LandzDown Forum

Hello All

I am a Greek, so please forgive me for my English...

I have a serious problem with my computer, since last Tuesday. I was trying to find a licence for a software I need. I found one, and although Panda Global Protection warn me that it was a suspicious file, I ran it... And so I ha a Blue Screen of Dead... Since then, I cannot connect to my wifi, although it seems to be connected...

I have tried the following antispywares, but nothing bad was found:

Super Antispyware Pro
MBAM
Kaspersky Virus Removal

I also tried to reinstall Panda, but the action cannot take place...

I tried do something with IP adress in Internet Protocol Window, but I think I cause a big mess there...

Tried winsock reset, nothing...

Tried turn on windows firewall, nothing... It says that there is a dead network...

Please, help me! I am a postgraduate student, and I need internet! In fact, I was waiting for the weekend to cover a lot of reading, but...

THANK YOU IN ADVANCE!!!

PANOS

Thank you for your quick reply!!!!

I start right now!

QUESTION:

I have original SUPER ANTISPYWARE PRO AND MBAM. Should I uninstall one of them? Can I only stop the one by using msconfig?

I have taken the risk to transfer files from the one computer to the other... I forgot to mention that the infected computer became very very slow...

Another question, before texts: Isn't is dangerous to paste to public all these details about a system?

