[RESOLVED] Laptop is infected with a Trojan...

Printable View

Show 40 post(s) from this thread on one page

July 13th, 2012, 10:25 PM
Broni
Data error (cyclic redundancy check)" may indicate some hard drive issue but we'll see.

Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  Code:
  
  :OTL [2012/07/11 08:02:17 | 000,000,000 | ---D | M] (Support.com Toolbar) -- C:\Users\Janette\AppData\Roaming\Mozilla\Firefox\Profiles\pk4iz42a.default\extensions\[email protected] O2 - BHO: (Support.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Support.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O15 - HKU\S-1-5-21-4005884000-2466192861-660793693-1005\..Trusted Domains: internet ([]about in Trusted sites) O15 - HKU\S-1-5-21-4005884000-2466192861-660793693-1005\..Trusted Domains: mcafee.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-4005884000-2466192861-660793693-1005\..Trusted Domains: mcafee.com ([]https in Trusted sites) O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Mahjong%20Escape%20-%20Ancient%20China/Images/armhelper.ocx (Reg Error: Key error.) O37 - HKU\S-1-5-21-4005884000-2466192861-660793693-1005\...com [@ = ComFile] -- Reg Error: Key error. File not found [2012/07/10 09:38:00 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-dEXeuNYt1835dg @Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:35950FAF @Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:197335E4 @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:CDCFEE39 @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:A4ACFB14 @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:621BEE66 @Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:CF61CE5A @Alternate Data Stream - 254 bytes -> C:\ProgramData\TEMP:0B352B60 @Alternate Data Stream - 247 bytes -> C:\ProgramData\TEMP:701B92FB @Alternate Data Stream - 244 bytes -> C:\ProgramData\TEMP:E6C6EB3B @Alternate Data Stream - 243 bytes -> C:\ProgramData\TEMP:C9B27A06 @Alternate Data Stream - 243 bytes -> C:\ProgramData\TEMP:9D03192E @Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:9D6EAEC3 @Alternate Data Stream - 239 bytes -> C:\ProgramData\TEMP:0EC7A545 @Alternate Data Stream - 235 bytes -> C:\ProgramData\TEMP:72E6616C @Alternate Data Stream - 235 bytes -> C:\ProgramData\TEMP:5A437AC3 @Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:99AC3203 @Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:C22674B6 @Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:D31BE97C @Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:5C6EBC69 @Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:CB16385F @Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:9BB8C675 @Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:5FFC2819 @Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:E51234A9 @Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:D48500F8 @Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:7C4DF735 @Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:370E4EFB @Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:0AC32449 @Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:A31B5E9B @Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:8F067037 @Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:109734F6 @Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:EC855C73 @Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:A02025CE @Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:51676264 @Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:A9ABA3FF @Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:78E0DF72 @Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:1C88C8E5 @Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:918B7566 @Alternate Data Stream - 205 bytes -> C:\ProgramData\TEMP:260575F1 @Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:35FAD15D @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:123A86B5 @Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:F84B8DB5 @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:32A82570 @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:38FF076E @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:BAC2F271 @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:737160C1 @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:C76CFF82 @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:A7596EAE @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:35629AE6 @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:6423D635 @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:700B9342 @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:DE875C30 @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:D2397415 @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1C4D3509 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:98982C88 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:50636E35 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:22786385 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:F33C37D5 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:B2735F9E @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:5D351BC6 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:4A448DB2 @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:AD727397 @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:68EF6203 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:F44D3C53 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:97C4F81F @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:598E8EA1 @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:8401B6D5 @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:616D21DE @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:041C0562 @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:DE47A3DA @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:BCA198E3 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:F92AD177 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:B72F3698 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:98DFF516 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:C085630F @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:3F2212BB @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:B9710577 @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9BFB769D @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:40EE25BB @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:5E9B629B @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:AFB24B00 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D2BD3451 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:3A78F62C @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:2B275F6A @Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:83ACAC73 @Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:60A4BB64 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:FD2BFC89 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DA18FD1D @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:66AA0486 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:0F0A5896 @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:70E897B5 @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:4249A835 @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:B1381B34 @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:853CCFC7 @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:6F1F66C0 @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:090FB735 @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:9124CA95 @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:8EA719EA @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:68DC65DC @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:4F8B72C9 @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:40E5AD89 @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:211ED887 @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:23ADF89D @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:177313FB @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:B6C77675 @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:24FECE50 @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:E3313793 @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:4A9220C3 @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:F14D1F80 @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:9B285B76 @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:6440F08B @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:561B1D2B @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:029300DC @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:7E0EFF7B @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:1A7FFE9C :Services :Reg :Files C:\Program Files\Ask.com :Commands [purity] [emptytemp] [emptyjava] [emptyflash] [Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- You will get a log that shows the results of the fix. Please post it.
===========================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.
- Double-click SecurityCheck.exe
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  
  NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.
2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
- Make sure the following options are checked:
  - Internet Services
  - Windows Firewall
  - System Restore
  - Security Center
  - Windows Update
  - Windows Defender
- Press "Scan".
- It will create a log (FSS.txt) in the same directory the tool is run.
- Please copy and paste the log to your reply.
3. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
- Double click on TFC.exe to run the program.
- Click on Start button to begin cleaning process.
- TFC will close all running programs, and it may ask you to restart computer.
4. Please run a free online scan with the ESET Online Scanner
- Disable your antivirus program
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- Accept any security warnings from your browser.
- Check Scan archives
- Click Start
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, click on List of found threats
- Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- NOTE. If Eset won't find any threats, it won't produce any log.
July 14th, 2012, 12:48 AM
rollie

