# computer frozen, likely virus?



## Ice4 (Oct 8, 2007)

While I was downloading something today, my computer froze completely. I finally had to force it to shut down. Tried Ctrl/Alt/Delete, but unresponsive. After I rebooted the computer froze again, I tired Ctrl/Alt/Delete again, and at one point it went to a Windows screen saying something about "preparing security settings", and hung there for a long time. I was concerned whatever virus I likely caught was messing with my settings, so shut it down again.

Tried repeatedly to run Avira on reboot, once I got to 42.4%, but the computer froze again. Shut it down for a few minutes, unplugged, without battery, and it took about 20 minutes to finally get another scan running. It found nothing. At least it didn't alert me to anything, and so far I've not been able to get into the reports window of Avira again. But after the scan the computer was moving at a more normal pace again, so I decided to shut it down normally once more. I also managed to delete the file I believe may have been infected somewhere in the midst of all this.

After reboot it was frozen again. I clicked on a program icon, and the computer hung there for a long time, the clock frozen for about 5 minutes, and during this time a Windows message said something like "The application is not responding. The program may respond again if you let it finish. Do you want to end the process". It didn't say any specific program. I ignored it, to see what would happen. The entire little message window was entitled Microsoft Windows, and I assume this means that Windows itself was having problems (maybe this question belongs in the Windows 7 forum instead?). Once the window went away, I could move the mouse again, but as soon as I as much as hovered over an icon in the task bar, it froze again, and that window popped up. 

I wonder if something went terribly wrong with Windows during the many shut downs, or if there's still an infection on the loose. I should also mention that the computer was just reset to factory settings a few days ago. At this point I basically can't do anything. Every tiniest move I make takes forever, and most of the time nothing happens. I've not been able to load my browser. I finally managed to get the task manager to open, and Firefox had started to load, but never finished. It's a huge mess, and I'm at a loss as to what to do. I'm using a very unreliable computer right now, and really need the other one to work. 

Could someone help me please?


----------



## Ice4 (Oct 8, 2007)

When I tried to shut down the computer it again wouldn't let me. Finally froze on a black screen after Ctrl/Alt/Delete. 

After pushing the power button and rebooting after a while, I finally managed to view the reports page in Avira (took half an hour to open), and it does indeed say there was no detection during the last scan. 

I also managed to open the task manager, but when I click on "show processes for all users" nothing happens. After I did that, I got a warning that Avira was suddenly turned off. I tried to open the "Action Center" to fix it, but it wouldn't open. Avira looks like it's turned on in the task menu, though. 

Since then the task manager has been beeping at me anytime I click on it, and is now otherwise completely unresponsive. Can't even minimize it to see if there's another error message somewhere hidden. I've experienced this sort of thing with my old computer, which has very little RAM, and the computer would freeze like this, and error messages would pop up and hide behind the very window that was frozen and couldn't be moved. But this computer has lots of RAM, and it's now moving slower than the old computer ever did, even on a bad day. 

I now see that there is a process in the task manager that wasn't there before, consent.exe, and I wonder if the presumed invisible message is some sort of administrator approval request. I've never needed that before to look at all processes, but I wonder if whatever virus might be at work here changed the settings when it said "preparing security settings".

The computer has been frozen for 20 minutes now. The clock stopped, a transparent white overlay over the entire desktop, with the little twirly circle Window displays when it's doing something. Task manager says 0% CPU, 30% Physical Memory. Going to wait a little while longer, than try to shut it down again.


----------



## Ice4 (Oct 8, 2007)

Correction: The message about security was "preparing security options...". Just got it again when I did Ctrl/Alt/Delete. Shut down by power button again. 

I looked up "preparing security options..." and others are apparently having similar issues that end on that screen, but I've not discovered any definitive answer about what to do about it. Also not clear if this is due to a virus (some people say Windows doesn't generate such a message), or a hardware issue, and some people say it's an issue with drivers.

I'm giving up for tonight. Really hope someone here has some insight. This is a very new machine and I've had a bunch of issues with it already, so was told by Dell to go back to factory settings. Had just gone through all that last week.


----------



## kevinf80 (Mar 21, 2006)

Can you run the following and post the two logs...

Download and save DDS to your Desktop from either of the following links:

*Link 1*
*Link 2*

Double click DDS to run the scan, Vista or Windows 7 user accept UAC alert.
There will be an alert that two logs will be saved to the Desktop, DDS.txt and Attach.txt 
Copy and paste those two logs to your reply when the scan is complete....

If you cannot get DDS to run let me know what version of OS you are running, also if 32 bit or 64 bit....

Kevin


----------



## Ice4 (Oct 8, 2007)

Been trying to get Firefox to open for a couple of hours. I got the task manager open, and again Firefox was stuck, at about 1,500K. I finally stopped the process in the task manager, and tried again. Firefox stopped at 116K. I waited for another half hour for something to happen, but the only process that was really active I was Dell Support Center (pcdrcui.exe) which counted down from several thousand K and finally stabilized at 768K. 

All the while my CPU was jumping around as much as up to 49%, with none of the visible processes involved (I gave up on trying to make all the other processes visible, since that repeatedly froze up everything and prevented me from even shutting down the computer).

I tried to end Firefox again, but the computer froze again completely. After half an hour it finally unfroze and tried to stop it again, and it did within a couple of minutes. Dell Support Center seems to be involved in this somehow. It started moving again, but this time the CPU stayed at 0%.

I tried to open Firefox from the programs list in the Start menu, but it froze at every step. Of course Firefox isn't even listed in the program list because it's in Window's special 32-bit file, so I clicked on Internet Explorer instead. As I was doing that I got another alert that Avira is turned off, but the Avira icon shows it's on. I did get DDS to run, so I will now try to copy and paste that. I've been writing this on the old, unreliable computer.