A.
 Results of screen317's Security Check version 0.99.24 
 Windows XP Service Pack 3 x86   
 Internet Explorer 8 
``````````````````````````````
Antivirus/Firewall Check:
 WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
 Malwarebytes' Anti-Malware   
 Java(TM) 6 Update 26 
 Java 2 Runtime Environment, SE v1.4.2_05
 Out of date Java installed!
  Adobe Flash Player (   10.3.183.5) Flash Player Out of Date! 
 Mozilla Firefox (x86 el..)
````````````````````````````````
Process Check: 
objlist.exe by Laurent
 Malwarebytes' Anti-Malware mbamservice.exe 
``````````End of Log````````````


B.
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 1.6.0_26
Run by M at 20:30:31 on 2011-10-21
Microsoft Windows XP Professional  5.1.2600.3.1253.30.1033.18.1526.1114 [GMT 3:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Protector Suite QL\menusw.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Freecorder\FLVSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\WINDOWS\system32\wscntfy.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.nec-online.co.uk/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office14\GROOVEEX.DLL
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~3\office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [Update Service] c:\progra~1\common~1\teknum~1\update.exe /startup
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Biomenu] "c:\program files\protector suite ql\menusw.exe"
mRun: [SSC_UserPrompt] c:\program files\common files\symantec shared\security center\UsrPrmpt.exe
mRun: [SECEDIT] c:\drivers\SECEDIT.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Freecorder FLV Service] "c:\program files\freecorder\FLVSrvc.exe" /run
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~3\office14\ONBttnIE.dll/105
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: Interfaces\{7142F9FD-8C3A-4AD5-A619-3C94C79502D5} : NameServer = 192.168.6.108,192.168.5.108
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: avldr - avldr.dll
Notify: igfxcui - igfxdev.dll
Notify: psfus - fusstub.dll
AppInit_DLLs: acaptuser32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: ExecuteHooker Class: {569dac0f-2791-46ab-8efc-a54b77c04c20} - c:\program files\dvd ghost\ExecuteHooker.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office14\GROOVEEX.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli fusstub
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\maria\application data\mozilla\firefox\profiles\45nyw1gt.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\progra~1\micros~3\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
.
============= SERVICES / DRIVERS ===============
.
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [2011-8-11 11264]
R2 FdRedir;FdRedir;c:\windows\system32\drivers\FdRedir.sys [2005-2-28 12544]
R2 FileDisk2;FileDisk Protector Kernel Driver;c:\windows\system32\drivers\filedisk.sys [2005-2-28 33024]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-16 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-8-16 41272]
.
=============== Created Last 30 ================
.
2011-10-21 15:17:19   --------   d-----w-   C:\bd_logs
2011-10-20 19:22:34   --------   d-----w-   c:\program files\common files\Panda Security
2011-10-18 11:50:26   105088   ----a-w-   c:\windows\system32\drivers\av5flt.sys
2011-10-18 11:40:27   --------   d-sh--w-   c:\documents and settings\maria\local settings\application data\1d883865
2011-10-17 19:29:26   26600   ----a-w-   c:\windows\system32\drivers\GEARAspiWDM.sys
2011-10-16 14:27:26   --------   d-----w-   c:\documents and settings\maria\application data\go
2011-10-16 14:27:22   --------   d-----w-   c:\documents and settings\all users\application data\Easybits GO
2011-10-11 12:27:22   1277952   ----a-w-   c:\windows\system32\SYNSOACC.dll
2011-10-09 12:07:13   1277952   ----a-w-   c:\windows\system32\SYNSOEMU.dll
2011-10-08 18:50:25   1409   ----a-w-   c:\windows\QTFont.for
2011-10-07 14:21:27   --------   d-----w-   c:\program files\Sonnox
2011-10-07 13:52:10   2892   ----a-w-   c:\windows\system32\audcon.sys
2011-10-07 13:52:10   --------   d-----w-   c:\documents and settings\all users\application data\Syncrosoft
2011-10-07 13:31:04   116736   ----a-w-   c:\windows\system32\drivers\mcdbus.sys
2011-10-07 13:31:02   --------   d-----w-   c:\program files\MagicDisc
2011-10-07 13:26:42   --------   d-----w-   c:\documents and settings\maria\LocalLow
2011-10-04 20:30:47   --------   d-----w-   c:\program files\SPSS Viewer
2011-10-04 18:26:07   --------   d-----w-   c:\documents and settings\maria\application data\Eclipse
2011-10-03 21:49:38   --------   d-----w-   c:\documents and settings\maria\local settings\application data\Amos 19.0
2011-10-03 21:44:25   1024   -c--a-w-   c:\windows\system32\clauth2.dll
