Bad case of malware that keeps coming back [Closed]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

3 Pages

1 2 3 >

Bad case of malware that keeps coming back [Closed], Just when I thought everything was gone, the Google Redirects are back

Options

shbullets View Member Profile	May 17 2009, 07:53 PM Post #1
Member Posts: 25 OS: XP	Hi everyone! I'm very glad I found this website to help me with a virus problem I'd been having these past 2 days. Yesterday, I was infected with Antivirus 2009, Windows Defender and downloaded MBAM which helped me remove them (I don't get them anymore, so I'm assuming they are gone thank goodness). I believe while doing the scan I also found the Vundo virus which I removed with MBAM. During that time, I noticed that when I plugged my USB drive into the computer, the drive did not show up on My Computer, and all that happened was the USB drive balloon showed up on the right corner of the screen. At that time, I just thought my virus problem went away since I was able to see my desktop wallpaper again (I couldn't when I was infected). Now, today I open my computer and go on Youtube and I get these ridiculous Google Redirects that don't even load to the new URL. It keeps opening new tabs to tebe.us (an inappropriate site I was told). I did another scan with MBAM and I found more Trojans: this time it was Virtumonde! I removed it, but was still getting Google Redirects. I downloaded Spybot, and it found some things too. I believe it detected Rootkit!! I restarted it like it told me, and it scanned my pc before startup, but then I clicked "Stop" and it froze, so I just did a cold reboot. Following that attempt, I downloaded SuperAntiSpyware. I scanned with it and found 13 threats and removed them. I thought it was over because now I could at least see my USB drive on My Computer (but I also noticed my USB usually lights up when it's inserted, it did not this time). So I was surfing the internet, and boom, another tebe.us! I did a quick scan with MBAM and again, 13 new viruses show up. They're like parasites, resurfacing each time and it's like I need to wipe out the source or something to make it stop. So that is why I have posted for your assistance! If anyone can help, that would be GREATLY appreciated. I do not want to re-format my computer if there might be another way out of this. I'm aware of Combofix.exe (if I recall that was the name) and I'm not sure if that is necessary for my situation, but here is the MBAM log file before I restart the computer: QUOTE Malwarebytes' Anti-Malware 1.36 Database version: 2143 Windows 5.1.2600 Service Pack 2 17/05/2009 9:54:27 PM mbam-log-2009-05-17 (21-54-27).txt Scan type: Quick Scan Objects scanned: 89431 Time elapsed: 13 minute(s), 52 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 0 Registry Values Infected: 3 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 15 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\autochk.dll (Trojan.FakeAlert) -> Delete on reboot. Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Documents and Settings\Gavin\Local Settings\Temp\ovfsthmwkidqemnt.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Gavin\Local Settings\Temp\ovfsthsotnwivsiv.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\autochk.dll (Trojan.Agent) -> Delete on reboot. C:\Documents and Settings\NetworkService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Gavin\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\LocalService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Gavin\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ovfsthkpxplkbnusoipnymwjqkfargubvnvomf.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Gavin\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Gavin\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Gavin\Local Settings\Temp\ovfsthoriybxylwo.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lmn_setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully. and here is my HijackThis Log after the restart: QUOTE Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:08:11 PM, on 17/05/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\PMJ151LA.BIN C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file) O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...96/mcinsctl.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: C:\WINDOWS\system32\hurasivi.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 6953 bytes I have AVG, Spybot, SuperAntiSpyware, ZoneAlaram, Ad-Aware and HiJack This installed on my computer. Any help is truly appreciated! Thank you! Also, if it helps, I am now being prompted to do a disc check and during stage 2 I've waited for 15+ minutes and it does not move (in terms of percentage completion) This post has been edited by shbullets: May 17 2009, 10:00 PM