Tried to post the results of the OTL Scan/Fix but this message came up again...
The following errors occurred with your submission

You have included a total of 7 images and/or videos in your message. The maximum number that you may include is 6. Please correct the problem and then continue again.

Images include use of smilies, the BB code [img] tag, and HTML <img> tags. Videos are included with the BB code [video] tag. The use of these is all subject to them being enabled by the administrator.
July 14th, 2012, 12:59 AM
Broni

Upload the file(s) here: http://uploadmb.com/
Copy the link inside the Direct Link box and post it in your next reply.
July 14th, 2012, 01:00 AM
rollie

checkup.txt:

Results of screen317's Security Check version 0.99.24
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Security Toolbar
McAfee Security Scan Plus
McAfee SecurityCenter
McAfee Online Backup
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 31
Java(TM) 6 Update 2
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player 9 (Out of date Flash Player installed!)
Adobe Flash Player 11.3.300.265
Adobe Reader X (10.1.3)
Mozilla Thunderbird (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
McAfee Online Backup MOBKbackup.exe
``````````End of Log````````````
July 14th, 2012, 01:03 AM
rollie

http://www.uploadmb.com/dw.php?id=1342242135
July 14th, 2012, 01:17 AM
rollie

Farbar Service Scanner Version: 08-07-2012
Ran by Janette (administrator) on 13-07-2012 at 22:15:38
Running from "C:\Users\Janette\Desktop"
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2012-05-13 13:55] - [2012-03-30 05:39] - 0905600 ____N (Microsoft Corporation) 27D470DABC77BC60D0A3B0E4DEB6CB91

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****
July 14th, 2012, 10:36 AM
rollie

Results of the ESET Online Scanner scan:

C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application cleaned by deleting - quarantined
C:\Users\Janette\Documents\Execution files for programs\7-zip-s32-downloader.exe a variant of Win32/Soft32Downloader.A application cleaned by deleting - quarantined
C:\Users\Janette\Documents\Execution files for programs\registrybooster.exe Win32/RegistryBooster application deleted - quarantined
July 14th, 2012, 11:47 AM
Broni
Update Adobe Flash Player
Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/0...ut-any-extras/

=====================================

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it.
- Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
- Accept any prompts.
- Do NOT post JavaRa log.
========================================

Your computer is clean http://dev.discussions.virtualdr.forums.relay.cool/

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:

:OTL :Commands [purity] [emptytemp] [EMPTYFLASH] [emptyjava] [CLEARALLRESTOREPOINTS] [Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post resulting log.
2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.
July 14th, 2012, 03:53 PM
rollie

While updating Java--it seemed to install just fine--when it finished, this Error popped up:
"Installer: Wrapper.CreateFile failed with error 5: Access is denied"

Here is the OTL log:

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Janette
->Temp folder emptied: 10017633 bytes
->Temporary Internet Files folder emptied: 20704511 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1593580 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 743229 bytes

Total Files Cleaned = 32.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Janette
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Janette
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.54.0 log created on 07142012_124004