My OS is Windows 7 Home Premium 64-bit.


----------



## Ice4 (Oct 8, 2007)

dds.txt:

DDS (Ver_2012-11-07.01) - NTFS_AMD64 
Internet Explorer: 9.0.8112.16450
Run by IF at 19:34:43 on 2012-11-11
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3494.2074 [GMT -8:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files\Soluto\SolutoLauncherService.exe
C:\Program Files\Soluto\SolutoService.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Classic Shell\ClassicStartMenu.exe
C:\Program Files (x86)\Kalender\Kalender.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\windows\system32\taskmgr.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\servicing\TrustedInstaller.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\svchost.exe -k AxInstSVGroup
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: ClassicIE9BHO Class: {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll
TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
uRun: [Kalender] C:\Program Files (x86)\Kalender\Kalender.exe
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [RoxWatchTray] "c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
mRunOnce: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
mRunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe
IE: {64964764-1101-4bbd-8891-B56B1A53B9B3} - {553891B7-A0D5-4526-BE18-D3CE461D6310}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
TCP: NameServer = 75.101.19.192 66.117.136.6
TCP: Interfaces\{43869EC2-32E7-4BAF-8EA4-E8E12825C4A2} : DHCPNameServer = 75.101.19.192 66.117.136.6
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
x64-BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-BHO: ClassicIE9BHO Class: {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll
x64-TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll
x64-Run: [Persistence] C:\windows\System32\igfxpers.exe
x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
x64-Run: [Classic Start Menu] C:\Program Files\Classic Shell\ClassicStartMenu.exe
x64-Run: [Soluto] C:\Program Files\Soluto\soluto.exe /init
x64-IE: {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe
x64-IE: {64964764-1101-4bbd-8891-B56B1A53B9B3} - {553891B7-A0D5-4526-BE18-D3CE461D6310}
x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
x64-DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\IF\AppData\Roaming\Mozilla\Firefox\Profiles\h7i9zyx1.default\
FF - prefs.js: browser.startup.homepage - hxxp://us.mc634.mail.yahoo.com/mc/showFolder?fid=Inbox&order=down&tt=34165&pSize=200&noajax
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\windows\System32\drivers\PxHlpa64.sys [2012-3-2 55856]
R0 Soluto;Soluto;C:\windows\System32\drivers\Soluto.sys [2012-11-3 54728]
R1 avkmgr;avkmgr;C:\windows\System32\drivers\avkmgr.sys [2012-11-1 27800]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2012-3-2 89600]
R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-11-1 84256]
R2 AntiVirService;Avira Real-Time Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-11-1 108320]
R2 avgntflt;avgntflt;C:\windows\System32\drivers\avgntflt.sys [2012-11-1 99248]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664]
R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-2 483688]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2012-3-2 689472]
R2 SolutoLauncherService;Soluto Launcher Service;C:\Program Files\Soluto\SolutoLauncherService.exe [2012-10-31 159800]
R2 SolutoService;Soluto PCGenome Core Service;C:\Program Files\Soluto\SolutoService.exe [2012-10-31 625720]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\windows\System32\drivers\CtClsFlt.sys [2012-3-2 176096]
R3 IntcDAud;Intel(R) Display Audio;C:\windows\System32\drivers\IntcDAud.sys [2012-3-2 317440]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2012-3-2 533096]
R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2009-12-2 721768]
R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2009-12-2 269672]
R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2009-12-2 25960]
R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2009-12-2 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-2 209768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 DellDigitalDelivery;Dell Digital Delivery Service;C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [2011-10-26 162816]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-3-2 13336]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-3-2 2656280]
S3 BTWAMPFL;BTWAMPFL;C:\windows\System32\drivers\btwampfl.sys [2012-3-2 349736]
S3 btwl2cap;Bluetooth L2CAP Service;C:\windows\System32\drivers\btwl2cap.sys [2012-3-2 39464]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2012-3-2 250984]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2012-11-1 1255736]
S4 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]
S4 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-10-19 160944]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== File Associations ===============
.
FileExt: .txt: soffice.StarWriterDocument.6="C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe" -o "%1" [UserChoice]
.
=============== Created Last 30 ================
.
2012-11-12 03:32:34	--------	d--h--w-	C:\windows\AxInstSV
2012-11-09 09:42:31	--------	d-----w-	C:\Users\IF\AppData\Roaming\Foxit Software
2012-11-08 08:39:15	--------	d-----w-	C:\Users\IF\AppData\Local\{85445085-83AB-4CE9-9B93-52C8BB98A3BA}
2012-11-06 03:22:50	--------	d-----w-	C:\Users\IF\AppData\Roaming\temp
2012-11-05 10:18:57	--------	d-----w-	C:\windows\PCHEALTH
2012-11-05 10:18:57	--------	d-----w-	C:\Program Files (x86)\Microsoft Application Virtualization Client
2012-11-05 07:19:28	--------	d-----w-	C:\Users\IF\.thumbnails
2012-11-05 07:02:01	--------	d-----w-	C:\Users\IF\.gimp-2.4
2012-11-04 11:02:11	--------	d-----w-	C:\Users\IF\AppData\Local\Sonic_Solutions
2012-11-04 01:41:41	54728	----a-w-	C:\windows\System32\drivers\Soluto.sys
2012-11-04 01:41:40	--------	d-----w-	C:\Program Files\Soluto
2012-11-03 10:58:36	--------	d-----w-	C:\ProgramData\Soluto
2012-11-02 19:00:06	--------	d-----w-	C:\ProgramData\PCDr
2012-11-02 11:34:50	--------	d-----w-	C:\Users\IF\AppData\Local\Microsoft Games