sage5 View Member Profile	May 17 2009, 09:57 PM Post #2
RIP 10/2009 Posts: 2,646 From: NE Victoria, Australia OS: WinXp SP3	Hi shbullets, Welcome to Geeks to Go! I am sage5, and I will be helping you with this problem. There are a some things that I need to make clear to you, before we continue, that will help us both: Please read all of my instructions, in each post, before you continue with the fix. (If there is anything that you need clarified/don't understand, please ask) Please don't perform any steps/fixes with tools that I have not asked you to do. Many of the fixes require specific steps to be taken in a set order. Make sure that all of the logs/reports, that I ask for, get posted completely. Check out the information Here, if you are unsure how to send replies etc OK, on with the fix: Please download the following & save to your Desktop: ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the text from C:\ComboFix.txt** in your next reply. Cheers, sage5

shbullets View Member Profile	May 19 2009, 06:24 PM Post #3
Member Posts: 25 OS: XP	Hi, sorry for the less than timely response! When you say disable the antivirus and antispyware programs, do you mean right clicking the bottom right icons and selecting "exit"?

sage5 View Member Profile	May 19 2009, 06:46 PM Post #4
RIP 10/2009 Posts: 2,646 From: NE Victoria, Australia OS: WinXp SP3	Check out the instructions to disable just about every security application Here

shbullets View Member Profile	May 19 2009, 06:53 PM Post #5
Member Posts: 25 OS: XP	Oh thanks! Quick questions, I have Ad-Aware SE Personal, so is there a tutorial to turn off? And I have MBAM and SuperAntiSpyware installed, do I need to disable it (or does it not interfere with anything)? As well, do I need to turn off my firewall too? This post has been edited by shbullets: May 19 2009, 07:23 PM

sage5 View Member Profile	May 19 2009, 07:47 PM Post #6
RIP 10/2009 Posts: 2,646 From: NE Victoria, Australia OS: WinXp SP3	If those are all the free versions, they will not be providing "real-time" protection, so won't be running.

shbullets View Member Profile	May 19 2009, 08:12 PM Post #7
Member Posts: 25 OS: XP	Ok, sounds good. I will install ComboFix on the infected computer with only my AVG turned off then (since my MBAM, SAS and Adware Se Personal are free). Firewall will be on. Log will be posted soon! This post has been edited by shbullets: May 19 2009, 08:23 PM

shbullets View Member Profile	May 19 2009, 08:36 PM Post #8
Member Posts: 25 OS: XP	Also: during start up my computer has been asking for a disc check and I have been ignoring that. Is it a sign that it is still infected? Something about it being NFTS or NTFS ?!?

shbullets View Member Profile	May 19 2009, 08:40 PM Post #9
Member Posts: 25 OS: XP	Also, I'm getting this alert from my Zone Alarm pev.cfexe is trying to access the trusted zone. Should I let it? Edit: Let it through my firewall and there doesn't seem to be a problem. This post has been edited by shbullets: May 19 2009, 08:55 PM