2011-10-03 21:44:25   1024   -c--a-w-   c:\windows\system32\clauth1.dll
2011-10-03 21:44:25   0   -c--a-w-   c:\windows\system32\ssprs.dll
2011-10-03 21:44:25   0   -c--a-w-   c:\windows\system32\serauth2.dll
2011-10-03 21:44:25   0   -c--a-w-   c:\windows\system32\serauth1.dll
2011-10-03 21:44:25   0   -c--a-w-   c:\windows\system32\nsprs.dll
2011-10-03 21:43:53   45328   ----a-w-   c:\program files\common files\microsoft shared\replication manager 4.0\mstran40.exe
2011-10-03 21:43:53   37136   ----a-w-   c:\program files\common files\microsoft shared\replication manager 4.0\mstrai40.exe
2011-10-03 21:43:52   74000   ----a-w-   c:\program files\common files\microsoft shared\replication manager 4.0\msrpfs40.dll
2011-10-03 20:59:52   --------   d-----w-   c:\documents and settings\maria\local settings\application data\javasharedresources
2011-10-03 20:58:12   --------   d--h--w-   c:\program files\Zero G Registry
2011-10-03 20:58:12   --------   d--h--w-   c:\documents and settings\maria\InstallAnywhere
2011-10-03 20:55:49   --------   d-----w-   c:\documents and settings\all users\application data\SPSS
2011-10-03 20:53:38   --------   d-----w-   c:\program files\common files\IBM
2011-10-03 20:52:23   --------   d-----w-   c:\program files\IBM
2011-10-03 19:36:24   --------   d-----w-   c:\documents and settings\maria\local settings\application data\IsolatedStorage
2011-10-03 19:35:59   --------   d-----w-   c:\documents and settings\maria\local settings\application data\HP
.
==================== Find3M  ====================
.
2011-10-16 14:30:21   414368   -c--a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-04 20:35:13   205   -c--a-w-   c:\windows\system32\lsprst7.dll
2011-09-26 08:41:20   611328   ----a-w-   c:\windows\system32\uiautomationcore.dll
2011-09-26 08:41:20   220160   ----a-w-   c:\windows\system32\oleacc.dll
2011-09-26 08:41:14   20480   ----a-w-   c:\windows\system32\oleaccrc.dll
2011-09-09 09:12:13   599040   ----a-w-   c:\windows\system32\crypt32.dll
2011-09-06 13:20:51   1858944   ----a-w-   c:\windows\system32\win32k.sys
2011-08-22 23:48:55   916480   ----a-w-   c:\windows\system32\wininet.dll
2011-08-22 23:48:54   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2011-08-22 23:48:54   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2011-08-22 11:56:39   385024   ----a-w-   c:\windows\system32\html.iec
2011-08-17 13:49:54   138496   ----a-w-   c:\windows\system32\drivers\afd.sys
2011-08-13 14:11:08   8192   ----a-w-   c:\windows\system32\srvany.exe
2011-08-11 14:21:43   100   -c--a-w-   c:\windows\system32\prsgrc.dll
2011-08-11 13:45:48   1024   -c--a-w-   c:\windows\system32\grcauth2.dll
2011-08-11 13:45:48   1024   -c--a-w-   c:\windows\system32\grcauth1.dll
2011-08-11 13:44:02   1025   -c--a-w-   c:\windows\system32\sysprs7.dll
2011-08-10 21:52:10   87608   ----a-w-   c:\documents and settings\maria\application data\inst.exe
2011-08-10 21:52:10   47360   ----a-w-   c:\windows\system32\drivers\pcouffin.sys
2011-08-10 21:52:10   47360   ----a-w-   c:\documents and settings\maria\application data\pcouffin.sys
2011-08-10 21:10:50   14   -c--a-w-   c:\windows\system32\SysEngine2.SYS
2011-08-10 20:52:55   73728   -c--a-w-   c:\windows\system32\javacpl.cpl
2011-08-10 20:52:55   472808   -c--a-w-   c:\windows\system32\deployJava1.dll
2011-08-08 08:00:00   74752   -c--a-w-   c:\windows\system32\ff_vfw.dll
.
============= FINISH: 20:33:32.94 ===============


C.

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 09/08/2011 12:40:23
System Uptime: 21/10/2011 20:04:08 (0 hours ago)
.
Motherboard: NEC Computers International      |  | VC2
Processor:         Intel(R) Pentium(R) M processor 1.86GHz | uFCBGA | 1862/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 71 GiB total, 16.739 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel(R) PRO/Wireless 2200BG Network Connection
Device ID: PCI\VEN_8086&DEV_4220&SUBSYS_27018086&REV_05\4&31177083&0&18F0
Manufacturer: Intel(R) Corporation
Name: Intel(R) PRO/Wireless 2200BG Network Connection
PNP Device ID: PCI\VEN_8086&DEV_4220&SUBSYS_27018086&REV_05\4&31177083&0&18F0
Service: w29n51
.
==== Installed Programs ======================
.
"Nero SoundTrax Help
ΜΑΤΖΕΝΤΑ - Αγγλικό-Ελληνικό & Ελληνικό-Αγγλικό λεξικό
1500
1500_Help
1500Trb
ABBYY PDF Transformer 2.0
Adobe Acrobat 9 Pro Extended - English, Franηais, Deutsch
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 6.0
Adobe Setup
Adobe Shockwave Player 11.6
Adobe Stock Photos CS3
Adobe SVG Viewer 3.0
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Advertising Center
AiO_Scan
AiOSoftware
AnyDVD
ASAPI Update
Bigger Brain Trainer
BufferChm
Click to Call with Skype
Conduit Engine
ConvertXtoDVD 3.2.0.52
CP_AtenaShokunin1Config
CP_CalendarTemplates1