2012-11-02 11:25:45	--------	d-----w-	C:\Program Files (x86)\GIMP-2.0
2012-11-02 11:00:18	--------	d-----w-	C:\Users\IF\AppData\Roaming\NCH Software
2012-11-02 10:59:47	--------	d-----w-	C:\Program Files (x86)\NCH Software
2012-11-02 08:44:30	--------	d-----r-	C:\Program Files (x86)\Skype
2012-11-02 06:58:48	--------	d-----w-	C:\Users\IF\AppData\Local\Macromedia
2012-11-02 06:57:47	73656	----a-w-	C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-02 06:57:47	696760	----a-w-	C:\windows\SysWow64\FlashPlayerApp.exe
2012-11-02 06:50:45	--------	d-----w-	C:\Users\IF\AppData\Local\Adobe
2012-11-02 05:45:35	--------	d-----w-	C:\Users\IF\AppData\Roaming\Avira
2012-11-02 05:40:08	99248	----a-w-	C:\windows\System32\drivers\avgntflt.sys
2012-11-02 05:40:08	27800	----a-w-	C:\windows\System32\drivers\avkmgr.sys
2012-11-02 05:40:06	--------	d-----w-	C:\ProgramData\Avira
2012-11-02 05:40:06	--------	d-----w-	C:\Program Files (x86)\Avira
2012-11-02 04:57:42	--------	d-----w-	C:\Program Files (x86)\Foxit Software
2012-11-02 03:33:46	--------	d-----w-	C:\windows\SysWow64\Wat
2012-11-02 03:33:44	--------	d-----w-	C:\windows\System32\Wat
2012-11-02 03:26:46	--------	d-----w-	C:\windows\pss
2012-11-02 00:48:01	--------	d-----w-	C:\ProgramData\SUPERSetup
2012-11-02 00:40:06	--------	d-----w-	C:\ProgramData\VirtualizedApplications
2012-11-02 00:33:57	--------	d-----w-	C:\Program Files (x86)\MSXML 4.0
2012-11-02 00:18:41	23408	----a-w-	C:\windows\System32\drivers\fs_rec.sys
2012-11-02 00:18:40	81408	----a-w-	C:\windows\System32\imagehlp.dll
2012-11-02 00:18:40	5120	----a-w-	C:\windows\SysWow64\wmi.dll
2012-11-02 00:18:40	5120	----a-w-	C:\windows\System32\wmi.dll
2012-11-02 00:18:40	159232	----a-w-	C:\windows\SysWow64\imagehlp.dll
2012-11-02 00:04:20	2622464	----a-w-	C:\windows\System32\wucltux.dll
2012-11-02 00:04:17	99840	----a-w-	C:\windows\System32\wudriver.dll
2012-11-02 00:04:09	36864	----a-w-	C:\windows\System32\wuapp.exe
2012-11-02 00:04:09	186752	----a-w-	C:\windows\System32\wuwebv.dll
2012-11-02 00:02:08	--------	d-----w-	C:\Users\IF\AppData\Roaming\UK's Kalender
2012-11-02 00:02:07	--------	d-----w-	C:\Program Files (x86)\Kalender
2012-11-01 23:59:34	--------	d-----w-	C:\Program Files (x86)\VideoLAN
2012-11-01 23:55:01	59392	----a-w-	C:\windows\System32\browcli.dll
2012-11-01 23:55:01	41984	----a-w-	C:\windows\SysWow64\browcli.dll
2012-11-01 23:55:01	136704	----a-w-	C:\windows\System32\browser.dll
2012-11-01 23:54:14	2048	----a-w-	C:\windows\SysWow64\tzres.dll
2012-11-01 23:54:14	2048	----a-w-	C:\windows\System32\tzres.dll
2012-11-01 23:53:26	376688	----a-w-	C:\windows\System32\drivers\netio.sys
2012-11-01 23:53:26	288624	----a-w-	C:\windows\System32\drivers\FWPKCLNT.SYS
2012-11-01 23:53:26	1913200	----a-w-	C:\windows\System32\drivers\tcpip.sys
2012-11-01 23:52:39	184320	----a-w-	C:\windows\System32\cryptsvc.dll
2012-11-01 23:52:39	1464320	----a-w-	C:\windows\System32\crypt32.dll
2012-11-01 23:52:39	140288	----a-w-	C:\windows\SysWow64\cryptsvc.dll
2012-11-01 23:52:39	140288	----a-w-	C:\windows\System32\cryptnet.dll
2012-11-01 23:52:39	1159680	----a-w-	C:\windows\SysWow64\crypt32.dll
2012-11-01 23:52:39	103936	----a-w-	C:\windows\SysWow64\cryptnet.dll
2012-11-01 23:52:13	3148800	----a-w-	C:\windows\System32\win32k.sys
2012-11-01 23:49:56	340992	----a-w-	C:\windows\System32\schannel.dll
2012-11-01 23:48:55	210944	----a-w-	C:\windows\System32\drivers\rdpwd.sys
2012-11-01 23:26:05	--------	d-----w-	C:\Users\IF\AppData\Local\Thunderbird
2012-11-01 23:20:01	--------	d-----w-	C:\Users\IF\AppData\Local\Mozilla
2012-11-01 23:16:22	--------	d-----w-	C:\Program Files (x86)\MozBackup
2012-11-01 22:58:40	--------	d-----w-	C:\Program Files\Classic Shell
2012-11-01 22:56:43	--------	d-----w-	C:\Users\IF\AppData\Roaming\OpenOffice.org
2012-11-01 22:55:25	--------	d-----w-	C:\Program Files (x86)\OpenOffice.org 3
2012-11-01 22:28:37	--------	d-----w-	C:\Users\IF\AppData\Roaming\IDT
2012-11-01 22:26:12	--------	d-----w-	C:\Users\IF\AppData\Roaming\SoftGrid Client
2012-11-01 22:26:12	--------	d-----w-	C:\Users\IF\AppData\Local\SoftGrid Client
2012-11-01 22:25:58	--------	d-----w-	C:\Users\IF\AppData\Local\Diagnostics
2012-11-01 22:25:27	--------	d-----w-	C:\Users\IF\AppData\Roaming\TP
2012-11-01 22:20:54	--------	d-----w-	C:\Users\IF\AppData\Roaming\Macrovision
2012-11-01 22:16:41	--------	d-----w-	C:\Users\IF\AppData\Roaming\Dell
2012-11-01 22:16:37	--------	d-----w-	C:\Users\IF\AppData\Roaming\Intel Corporation
2012-11-01 22:16:34	--------	d-----w-	C:\Users\IF\AppData\Roaming\Fingertapps
2012-11-01 22:16:31	--------	d-----w-	C:\Users\IF\AppData\Local\Dell
2012-11-01 22:15:54	--------	d-sh--w-	C:\$RECYCLE.BIN
2012-11-01 22:15:53	--------	d-----w-	C:\Users\IF\AppData\Local\VirtualStore
2012-11-01 18:48:54	--------	d-----w-	C:\windows\SMINST
.
==================== Find3M ====================
.
2012-08-30 18:03:45	5559664	----a-w-	C:\windows\System32\ntoskrnl.exe
2012-08-30 17:12:02	3968880	----a-w-	C:\windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12:02	3914096	----a-w-	C:\windows\SysWow64\ntoskrnl.exe
2012-08-24 18:05:07	220160	----a-w-	C:\windows\System32\wintrust.dll
2012-08-24 16:57:48	172544	----a-w-	C:\windows\SysWow64\wintrust.dll
2012-08-24 10:31:32	2312704	----a-w-	C:\windows\System32\jscript9.dll
2012-08-24 10:21:18	1392128	----a-w-	C:\windows\System32\wininet.dll
2012-08-24 10:20:11	1494528	----a-w-	C:\windows\System32\inetcpl.cpl
2012-08-24 10:14:45	173056	----a-w-	C:\windows\System32\ieUnatt.exe
2012-08-24 10:13:29	599040	----a-w-	C:\windows\System32\vbscript.dll
2012-08-24 10:09:42	2382848	----a-w-	C:\windows\System32\mshtml.tlb
2012-08-24 06:59:17	1800704	----a-w-	C:\windows\SysWow64\jscript9.dll
2012-08-24 06:51:27	1129472	----a-w-	C:\windows\SysWow64\wininet.dll
2012-08-24 06:51:02	1427968	----a-w-	C:\windows\SysWow64\inetcpl.cpl
2012-08-24 06:47:26	142848	----a-w-	C:\windows\SysWow64\ieUnatt.exe
2012-08-24 06:47:12	420864	----a-w-	C:\windows\SysWow64\vbscript.dll
2012-08-24 06:43:58	2382848	----a-w-	C:\windows\SysWow64\mshtml.tlb
.
============= FINISH: 19:35:17.26 ===============

