Quote
  #27  
Old June 20th, 2012, 11:51 PM
Jintan's Avatar
Jintan Jintan is offline
Cyber Tech Help Moderator
 
Join Date: Dec 2004
Posts: 49,162
Blog Entries: 1
In Device Manager, double click WAN Mini port (PPPOE).

Click the Details tab, use the dropdown box to change the view to Hardware Ids, then write down what shows in the top listing there for PCI\Ven_&DEV_XXXX (the X's you will need to replace with whatever letters/numbers show there).

Post that back here please.
Reply With Quote
  #28  
Old June 21st, 2012, 09:23 AM
ShineHunter ShineHunter is offline
Member
 
Join Date: Mar 2008
Posts: 76
I did as you ask, but all there was is ms_pppoeminiport. I couldn't see anything like PCI\Ven_&DEV_XXXX with a numbers/letters replacing the X's.
Thank you very much for all your help.
Reply With Quote
  #29  
Old June 22nd, 2012, 12:16 AM
Jintan's Avatar
Jintan Jintan is offline
Cyber Tech Help Moderator
 
Join Date: Dec 2004
Posts: 49,162
Blog Entries: 1
Quote:
Everything is working except WAN Mini port (PPPOE) when I click on it this is the message I get

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)
Click on it in what display please, and why is it an issue there?
Reply With Quote
Reply

Bookmarks

Topic Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump




All times are GMT +1. The time now is 02:29 PM.