Virus' found, using Ad-Aware scan in C:\Windows\temp\SBS_LIBNSIS_....I can quarantine them but would like to delete them. Thanks, Bill

Just wanted to add the following. All of the viruses discovered had this with them: "ADSPY/BetterInternet,YC" As in my title, I have scanned this with Ad-Aware 8.3.0. It detected a half dozen viruses or so and I quarantined them using that program. When I looked in it's quarantine file log, they were not there. Just by chance, I happened to be looking through Avira Antivir Personal,s quarantine logs, and there they were. I've tried deleting them, quarantining them, what am I to do?

Hey friends, it's 11:17pm here in Florida and I gotta turn in. I'll be back tomorrow after 1pm. Thanks and get some sleep!

Welcome. Thank you for using Dell Community Forums.

I am reviewing your log. In the meantime, you can help me by addressing the following:

* Have you have posted this issue on another forum? If so, please provide a link to the topic.

* If you have disabled System Restore in an attempt to begin cleaning malware, please enable it now. We will flush System Restore when we are finished cleaning and we are sure that everything is running smoothly.

* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE.

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.  The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a partial list HERE.

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures. Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using. Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. It is understood by the trained analysts that once a helper replies to a log, he continues working with you until the issue is resolved.

* During the course of our cleanup please do not do any additional online work or surfing until we have verified that your system is clean.

* We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them.

Please go to Add/Remove Programs and uninstall Marketscore.RelevantKnowledge. RelevantKnowledge is a MarketScore variant that monitors browsing habits and sends unsolicited advertisements. RelevantKnowledge is bundled in many freeware utilities, one or more of which someone using that computer must have installed. The related rlvknlg.exe file is a backdoor proxy component.

After that, we'll need to see some additional information about what is happening in your machine:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explanation about the tool.
• Click Yes at the prompt for Optional Scan.
• When done, DDS will open two (2) logs

1. DDS.txt
2. Attach.txt

• Save both reports to your desktop.
• Copy/paste both logs to your reply on the forum.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.

No Reply within 3 days will result in this topic being closed, and I will remove it from my subscriptions. If you require more time, please let me know.

Instructions posted for this user are customized for this user only. The tools used may cause damage if used on a computer with different infections. If you think you have similar problems, please post a log at the top of this board to start a new forum topic.

Thank you Bugbatter. Love that name. Did you get it from slapping mosquitos or did a bug land in your pancake mix? Wait, I know, you demolish computer bugs! Great name. I must tell you up front that I have a general knowledge of computers. I can see already, by your instructions, that you will explains what steps I should take very thoroughly. And I will do my best to follow them to a 'T'.

I have not posted on any other forum.

I have not disabled system restore.

I have no 'cracked' software that I am aware of based on the definition given.

This computer belongs to me exclusively.

I will copy all instructions to notepad and follow them in the sequence you prescribe.

I will not do anything I'm not instructed to do.

I fully understand that fixes are not instantaneous in most every case.

I will not do any additionalonline work or surfing until you give me the 'go ahead'. (I assume this includes checking and answering emails?)

The only P2P file I uninstalled was 'LimeWire'.

I did not find 'MarketScore.RelevantKnowledge' in my add/remove program.

I did a 'Search' for P2P and found lots of files with P2P included in their names, but I do not know if you wanted these deleted. Some are in C:\i386, C:\Windows\inf, C:\Windows\System32, C:\Windows\ServicePackFiles\i386 and a few more for a total of 37 files. Some names are p2p.dll,p2p,p2pgasvc.dll, p2pgraph.dll, p2pnetsch.dll, p2psvc.dll, sbp2port and the list continues.

I understand I may have too many antivirus programs running. This is because I don't what is necessary and what is not. I have used Avira Antivir Personal for many years after removing Macaffee and before that Norton because they really slowed down my computer and I liked the idea of free antivirus programs. I have also used Ad-Aware and CCleaner about as long. I, just last week, installed Superantispy at a friend's recommendation to try and remove these viruses, so I don't know much about it.