attach.txt:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-07.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 11/1/2012 3:12:36 PM
System Uptime: 11/11/2012 5:27:04 PM (2 hours ago)
.
Motherboard: Dell Inc. | | 
Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz | CPU 1 | 2300/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 451 GiB total, 324.467 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
7-Zip 9.20 (x64 edition)
Accidental Damage Services Agreement
Adobe AIR
Adobe Flash Player 11 Plugin
Adobe Reader X MUI
Advanced Audio FX Engine
Avira Free Antivirus
Banctec Service Agreement
Blio
Classic Shell
Complete Care Business Service Agreement
Consumer In-Home Service Agreement
D3DX10
Dell DataSafe Local Backup
Dell DataSafe Local Backup - Support Software
Dell DataSafe Online
Dell Digital Delivery
Dell Edoc Viewer
Dell Getting Started Guide
Dell Home Systems Service Agreement
Dell MusicStage
Dell PhotoStage
Dell Product Registration
Dell Stage
Dell Stage Remote
Dell Support Center
Dell Touchpad
Dell VideoStage 
Dell Webcam Central
DirectX 9 Runtime
DW WLAN Card
Foxit Reader 5.1
GIMP 2.4.7
High-Definition Video Playback
IDT Audio
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Java Auto Updater
Java(TM) 7 Update 1
Java(TM) 7 Update 1 (64-bit)
Junk Mail filter update
Mesh Runtime
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MozBackup 1.5.1
Mozilla Firefox 12.0 (x86 en-US)
Mozilla Maintenance Service
Mozilla Thunderbird 12.0.1 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 10 Movie ThemePack Basic
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Nero Update
OpenOffice.org 3.4
PhotoShowExpress
PlayReady PC Runtime x86
Premium Service Agreement
QualxServ Service Agreement
Quickset64
RBVirtualFolder64Inst
Realtek Ethernet Controller Driver
Realtek USB 2.0 Card Reader
Roxio Activation Module
Roxio BackOnTrack
Roxio Burn
Roxio Creator Starter
Roxio Express Labeler 3
Roxio File Backup
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Skype 6.0
Soluto
Sonic CinePlayer Decoder Pack
SyncUP
UK's Kalender 2.3.2
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
VLC media player 2.0.1
WavePad Sound Editor
WIDCOMM Bluetooth Software
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Zinio Reader 4
.
==== Event Viewer Messages From Past Week ========
.
11/11/2012 7:26:58 PM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
11/11/2012 7:17:19 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Font Cache Service service to connect.
11/11/2012 7:17:19 PM, Error: Service Control Manager [7000] - The Windows Font Cache Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/11/2012 6:29:59 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
11/11/2012 6:11:45 PM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.
11/11/2012 6:02:11 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Management and Security Application User Notification Service service to connect.
11/11/2012 6:02:11 PM, Error: Service Control Manager [7000] - The Intel(R) Management and Security Application User Notification Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/11/2012 6:00:42 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
11/11/2012 5:58:19 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
11/11/2012 5:57:51 PM, Error: Service Control Manager [7022] - The Security Center service hung on starting.
11/11/2012 5:57:33 PM, Error: Service Control Manager [7022] - The Software Protection service hung on starting.
11/11/2012 5:52:58 PM, Error: Service Control Manager [7022] - The Intel(R) Management and Security Application Local Management Service service hung on starting.
11/11/2012 5:44:04 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Management and Security Application Local Management Service service to connect.
11/11/2012 5:44:04 PM, Error: Service Control Manager [7000] - The Intel(R) Management and Security Application Local Management Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/11/2012 5:42:04 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Rapid Storage Technology service to connect.
11/11/2012 5:42:04 PM, Error: Service Control Manager [7000] - The Intel(R) Rapid Storage Technology service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/11/2012 5:38:03 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Dell Digital Delivery Service service to connect.
11/11/2012 5:38:03 PM, Error: Service Control Manager [7000] - The Dell Digital Delivery Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/11/2012 5:33:59 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.
11/11/2012 5:32:58 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
11/11/2012 5:32:22 PM, Error: Service Control Manager [7022] - The Background Intelligent Transfer Service service hung on starting.
11/11/2012 2:22:32 AM, Error: Service Control Manager [7001] - The Intel(R) Management and Security Application User Notification Service service depends on the Intel(R) Management and Security Application Local Management Service service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
11/11/2012 2:11:55 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.
11/11/2012 2:07:57 AM, Error: Service Control Manager [7022] - The Windows Font Cache Service service hung on starting.
11/11/2012 12:08:20 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.
11/11/2012 12:08:20 AM, Error: Service Control Manager [7000] - The Software Protection service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/10/2012 9:18:23 PM, Error: Service Control Manager [7034] - The Dell Digital Delivery Service service terminated unexpectedly. It has done this 1 time(s).
.
==== End Of File ===========================