CP_Package_Basic1
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
CP_Panorama1Config
CueTour
CustomerResearchQFolder
Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition
DesignPro SE eMedia
Destinations
DeviceFunctionQFolder
DeviceManagementQFolder
DjVuLibre+DjView
DocProc
DocumentViewer
DocumentViewerQFolder
DolbyFiles
DVD Ghost 2.2
DVDShrink 2008
EasyBits GO
eSupportQFolder
EucliDraw
Fax
Finale 2011
Freecorder 5
Freecorder Toolbar
FullDPAppQFolder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
HP Document Viewer 5.3
HP Extended Capabilities 5.3
HP Image Zone 5.3
HP Imaging Device Functions 5.3
HP PSC & OfficeJet 5.3.B
HP Software Update
HP Solution Center & Imaging Support Tools 5.3
HPProductAssistant
IBM SPSS Amos 19
IBM SPSS Statistics 19
ImagXpress
ImTOO Audio Maker
ImTOO DVD Copy Express
ImTOO DVD Creator
ImTOO DVD Ripper Ultimate
ImTOO MPEG Encoder Ultimate
InstantShareDevices
Java 2 Runtime Environment, SE v1.4.2_05
Java Auto Updater
Java(TM) 6 Update 26
K-Lite Codec Pack 7.6.0 (Full)
Kidspiration 3 IE
LightScribe System Software
MagicDisc 2.7.106
Malwarebytes' Anti-Malware version 1.51.1.1800
MarketResearch
Menu Templates - Starter Kit
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Greek Language Pack
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Access MUI (English) 2010
Microsoft Office Access MUI (Greek) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Excel MUI (Greek) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office Groove MUI (Greek) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office InfoPath MUI (Greek) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office OneNote MUI (Greek) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office Outlook MUI (Greek) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office PowerPoint MUI (Greek) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Greek) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Proofing (Greek) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Publisher MUI (Greek) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared MUI (Greek) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Office Word MUI (Greek) 2010
Microsoft Silverlight
Microsoft Software Update for Web Folders  (English) 14
Microsoft Software Update for Web Folders  (Greek) 14
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Movie Templates - Starter Kit
Mozilla Firefox 5.0.1 (x86 el)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 9
Nero BurningROM
Nero BurnRights
Nero ControlCenter
Nero CoverDesigner
Nero CoverDesigner Help
Nero Disc Copy Gadget
Nero Disc Copy Gadget Help
Nero DiscSpeed
Nero DriveSpeed
Nero Express
Nero InfoTool
Nero Installer
Nero Live
Nero Live Help
Nero PhotoSnap
Nero PhotoSnap Help
Nero Recode
Nero Recode Help
Nero Rescue Agent
Nero RescueAgent Help
Nero ShowTime
Nero StartSmart
Nero StartSmart Help
Nero Vision
Nero WaveEditor
Nero WaveEditor Help
NeroBurningROM
NeroExpress
neroxml
NewCopy
PanoStandAlone
PDF Settings
Photo Story 3 for Windows
PhotoGallery
PowerDVD
ProductContext
Protector Suite QL 5.2
QuickTime
RandMap
RapidBIT Suite
Readme
Registry Speedup 1.00
Scan
ScannerCopy
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft Excel 2010 (KB2553070)
Security Update for Microsoft InfoPath 2010 (KB2510065)
Security Update for Microsoft Office 2010 (KB2289078)
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2584066)
Security Update for Microsoft PowerPoint 2010 (KB2519975)
Security Update for Microsoft Publisher 2010 (KB2409055)
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Windows (KB2564958)
Security Update for Microsoft Word 2010 (KB2345000)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2530548)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544521)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
SkinsHP1
Skype™ 5.3
SmartSound Quicktracks Plugin
SolutionCenter
Sonic RecordNow!
Sonic_PrimoSDK
SoundTrax
SPSS SmartViewer 15.0
Status
Subtitle Workshop 2.51
SUPERAntiSpyware
swMSM
Text to Speech XP
TinkerPlots
Total Uninstall 5.2.0
Total Video Converter 3.12 080330
TrayApp
Ulead Photo Express 3.0 SE
Ulead VideoStudio 10
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2010 (KB2202188)
Update for Microsoft Office 2010 (KB2413186)
Update for Microsoft Office 2010 (KB2523113)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft OneNote 2010 (KB2493983)
Update for Microsoft Outlook Social Connector (KB2583935)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2492386)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VLC media player 1.1.0
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Xilisoft Video Converter Ultimate
.
==== Event Viewer Messages From Past Week ========
.