This is one of the few times in many years I have been stumped on deleting viruses, if indeed this is the problem. If you are allowed, please inform me as to which antivirus programs I do not need.

I'll be watching for your posts. Thanks again for this service. Bill

Thank you for the compliment on the name. My son came up with that when he was 2.

Those other files that you mentioned are Microsoft files. Please leave them where they are.

We'll remove those Relevant Knowledge entries from the Registry when we clean things up for you.

I await your DDS logs.

Here is the DDS.txt   I do not know how to attach the Attach.txt. I was able to zip it.

DDS (Ver_10-03-17.01) - NTFSx86 
Run by Bill at 15:26:23.13 on Sat 07/10/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1014.407 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated)   {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Bill\Local Settings\Temporary Internet Files\Content.IE5\UX2KZ485\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig/dell?hl=en
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\googleafe\GoogleAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,_RunDLLEntry@16
mRun: [dlccmon.exe] "c:\program files\dell photo aio printer 924\dlccmon.exe"
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe"  -osboot
mRun: [Google Quick Search Box] "c:\program files\google\quick search box\GoogleQuickSearchBox.exe"  /autorun
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUman000
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: musicmatch.com\online
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139782755687
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - hxxp://download.abacast.com/download/files/abasetup163.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\program,files\relevantknowledge\rlai.dll,c:\program,files\relevantknowledge\rlai.dll files\relevantknowledge\rlai.dll c:\progra~1\google\google~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-9 64288]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-10-17 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-17 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-10-17 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-29 56816]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-6-21 1352832]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-7 135664]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2005-12-29 30192]

=============== Created Last 30 ================

2010-07-08 20:16:21 0 d-----w- c:\docume~1\bill\applic~1\SUPERAntiSpyware.com
2010-07-08 20:16:21 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-07-08 20:16:11 0 d-----w- c:\program files\SUPERAntiSpyware
2010-07-06 16:06:28 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
2010-07-06 16:00:27 125695976 ----a-w- c:\program files\Ad-AwareInstall.exe
2010-07-01 22:36:56 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-07-01 22:36:56 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll
2010-07-01 22:36:43 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-07-01 22:36:43 60032 ----a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-06-25 19:01:56 3396176 ----a-w- c:\program files\ccsetup233.exe
2010-06-17 17:53:40 0 d-----w- c:\docume~1\bill\applic~1\W Photo Studio Viewer
2010-06-11 20:00:08 76230 ----a-w- c:\windows\MusicMatch Wallpaper.bmp
2010-06-11 14:56:53 3274 ----a-w- c:\windows\system32\wbem\Outlook_01cb0976543e94de.mof
2010-06-11 14:17:08 3274 ----a-w- c:\windows\system32\wbem\Outlook_01cb0970c68b1572.mof