----------



## kevinf80 (Mar 21, 2006)

Thanks for the logs, run the following:

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from the following link :-

*Combofix*


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

 Disable all security programs as they will have a negative effect on Combofix, instructions available *Here* if required. Be aware the list may not have all programs listed, if you need more help please ask.

 Close any open browsers and any other programs you might have running

 Double click the







icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)

 Instructions for running Combofix available *Here* if required.

 If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.

 When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

*******Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze* ******

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read *Here* why disabling autoruns is recommended.

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 *If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal*
 If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin


----------



## Ice4 (Oct 8, 2007)

I'm running it now. Even though Avira is shut down, once ComboFix started an Avira pop up happened that said that a suspicious attempt to access the registry was blocked. It went away too fast for me to type in everything it said, especially since my old computer is really slow and the keyboard wonky. But ComboFix seems to be doing its thing.

I also want to mention that the Dell Support Center disappeared from the task manager after a while, and the computer then began to function normally. I even managed to open up Firefox, which took about 5 seconds, and backed up a few files I had created since I restored to factory settings.

Thanx so much for helping me, Kevin.


----------



## Ice4 (Oct 8, 2007)

Here's the ComboFix log:

ComboFix 12-11-12.01 - IF 11/12/2012 1:07.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3494.2112 [GMT -8:00]
Running from: c:\users\IF\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-10-12 to 2012-11-12 )))))))))))))))))))))))))))))))
.
.
2012-11-12 09:11 . 2012-11-12 09:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-11-05 10:18 . 2012-11-05 10:18	--------	d-----w-	c:\program files (x86)\Microsoft Application Virtualization Client
2012-11-05 10:18 . 2012-11-05 10:18	--------	d-----w-	c:\windows\PCHEALTH
2012-11-05 10:18 . 2012-11-05 10:18	--------	d-----w-	c:\program files\Microsoft Office
2012-11-04 02:41 . 2012-11-04 02:41	--------	d-----w-	c:\programdata\Creative
2012-11-04 01:41 . 2012-11-04 01:41	--------	dc----w-	c:\windows\system32\DRVSTORE
2012-11-04 01:41 . 2012-10-31 17:58	54728	----a-w-	c:\windows\system32\drivers\Soluto.sys
2012-11-04 01:41 . 2012-11-04 01:41	--------	d-----w-	c:\program files\Soluto
2012-11-03 10:58 . 2012-11-04 02:06	--------	d-----w-	c:\programdata\Soluto
2012-11-02 19:00 . 2012-11-02 19:00	--------	d-----w-	c:\programdata\PCDr
2012-11-02 11:25 . 2012-11-02 11:25	--------	d-----w-	c:\program files (x86)\GIMP-2.0
2012-11-02 11:00 . 2012-11-02 11:00	--------	d-----w-	c:\programdata\NCH Software
2012-11-02 10:59 . 2012-11-02 10:59	--------	d-----w-	c:\program files (x86)\NCH Software
2012-11-02 10:57 . 2012-11-02 10:57	--------	d-----w-	c:\program files\7-Zip
2012-11-02 08:44 . 2012-11-02 08:44	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2012-11-02 00:48 . 2012-11-02 00:48	--------	d-----w-	c:\programdata\SUPERSetup
2012-11-02 00:40 . 2012-11-02 00:41	--------	d-----w-	c:\programdata\VirtualizedApplications
2012-11-02 00:38 . 2012-09-28 07:18	65309168	----a-w-	c:\windows\system32\MRT.exe
2012-11-02 00:33 . 2012-11-02 00:33	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2012-11-02 00:18 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-11-02 00:18 . 2012-03-01 06:33	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-11-02 00:18 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2012-11-02 00:18 . 2012-03-01 05:33	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-11-02 00:18 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-11-02 00:04 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-11-02 00:04 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-11-02 00:04 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-11-02 00:04 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-11-02 00:04 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-11-02 00:04 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-11-02 00:04 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-11-02 00:04 . 2012-06-02 22:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-11-02 00:04 . 2012-06-02 22:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2012-11-02 00:02 . 2012-11-02 00:02	--------	d-----w-	c:\program files (x86)\Kalender
2012-11-01 23:59 . 2012-11-01 23:59	--------	d-----w-	c:\program files (x86)\VideoLAN
2012-11-01 23:55 . 2012-06-09 05:43	14172672	----a-w-	c:\windows\system32\shell32.dll
2012-11-01 23:55 . 2012-07-04 22:16	73216	----a-w-	c:\windows\system32\netapi32.dll
2012-11-01 23:55 . 2012-07-04 22:13	59392	----a-w-	c:\windows\system32\browcli.dll
2012-11-01 23:55 . 2012-07-04 22:13	136704	----a-w-	c:\windows\system32\browser.dll
2012-11-01 23:55 . 2012-07-04 21:14	41984	----a-w-	c:\windows\SysWow64\browcli.dll
2012-11-01 23:54 . 2012-09-14 19:19	2048	----a-w-	c:\windows\system32\tzres.dll