21/10/2011 17:58:07, error: Tcpip [4198]  - The system detected an address conflict for IP address 192.168.10.2 with the system having network hardware address 0C:60:76:3F:6F:D0. The local interface has been disabled.
20/10/2011 22:34:55, error: Server [2505]  - The server could not bind to the transport \Device\NetBT_Tcpip_{7142F9FD-8C3A-4AD5-A619-3C94C79502D5} because another computer on the network has the same name.  The server could not start.
20/10/2011 22:23:48, error: Service Control Manager [7034]  - The Panda Process Protection Service service terminated unexpectedly.  It has done this 1 time(s).
20/10/2011 22:09:58, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u mraid35x PCIIde perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
20/10/2011 16:21:40, error: Service Control Manager [7023]  - The IPSEC Services service terminated with the following error:  An address incompatible with the requested protocol was used.
20/10/2011 16:21:40, error: Service Control Manager [7023]  - The Automatic Updates service terminated with the following error:  %%2147952447
20/10/2011 16:10:07, error: Service Control Manager [7023]  - The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error:  An address incompatible with the requested protocol was used.
20/10/2011 16:10:07, error: Service Control Manager [7023]  - The IPSEC Services service terminated with the following error:  The support for the specified socket type does not exist in this address family.
19/10/2011 21:00:55, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AD8-2166-11D1-B1D0-00805FC1270E}
19/10/2011 17:54:10, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
19/10/2011 17:23:20, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  AFD ElbyCDIO Fips intelppm IPSec MRxSmb NetBIOS NetBT pavboot RasAcd Rdbss SASDIFSV SASKUTIL Tcpip
19/10/2011 17:14:37, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
19/10/2011 17:14:30, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
19/10/2011 17:11:16, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  AFD ElbyCDIO Fips intelppm IPSec MRxSmb NetBIOS NetBT pavboot RasAcd Rdbss SASDIFSV SASKUTIL ShldDrv Tcpip
19/10/2011 17:11:16, error: Service Control Manager [7003]  - The Panda On-Access Anti-Malware Service service depends on the following nonexistent service: PskSvcRetail
19/10/2011 17:11:16, error: Service Control Manager [7001]  - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:  A device attached to the system is not functioning.
19/10/2011 17:11:16, error: Service Control Manager [7001]  - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:  A device attached to the system is not functioning.
19/10/2011 17:11:16, error: Service Control Manager [7001]  - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:  A device attached to the system is not functioning.
19/10/2011 17:11:16, error: Service Control Manager [7001]  - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:  A device attached to the system is not functioning.
19/10/2011 17:11:16, error: Service Control Manager [7001]  - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:  A device attached to the system is not functioning.
18/10/2011 21:30:37, error: Service Control Manager [7034]  - The Panda TPSrv service terminated unexpectedly.  It has done this 1 time(s).
18/10/2011 21:29:25, error: Service Control Manager [7024]  - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service terminated with service-specific error 4294967295 (0xFFFFFFFF).
18/10/2011 21:29:25, error: Service Control Manager [7023]  - The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error:  A socket operation encountered a dead network.
18/10/2011 21:29:25, error: Service Control Manager [7023]  - The IPSEC Services service terminated with the following error:  A socket operation encountered a dead network.
18/10/2011 21:29:25, error: Service Control Manager [7023]  - The Automatic Updates service terminated with the following error:  %%2147952450
18/10/2011 14:44:50, error: System Error [1003]  - Error code 1000007e, parameter1 c0000005, parameter2 884f7034, parameter3 ba51baec, parameter4 ba51b7e8.
14/10/2011 14:37:49, error: Dhcp [1002]  - The IP address lease 192.168.10.1 for the Network Card with network address 0015002F93DD has been denied by the DHCP server 192.168.10.254 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================



THAT'S ALL...............

Hi, Corine.

When I enter windows in safe mode, I have not the option of networking. I think that Supe Antispyware gives this option. I will try and tell you.

Thank you for the instructions. I will proceed immediately.

Some news!

I tried enter web through Firefox and it worked! I CAN HAVE INTERNET AGAIN!

BUT:

How do I know that everything (?) is ok, now?

Is there anything else to do?