shbullets View Member Profile	May 19 2009, 08:57 PM Post #10
Member Posts: 25 OS: XP	Hi! Here is the log: QUOTE ComboFix 09-05-19.08 - Gavin 19/05/2009 22:29.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.2.1033.18.511.153 [GMT -4:00] Running from: c:\documents and settings\Gavin\Desktop\ComboFix.exe AV: AVG Anti-Virus Free On-access scanning disabled (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall enabled {829BDA32-94B3-44F4-8446-F8FCFF809F8B} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\config\systemprofile\protect.dll . ((((((((((((((((((((((((( Files Created from 2009-04-20 to 2009-05-20 ))))))))))))))))))))))))))))))) . 2009-05-17 22:59 . 2009-05-17 22:59 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-05-17 22:59 . 2009-05-17 22:59 -------- d-----w c:\program files\SUPERAntiSpyware 2009-05-17 22:59 . 2009-05-17 22:59 -------- d-----w c:\documents and settings\Gavin\Application Data\SUPERAntiSpyware.com 2009-05-17 22:58 . 2009-05-17 22:58 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-05-17 21:04 . 2009-05-18 02:29 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-05-17 21:04 . 2009-05-18 02:29 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-05-17 20:46 . 2009-05-17 20:46 -------- d-----w c:\program files\Trend Micro 2009-05-17 01:50 . 2009-05-17 01:50 -------- d-----w c:\documents and settings\Gavin\Application Data\Malwarebytes 2009-05-17 01:50 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-05-17 01:50 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-17 01:50 . 2009-05-17 01:50 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes 2009-05-17 01:50 . 2009-05-17 01:50 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-16 22:10 . 2009-05-18 00:59 -------- d--h--w C:\$AVG8.VAULT$ 2009-05-16 22:06 . 2009-05-16 22:06 11952 ----a-w c:\windows\system32\avgrsstx.dll 2009-05-16 22:06 . 2009-05-16 22:06 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-05-16 22:06 . 2009-05-20 00:20 -------- d-----w c:\windows\system32\drivers\Avg 2009-05-16 22:06 . 2009-05-16 22:06 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-05-16 22:06 . 2009-05-16 22:06 -------- d-----w c:\program files\AVG 2009-05-16 22:06 . 2009-05-17 01:14 -------- d-----w c:\documents and settings\All Users\Application Data\avg8 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-20 02:37 . 2006-07-21 20:06 4212 ---ha-w c:\windows\system32\zllictbl.dat 2009-03-08 16:11 . 2005-07-05 22:48 121160 -c--a-w c:\documents and settings\Gavin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-03-06 14:44 . 2005-07-05 22:32 283648 ----a-w c:\windows\system32\pdh.dll 2009-02-20 08:30 . 2005-04-27 17:54 659456 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:30 . 2004-08-04 07:56 81920 ------w c:\windows\system32\ieencode.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-14 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-26 185896] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-16 1947928] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2004-08-04 53760] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-4-25 113664] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSetActiveDesktop"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-16 22:06 11952 ----a-w c:\windows\system32\avgrsstx.dll [HKLM\~\startupfolder\C:^Documents and Settings^Gavin^Start Menu^Programs^Startup^OpenOffice.org 1.1.4.lnk] path=c:\documents and settings\Gavin\Start Menu\Programs\Startup\OpenOffice.org 1.1.4.lnk backup=c:\windows\pss\OpenOffice.org 1.1.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Valve\\Steam\\Steam.exe"= "c:\\Program Files\\Valve\\Steam\\SteamApps\\room302\\counter-strike source\\hl2.exe"= "c:\\Soldat\\Soldat.exe"= "c:\\Program Files\\BitTorrent\\btdownloadgui.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "23413:TCP"= 23413:TCP:BitComet 23413 TCP "23413:UDP"= 23413:UDP:BitComet 23413 UDP R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [16/05/2009 6:06 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [16/05/2009 6:06 PM 108552] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [14/05/2009 2:22 PM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [14/05/2009 2:22 PM 72944] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16/05/2009 6:06 PM 298776] R2 PMJ151NM;Panasonic DVC Web Camera;c:\windows\system32\drivers\PMJ151NM.sys [14/01/2006 11:02 PM 14848] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [03/10/2006 9:57 PM 2368] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [14/05/2009 2:22 PM 7408] S0 xlaeov;xlaeov;c:\windows\system32\drivers\yvjxikyy.sys --> c:\windows\system32\drivers\yvjxikyy.sys [?] S3 gtermddo;gtermddo;\??\c:\docume~1\Gavin\LOCALS~1\Temp\gtermddo.sys --> c:\docume~1\Gavin\LOCALS~1\Temp\gtermddo.sys [?] S3 SydexFDD;Sydex Diskette Driver;c:\windows\system32\drivers\SYDEXFDD.SYS [05/11/2007 8:23 PM 13359] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.ca/ mSearch Bar = IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 LSP: c:\windows\system32\idmmbc.dll DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Gavin\Application Data\Mozilla\Firefox\Profiles\3xk1wvt8.default\ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-19 22:35 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PMJ151LA] "ImagePath"="%SystemRoot%\PMJ151LA.BIN" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{3e4448df-895d-4ef7-99a2-4a970dbe12d9}] @Denied: (Full) (Everyone) "Model"=dword:000000db "Therad"=dword:00000016 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) "scansk"=hex(0):bf,cd,db,a0,62,5c,b9,b9,f0,b2,26,95,e3,02,62,1d,de,e7,17,0a,9b, 0a,ad,d7,7f,09,cf,b6,fc,30,36,e1,e2,87,97,66,55,48,34,7d,00,00,00,00,00,00,\ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(528) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\Ati2evxx.dll - - - - - - - > 'lsass.exe'(584) c:\windows\system32\idmmbc.dll - - - - - - - > 'explorer.exe'(640) c:\progra~1\WINDOW~2\wmpband.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ZoneLabs\vsmon.exe c:\windows\system32\ati2evxx.exe c:\windows\PMJ151LA.BIN c:\windows\system32\PnkBstrA.exe c:\windows\system32\PnkBstrB.exe c:\windows\system32\wdfmgr.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\windows\system32\wscntfy.exe . ************************************************************************ . Completion time: 2009-05-20 22:55 - machine was rebooted ComboFix-quarantined-files.txt 2009-05-20 02:55 Pre-Run: 7,234,813,952 bytes free Post-Run: 7,551,426,560 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 183 --- E O F --- 2009-05-20 01:38