2012-11-01 23:54 . 2012-09-14 18:28	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-11-01 23:53 . 2012-08-22 18:12	1913200	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-11-01 23:53 . 2012-08-22 18:12	376688	----a-w-	c:\windows\system32\drivers\netio.sys
2012-11-01 23:53 . 2012-08-22 18:12	288624	----a-w-	c:\windows\system32\drivers\FWPKCLNT.SYS
2012-11-01 23:52 . 2012-06-02 05:41	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2012-11-01 23:52 . 2012-06-02 05:41	140288	----a-w-	c:\windows\system32\cryptnet.dll
2012-11-01 23:52 . 2012-06-02 05:41	1464320	----a-w-	c:\windows\system32\crypt32.dll
2012-11-01 23:52 . 2012-06-02 04:36	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2012-11-01 23:52 . 2012-06-02 04:36	1159680	----a-w-	c:\windows\SysWow64\crypt32.dll
2012-11-01 23:52 . 2012-06-02 04:36	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2012-11-01 23:52 . 2012-07-18 18:15	3148800	----a-w-	c:\windows\system32\win32k.sys
2012-11-01 23:49 . 2012-06-02 05:45	340992	----a-w-	c:\windows\system32\schannel.dll
2012-11-01 23:48 . 2012-04-28 03:55	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-11-01 23:26 . 2012-11-01 23:26	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2012-11-01 23:16 . 2012-11-01 23:16	--------	d-----w-	c:\program files (x86)\MozBackup
2012-11-01 22:58 . 2012-11-01 22:58	--------	d-----w-	c:\program files\Classic Shell
2012-11-01 22:55 . 2012-11-01 22:55	--------	d-----w-	c:\program files (x86)\OpenOffice.org 3
2012-11-01 22:41 . 2012-11-01 22:41	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2012-11-01 22:12 . 2012-11-07 07:24	--------	d-----w-	c:\users\IF
2012-11-01 18:48 . 2012-11-01 18:48	--------	d-----w-	c:\windows\SMINST
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2012-04-01 16:12	608768	----a-w-	c:\program files\Classic Shell\ClassicExplorer32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kalender"="c:\program files (x86)\Kalender\Kalender.exe" [2010-08-23 933888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-10-17 384800]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-08-12 163040]
"DSUpdateLauncher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" [2010-07-21 18240]
"STToasterLauncher"="c:\program files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe" [2010-08-12 120032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 DellDigitalDelivery;Dell Digital Delivery Service;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe [2011-10-26 162816]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-13 13336]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [2011-08-18 349736]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2011-08-18 39464]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-02 1255736]
R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-10-19 160944]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S0 Soluto;Soluto;c:\windows\system32\DRIVERS\Soluto.sys [2012-10-31 54728]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-24 27800]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-10-17 84256]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]
S2 SolutoLauncherService;Soluto Launcher Service;c:\program files\Soluto\SolutoLauncherService.exe [2012-10-31 159800]
S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2012-10-31 625720]
S3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2011-01-20 176096]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-05-17 533096]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2009-12-03 721768]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2009-12-03 269672]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2009-12-03 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2009-12-03 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-01 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-12-14 04:09]
.
2012-11-12 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\pcdrcui.exe [2011-12-14 04:09]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2012-04-01 16:12	739328	----a-w-	c:\program files\Classic Shell\ClassicExplorer64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-03-29 608112]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-05-27 1128448]
"Classic Start Menu"="c:\program files\Classic Shell\ClassicStartMenu.exe" [2012-04-01 159744]
"Soluto"="c:\program files\Soluto\soluto.exe" [2012-10-31 1266744]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{56753E59-AF1D-4FBA-9E15-31557124ADA2} - c:\program files\Classic Shell\ClassicIE9_32.exe
TCP: DhcpNameServer = 75.101.19.192 66.117.136.6
FF - ProfilePath - c:\users\IF\AppData\Roaming\Mozilla\Firefox\Profiles\h7i9zyx1.default\
FF - prefs.js: browser.startup.homepage - hxxp://us.mc634.mail.yahoo.com/mc/showFolder?fid=Inbox&order=down&tt=34165&pSize=200&noajax
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1674242581-3923710296-262410455-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*f*l*v*ù-©%\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-11-12 01:21:54
ComboFix-quarantined-files.txt 2012-11-12 09:21
.
Pre-Run: 347,532,402,688 bytes free
Post-Run: 348,049,805,312 bytes free
.
- - End Of File - - D33614FD631CE5D8E09C9095F6639D37


----------



## kevinf80 (Mar 21, 2006)

Thanks for the Combofix log, nothing really sinister showing up. The file deleted by CF is suspicious and can be used for monitoring your system, maybe not malicious but not really wanted. It will have come from some software that is already installed.