==================== Find3M  ====================

2010-07-08 20:01:47 45200 ------w- c:\windows\system32\drivers\pxhelp20.sys
2010-06-21 17:44:11 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-20 14:03:36 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-05-12 13:00:24 24184872 -c--a-w- c:\program files\LimeWireWin.exe
2010-05-05 13:30:57 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe
2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-05-02 05:22:50 1851264 ------w- c:\windows\system32\dllcache\win32k.sys
2010-04-30 17:12:38 921376 ----a-w- c:\program files\JavaSetup6u20.exe
2010-04-20 05:30:08 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-20 05:30:08 285696 ------w- c:\windows\system32\dllcache\atmfd.dll
2010-04-12 21:51:15 38808920 ----a-w- c:\program files\FileFormatConverters.exe
2010-04-12 21:29:19 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-09 14:51:20 9684728 ----a-w- c:\program files\R90275 - Sonic Update
2010-03-25 14:22:17 42281152 ----a-w- c:\program files\avira_antivir_personal_en.exe
2010-02-23 17:01:45 97364760 ----a-w- c:\program files\Ad-AwareInstaller.exe
2009-12-11 20:13:41 2015216 ----a-w- c:\program files\GoogleDesktopSetup.exe
2009-12-03 20:08:28 93234472 -c--a-w- c:\program files\iTunesSetup.exe
2009-10-14 02:15:31 77086488 ----a-w- c:\program files\Ad-AwareInstallation.exe
2009-09-30 18:23:35 12754672 ----a-w- c:\program files\MP10Setup.exe
2009-09-30 18:08:11 1603428 ----a-w- c:\program files\pxengine2_08_40d.exe
2009-09-30 17:58:18 86069416 ----a-w- c:\program files\R107621a.zip
2009-09-30 17:57:08 523404 ----a-w- c:\program files\D5150A07.EXE
2009-09-30 17:57:04 4641568 ----a-w- c:\program files\R126542.EXE
2009-09-30 17:57:02 507573 ----a-w- c:\program files\DE06.zip
2009-09-30 17:56:56 798186 ----a-w- c:\program files\E113.ZIP
2009-09-30 17:56:48 3573632 ----a-w- c:\program files\R121089.EXE
2009-09-30 17:56:28 6436560 ----a-w- c:\program files\R114282.EXE
2009-09-30 17:56:16 1417304 ----a-w- c:\program files\R114566.EXE
2009-09-30 17:19:26 1312845 ----a-w- c:\program files\PatchGdiPlus.EXE
2009-08-07 14:41:16 1729 ----a-w- c:\program files\Adobe Reader 9.lnk
2009-07-21 13:04:34 13667376 ----a-w- c:\program files\Dell_Upgrade.v2806_5_9(Dell)_DVD060410-01_R3.exe
2009-07-09 12:57:44 37452296 ----a-w- c:\program files\Ad-AwareAE.exe
2009-05-22 17:27:35 1887408 ----a-w- c:\program files\GoogleToolbarInstaller_en_signed.exe
2009-04-29 16:20:08 16883056 ----a-w- c:\program files\IE8-WindowsXP-x86-ENU.exe
2009-04-16 02:09:31 1048200 ----a-w- c:\program files\MoveMediaPlayer_071303000004.exe
2009-04-12 19:50:14 734 ----a-w- c:\program files\Acrobat.com.lnk
2009-02-03 04:28:55 251 ----a-w- c:\program files\wt3d.ini
2009-01-14 18:11:10 23804784 ----a-w- c:\program files\aaw2008.exe
2008-11-28 03:51:47 12349806 ----a-w- c:\program files\dvdflick_setup_1.3.0.4.exe
2008-11-27 21:33:53 11184142 ----a-w- c:\program files\dvdrnb.exe
2008-11-27 19:42:19 1103459 ----a-w- c:\program files\MP4Cam2AVI_SRC_v2.79.zip
2008-11-27 19:38:07 1419963 ----a-w- c:\program files\MP4Cam2AVI_v2.79.zip
2008-11-27 19:31:33 39537784 ----a-w- c:\program files\AVSVideoConverter.exe
2008-11-19 14:42:51 1506184 ----a-w- c:\program files\install_easyshare.exe
2008-10-03 19:32:59 940168 ----a-w- c:\program files\setup.exe
2008-09-30 18:09:08 2036504 ----a-w- c:\program files\oebk.zip
2007-11-23 17:28:14 2695320 ----a-w- c:\program files\COL11035en_a.exe
2007-11-13 16:43:52 1649 ----a-w- c:\program files\Create & Print.lnk
2007-05-24 17:06:27 13726624 ----a-w- c:\program files\austa_6.exe
2007-04-30 16:21:50 13613310 ----a-w- c:\program files\SPSCwin.zip
2007-04-06 21:53:51 1951432 -c--a-w- c:\program files\ppviewer.exe
2006-11-19 20:35:04 14879120 ----a-w- c:\program files\GoogleEarthWin.exe
2006-01-07 23:21:54 2855080 -c--a-w- c:\program files\aawsepersonal.exe
2006-01-07 22:58:27 819 ----a-w- c:\program files\Adobe ImageReady 7.0.lnk
2006-01-07 14:14:34 5482928 -c--a-w- c:\program files\SoundEffectsSet1.exe
2006-01-07 14:13:55 2203658 -c--a-w- c:\program files\WaveBreaker1.exe
2006-01-07 14:13:23 4645230 -c--a-w- c:\program files\RipEditBurn2.exe
2005-10-31 15:56:00 700416 ----a-w- c:\program files\StubInstaller.exe
2006-01-05 17:17:40 56 -csh--r- c:\windows\system32\CDE74AC9F7.sys
2006-01-05 17:17:41 3350 -csha-w- c:\windows\system32\KGyGaAvL.sys
2008-05-14 03:07:20 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008051320080514\index.dat