What about having my Internet Protocol use specific IP address instead of obtain it automatically?

As I said in the first post, I have made some mess in the windows of Network Connections...

Could you please tell me how to fix it?


THANK YOU! THANK YOU! THANK YOU!!

Hi, DR M.

I have been terrified! I think that something dangerous has been found!

1.  You were quite correct to be terrified.  I see no sign of an antivirus software on the computer, other than a very old leftover entry from Symantec.   I suggest that you install Microsoft Security Essentials, which is free.

2.  The Windows Firewall prompt was because for Java was checking for updates.  There have been several critical security updates to Java since Java(TM) 6 Update 26, with the current version being Java(TM) 6 Update 29. 

3.  Did you uninstall Java 2 Runtime Environment, SE v1.4.2_05?

4.  Do you really need Java?  As I wrote in a recent blog article, when it comes to Oracle Java JRE, you may have it installed on your computer but might not even need it. Following are reasons why someone may need Oracle Sun Java installed on their computer:

•     Playing on-line games generally requires Java.
•     With OpenOffice, Java is needed for the items listed here.
  
•     It used to be that Java was needed for websites to be properly displayed. However, that is generally not the case now with Flash having taken over.
•     There may be commercial programs that depend on Java. If Java is needed for a software installed on your computer, there should be a prompt for it.

If the above applies to you, then you need to update Java to the latest version from here:  Java SE Runtime Environment 6u29.  Otherwise, you can uninstall Java(TM) 6 Update 26.

Note:  UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.

5.  Please let me know in your next reply if you use and wish to keep the Freecorder toolbar.

6.  Please go here to run an on-line scan from ESET.

• Note: It is easiest if you use Internet explorer for this scan.  (If you use an alternate browser, it will be necessary to download the ESET Smart Installer)
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
  
• When asked, allow the ActiveX control to install
• Click Start
  
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
  
• Wait for the scan to finish
• Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  
• Copy and paste that log as a reply to this topic and also provide the answers to my questions above.

Hi, Corrine.

This is what I have done till now:

1. Installed Panda Global Protection 2012, and performed a full scan. No virus or malicious software was found.

2. JAVA: I uninstalled all previous versions (included v6 up26) and installed the latest version, v6 up29.

3. I tried to access ESSET page from the infected computer, with Internet Explorer, but it was impossible. Although, I could have access from the non infected one. So, I got in Internet Options of Internet Explorer, restored advanced settings and reset. Then, I could have access to the ESSET web page.

4. I installed Active x and another thing (I think EST online scanner) and started scan.

5. I am waiting for the log report (67% yet).

Hi, DR M.  You are six hours ahead of me. 

It isn't often I see infected ADS (Windows NTFS Alternate Data Streams).  In addition, the infected afd.sys is identified as a rootkit and is why you were having network connection problems.

Now that you have reinstalled the Panda A/V software, no, do not install Microsoft Security Essentials.  A second antivirus software could result in conflicts. 

The file detected by the ESET scan is described as a "system back door" -- meaning that it can bypass normal security measures.  This allows hackers to remotely control your computer, steal critical system information and download and execute files.  It is most likely the source of the other infected files.  We will take care of it in the next step.

Since you have space concerns and the version of leftover Symantec files is older than the removal tool, I'll include that in the cleanup.

Custom CFScript

Note: The following instructions were created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

• Please open Notepad (Click Start -> Run -> type notepad in the Open field -> OK).  Copy/Paste all of the text present inside the code box below:

File::
Patch_abbyy.pdf.transformer.2.0.exe
NDETECT.EXE

Folder::
c:\program files\Symantec
C:\Program Files\Common Files\Symantec Shared


• Save this as CFScript.txt and place it on your desktop.
• Close any open browsers.
• Close/disable all antivirus and anti-malware programs so they do not interfere with the running of ComboFix.
  
  
  
  
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

How is your computer now?