Files\Folders moved on Reboot...
C:\Users\Janette\AppData\Local\Temp\Low\REG9701.tmp moved successfully.
C:\Users\Janette\AppData\Local\Temp\Low\~DF81E1.tmp moved successfully.
C:\Users\Janette\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Janette\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

PendingFileRenameOperations files...
File C:\Users\Janette\AppData\Local\Temp\Low\REG9701.tmp not found!
File C:\Users\Janette\AppData\Local\Temp\Low\~DF81E1.tmp not found!
File C:\Users\Janette\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat not found!
File C:\Users\Janette\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT not found!

Registry entries deleted on Reboot...
July 14th, 2012, 07:32 PM
rollie

Here's what's happening now. I went to download Adobe Flash Player from 404 Tech Support, and clicked on the link for "Flash Player for other Browers" since I don't use Internet Explorer (except for the past 4 days); and was told it was not "the most current version. Please visit the the Player Download Center to obtain the latest version."
So then I used the link to "Flash Player for Internet Explorer", and ended up with Adobe Shockwave Player 11.6.

I still can't access Thunderbird or Firefox. It says the programs are already running. We did an uninstall/reinstall, rebooted and that did not work.
July 14th, 2012, 08:17 PM
Broni

Quote:

It says the programs are already running

Does it happen right when you first start your computer or...?

Post new Security Check log so we can see if your Java is OK.
July 14th, 2012, 08:54 PM
rollie

It happens whenever I try to open Firefox or Thunderbird. The same message comes up for both.

Here is the Security Check log:

Results of screen317's Security Check version 0.99.24
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Security Toolbar
ESET Online Scanner v3
McAfee Security Scan Plus
McAfee SecurityCenter
McAfee Online Backup
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
JavaFX 2.1.1
Java(TM) 6 Update 31
Java(TM) 7 Update 5
Java(TM) 6 Update 2
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player 11.3.300.265
Adobe Reader X (10.1.3)
Mozilla Thunderbird (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
McAfee Online Backup MOBKbackup.exe
``````````End of Log````````````
July 14th, 2012, 09:07 PM
Broni

Uninstall:
JavaFX 2.1.1
Java(TM) 6 Update 31
Java(TM) 6 Update 2
Java(TM) 6 Update 7
If any of them won't uninstall that's OK.

Uninstall Firefox completely using this manual: http://kb.mozillazine.org/Uninstalling_Firefox
Don't skip any steps.
Install fresh copy.
July 14th, 2012, 09:07 PM
Broni

Uninstall:
JavaFX 2.1.1
Java(TM) 6 Update 31
Java(TM) 6 Update 2
Java(TM) 6 Update 7
If any of them won't uninstall that's OK.

Uninstall Firefox completely using this manual: http://kb.mozillazine.org/Uninstalling_Firefox
Don't skip any steps.
Install fresh copy.
July 14th, 2012, 11:06 PM
rollie

Okay. Followed your above post ver batum. Tried the uninstall twice using the step-by-step instructions on mozillazine. It did not work. Firefox still would not run, and the window came up saying it was already running. My husband deleted every file but one--JavaRa.def--associated with Mozilla Firefox and Thunderbird. Then used the McAfee Shredder and shredded those files. I hope this was not a big mistake. That Java file was the only one left that was associated with (Mozilla) Firefox. So then I downloaded Mozilla Firefox from Mozilla.org. and installed it. It's still not working. the same window is coming up saying the program is already running. Other than that, things seem to be okay.

Show 40 post(s) from this thread on one page