============= FINISH: 15:26:51.79 ===============

Try again. Disable your AV realtime scanner before saving DDS.

Also, I need to know if:

1) Can I check and send emails while we are working on this or would you rather i did not?

2) Do I need to disable "Script Protection Running". If so, how do I do that?

3) I'm usually one full email behind you and I am having these posts sent to my Outlook Express so I hear when you respond. Should Outlook Express even be on? If not, do I just leave the site we are posting on open and will your post automatically appear when you send it. I can then just watch for them.

4) Also, if allowed, should I delete one or more of the A/V's I have or will we get to that?

5) Finally, thank you so much for your patience as I struggle to understand your directions. It takes me a while to comprehend most all of this and I even had to ask my wife to find something to do so I don't break my concentration. She went shopping. I love my wife!

Bill

Re:

1. DDS.txt
2. Attach.txt

• Save both reports to your desktop.
• Copy/paste both logs to your reply on the forum.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.

I think I was able to deliver both files to you in my last post. I had typed "I do not know how to attach the Attach.txt. I was able to zip it." At that moment a friend dropped by and I was distracted. I then think I found where to attach the zipped folder. So, I think I have accomplished this so far:

1. DDS.txt
2. Attach.txt

• Save both reports to your desktop.
• Copy/paste both logs to your reply on the forum.
• Close the program window, and delete the program from your desktop.

HOWEVER, in the next line of instructions it says, "Run the Scan" after disabling A/V. I searched my entire computer for DDS.SCR and it's no where to be found. So I was unable to "Run the Scan". I don't know how to disable any script protection running, but I guess that is mute because I can't find DDS.SCR to run it.

I just received an email from you and have not yet read it. Shall I proceed with what you wrote in your latest email in lieu of what I've just written.

Please feel free to tell me when you need a break from this or are signing off for the night. I can correspond almost anytime. I await your responce. Thanks

Save both reports to your desktop. Copy/paste both logs to your reply on the forum.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates,

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top.

• When the scan is finished, a message box will say "The scan completed successfully.

• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report along into your next reply and exit MBAM.

Note:-- If MBAM encounters a file that is difficult to remove,
you may be asked to reboot your computer so it can proceed with the disinfection process.
Regardless if prompted to restart the computer or not, please do so immediately.
Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

-- MBAM may make changes to your registry as part of its disinfection routine.
If you're using other security programs that detect registry changes (like Spybot's Teatimer),
they may interfere with the fix or alert you after scanning with MBAM.
Please disable such programs until disinfection is complete or permit them to allow the changes.

**If you need to re-install MBAM but encounter issue in re-installing, try using the MBAM Cleanup Utility by downloading it from HERE

1) Can I check and send emails while we are working on this or would you rather i did not?

2) Do I need to disable "Script Protection Running". If so, how do I do that?

4) Also, if allowed, should I delete one or more of the A/V's I have or will we get to that?

5) Finally, thank you so much for your patience as I struggle to understand your directions. It takes me a while to comprehend most all of this and I even had to ask my wife to find something to do so I don't break my concentration. She went shopping. I love my wife!

I'm not sure what you mean by the "previous post". I  see only the posts in this forum thread. I am still waiting for your log from Malwarebytes to be posted. After that I will take some time to review the log and let you know what to do next.

It's: Posted by catoomba

Thank you and I completely understand and she loves it. lol

Did you get my previous post? Seems I'm running one behind you.