The issue mentioned initially is something to do with Dell Support Center, the file you quoted monitors your system and checks for updates, changes etc etc. It would appear that is why that specific file is hogging resources and causing problems.

If you look at the Scheduled tasks that show in the CF log you see exactly when the scheduled runs happen. I suppose the date is when they were set up and the time is when it should happen. As this is a daily task that should only happen at 04:09 every day if the PC is active.
If the PC is off I`m not sure if the check is then done next time it is sensed as being available.

*2012-11-01 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-12-14 04:09]
.
2012-11-12 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\pcdrcui.exe [2011-12-14 04:09]*

I`m not really upto speed with Dell, maybe worth contacting them for information. The file is from PCDoctor which is part of the Dell setup,

Ok, bit of maintenance:

*Step 1*

Please download *AdwCleaner* by Xplode onto your Desktop.


 Please close all open programs and internet browsers.
 Double click on *Adwcleaner.exe* to run the tool.
 Click on *Delete*.
 Confirm each time with OK.
 Your computer will be rebooted automatically. A text file will open after the restart.
 Please post the content of that logfile in your reply.
 You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

Please post the log.

*Step 2*

Visit *ADOBE* and download the latest version of Acrobat Reader

Step 1 - Select your Operating System.
Step 2 - Select your Langauge.
Step 3 - Select latest version.

Untick the option for McAfee security scanner if offered.

Download and install.

Having the latest updates ensures there are no security vulnerabilities in your system.

*Step 3*

Your Java







maybe out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

*Upgrading Java:*

Go to *This site* and click on *"Do I have Java"*
It will check your current version and then offer to update to the latest version
Watch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it.

****Note:* Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if so - remove them.

*Step 4*

This is a temporay file cleaner, it will also empty various caches, it is not sinister and will not harm your system. If your security alerts to it, just accept and let it run....

Let me see the log from AdwCleaner, also let me know if the other steps completed OK. If you have any remaining issues or concerns, give me an update. Also how is PDr behaving?

Just leave Combofix for now, we can clean up shortly...

Kevin....:up:


----------



## Ice4 (Oct 8, 2007)

There was no temporary file cleaner in Step 4. Is there a link missing?

I don't much use Adobe Reader. I use Foxit. But I figure it's useful to have as a backup. I don't like its updater though, so always turn that off, and don't remember to update it very often. Is it better to remove Adobe, than to have an old copy I rarely use?

I didn't first remove the Java that came with the computer (Java 7 Update 1 (64-bit), so that's still in my Programs. The file I uploaded is Java 7 Update 9 (doesn't say anything about 64 or 32 bit). Should I remove the original one, or remove both and start over, or is this okay?

I always try to learn something when I come here, and I'm glad you confirmed what I was guessing at. I also noticed that scheduler for Dell Support Center, and thought that could have overwhelmed my computer, since I was downloading a large file and watching a movie at the same time. But I do that frequently, and even a scheduled AVG scan doesn't make my entire computer freeze when I do. I guess it was trying to finish what it started each time I rebooted, and had me running around in a needless panic, potentially doing harm to the computer in the process of forcibly shutting it down.

I honestly have no clue how PCDr behaves. I had no idea there was such a thing on my computer. If that program was to blame for this ordeal, which interrupted my birthday movie marathon, I would say it behaves very badly. I think I'll ask Dell what this does, and how to disable whatever schedules they put their programs on. You'd think there would at least be some sort of warning window that asks for permission, or at least alerts one that a major disruption is about to occur. I miss the days of appliances that don't do anything until I push a button. I'm almost ready to learn Linux....

The AdwCleaner made one change I can't live with. It deleted my homepage, which is my inbox, so I changed it back. Is there any reason this would be a problem?

Here's the AdwCleaner log:

# AdwCleaner v2.007 - Logfile created 11/12/2012 at 02:48:57
# Updated 06/11/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : IF - IF-PC
# Boot Mode : Normal
# Running from : C:\Users\IF\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

File Deleted : C:\Users\IF\AppData\Roaming\Mozilla\Firefox\Profiles\h7i9zyx1.default\searchplugins\Askcom.xml

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit
Key Deleted : HKLM\Software\Conduit

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v12.0 (en-US)

Profile name : default 
File : C:\Users\IF\AppData\Roaming\Mozilla\Firefox\Profiles\h7i9zyx1.default\prefs.js

Deleted : user_pref("browser.startup.homepage", "hxxp://us.mc634.mail.yahoo.com/mc/showFolder?fid=Inbox&order=[...]
Deleted : user_pref("extensions.aniweather.timeShifted", 348893);
Deleted : user_pref("extensions.m86sb.ta.categories", "{\r\n \"version\": \"3.504\",\r\n	\"Images\": {\r\n\[...]

*************************

AdwCleaner[S1].txt - [1145 octets] - [12/11/2012 02:48:57]

########## EOF - C:\AdwCleaner[S1].txt - [1205 octets] ##########


----------



## kevinf80 (Mar 21, 2006)

Sorry about TFC, here`s the instruction for it:

Download







TFC to your desktop, from either of the following links
*Link 1*
*Link 2*

 Save any open work. TFC will close all open application windows.
 Double-click TFC.exe to run the program. Vista or Windows 7 users accept the UAC alert.
 If prompted, click "Yes" to reboot.
TFC will automatically close any open programs, *including your Desktop*. Let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. TFC may re-boot your system, if not *Re-boot it yourself to complete cleaning process* *<---- Very Important *

Keep TFC it is an excellent, run weekly utility to keep your system optimized, it empties all user temp folders, Java cache etc etc. *Always remember to re-boot after a run, even if not prompted*

Regarding Adobe reader, if you prefer Foxit better to remove Adobe, especially if you don`t keep it updated.

The Java d/l tool will check your system and only install what is needed, I`d recommend to remove all other versions.

Regarding AdwCleaner, yep it will remove anything that is seen as a threat, or potential threat, if you`re happy with your homepage, just have it the way you like.

The issues with PCDr are all related to to Dell, as far as i`m aware. This is a system check facility that will monitor your system and make sure all is OK, it will also connect online and communicate. I`m not really up to speed with Dell systems, have a read at the following link http://www.pcdoctor-community.com/forum/index.php?topic=508.0 maybe ask a question yourself... Or contact Dell....

If you have no more issues let me know and we` can clean up, leave Combofix on your Desktop and i`ll give UNinstall info if you`re ready...

Kevin


----------



## Ice4 (Oct 8, 2007)

I uninstalled Adobe Reader. 

I also uninstalled both versions of Java and started from scratch. Something that occurred to me though is that Java is specific to the browser, so the automatic downloader gave me a 32-bit version. I think if I ever use IE, which is extremely rare, I may also need the 64-bit version, if I do something on there that requires Java.

I looked into Dell Support Center a little more, and found it in the Start menu programs list. I think I disabled all communications with Dell, and all scheduled tasks, and now I know it's there so I can do a scan when I want to. Seems to have some useful features, though I suspect Windows has most of these already in a less pretty version. I found a chart there that showed me each time I forcibly shut down the computer over the last 24 hours.

Do you have a link to more details about TFC that I can read up on and learn more about what I'm doing when I use it?

Thank you so much, Kevin, for helping me with this unruly machine. Inanimate objects shouldn't be more stubborn than I am. I think I'm ready for uninstall instructions.


----------



## kevinf80 (Mar 21, 2006)

Go here http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/ for info about TFC.

Next,

Remove Combofix now that we're done with it

Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")









 Please follow the prompts to uninstall Combofix.
 You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
The above procedure will delete the following:

 ComboFix and its associated files and folders.
 VundoFix backups, if present
 The C:_OtMoveIt folder, if present
 Reset the clock settings.
 Hide file extensions, if required.
 Hide System/Hidden files, if required.
 Reset System Restore.

*It is very important that you get a successful uninstall because of the extra functions done at the same time, let me know if this does not happen.*

Next,

Uninstall adwcleaner.exe

 Please close all open programs and internet browsers.
 Double click on adwcleaner.exe to run the tool.
 Click on *Uninstall*
 Click *Yes* at *Would you like to Uninstall Adwcleaner*

Any other issues let me know...


----------



## Ice4 (Oct 8, 2007)

Looks like I uninstalled ComboFix successfully. A small window popped up that said it's uninstalled. And the AdwCleaner icon is gone too, so I think I'm all set. Will read up on TFC, and the Dell Support Center as well. 

Thanx a whole lot for helping me take back the computer from malware and manufacturer's poltergeists. Truly much appreciated, Kevin!


----------



## kevinf80 (Mar 21, 2006)

You`re very welcome, Here are some tips to reduce the potential for malware infection in the future:

*Make proper use of your antivirus and firewall*

Antivirus and Firewall programs are integral to your computer security. However, just having them installed isn't enough. The definitions of these programs are frequently updated to detect the latest malware, if you don't keep up with these updates then you'll be vulnerable to infection. Many antivirus and firewall programs have automatic update features, make use of those if you can. If your program doesn't, then get in the habit of routinely performing manual updates, because it's important.

You should keep your antivirus and firewall guard enabled at all times, *NEVER* turn them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your antivirus program is a good idea to make sure you're system remains clean. Once a week should be adequate. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Install and use *WinPatrol* This will inform you of any attempted unauthorized changes to your system.

WinPatrol features explained *Here*

*Use a safer web browser*

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a few good free alternatives:

*Firefox*,

*Opera*, and

*Chrome*.

All of these are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial *HERE* which will help you to make IE *MUCH* safer.

These *browser add-ons* will help to make your browser safer:

*Web of Trust* warns you about risky websites that try to scam visitors, deliver malware or send spam. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous ones:

Available for *Firefox* and *Internet Explorer*.

*Green* to go, 
*Yellow* for caution, and 
*Red* to stop.

Available for *Firefox* only. *NoScript* helps to block malicious scripts and in general gives you much better control over what types of things webpages can do to your computer while you're browsing.

These are just a couple of the most popular add-ons, if you're interested in more, take a look at *THIS* article.

Here a couple of links by two security experts that will give some excellent tips and advice.

*So how did I get infected in the first place by Tony Klein*

*How to prevent Malware by Miekiemoes*

Finally this link *HERE* will give a comprehensive upto date list of free Security programs. To include - Antivirus, Antispyware, Firewall, Antimalware, Online scanners and rescue CD`s.

Don`t forget, the best form of defense is common sense. If you don`t recognize it, don`t open it. If something looks to good to be true, then it aint.

If no remaining issues hit the *Mark Solved* tab at the top of the thread,

Take care,

Kevin....:up:


----------



## Ice4 (Oct 8, 2007)

Everything seems to be running smoothly now. Thanx for all the help and tips, Kevin.


----------



## kevinf80 (Mar 21, 2006)

You`re very welcome, come back anytime.....:up:


----------