sage5 View Member Profile	May 19 2009, 09:16 PM Post #11
RIP 10/2009 Posts: 2,646 From: NE Victoria, Australia OS: WinXp SP3	Hi shbullets, Please download the following & save to your Desktop: OTListIt Run OTListIt2: Close all open windows and double click the OTListIt2.exe icon on your Desktop Tick the Scan all Users box, & check Standard Output. Set the File Age: box to 30 days Make sure that the Extra Registry is set to Safe List Leave all the other boxes set to the defaults Click the Run Scan button and let the program run uninterrupted. It will produce 2 log for you. OTListIt.txt will open automatically. Extras.txt should also be open. I need you to post the text from both logs here. NOTE: Thes can be large files, and there is a limit to the number of characters that can be posted at once on this forum. It may require you to make 2 posts, to get all the information to me Cheers, sage5

shbullets View Member Profile	May 19 2009, 09:39 PM Post #12
Member Posts: 25 OS: XP	OTListit Log: QUOTE OTListIt logfile created on: 19/05/2009 11:28:22 PM - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Documents and Settings\Gavin\Desktop Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00001009 \| Country: Canada \| Language: ENC \| Date Format: dd/MM/yyyy 511.48 Mb Total Physical Memory \| 132.68 Mb Available Physical Memory \| 25.94% Memory free 1.22 Gb Paging File \| 0.78 Gb Available in Paging File \| 64.38% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 37.27 Gb Total Space \| 7.05 Gb Free Space \| 18.93% Space Free \| Partition Type: NTFS Drive D: \| 37.26 Gb Total Space \| 37.20 Gb Free Space \| 99.83% Space Free \| Partition Type: NTFS Drive E: \| 701.13 Mb Total Space \| 0.00 Mb Free Space \| 0.00% Space Free \| Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: GUILDWARS Current User Name: Gavin Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Output = Standard File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - [2006/05/03 12:43:46 \| 00,413,696 \| ---- \| M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\Ati2evxx.exe PRC - [2009/02/16 00:10:22 \| 02,402,184 \| ---- \| M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe PRC - [2006/05/03 12:43:46 \| 00,413,696 \| ---- \| M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\Ati2evxx.exe PRC - [2007/06/13 06:23:07 \| 01,033,216 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2009/05/16 18:06:19 \| 00,298,776 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe PRC - [2002/04/11 06:36:26 \| 00,114,688 \| R--- \| M] (Matsushita Electric Industrial Co. ,Ltd,) -- C:\WINDOWS\PMJ151LA.BIN PRC - [2009/02/09 22:28:17 \| 00,066,872 \| ---- \| M] () -- C:\WINDOWS\system32\PnkBstrA.exe PRC - [2009/02/14 23:20:26 \| 00,107,832 \| ---- \| M] () -- C:\WINDOWS\system32\PnkBstrB.exe PRC - [2005/01/28 16:44:28 \| 00,038,912 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe PRC - [2009/05/16 18:06:23 \| 00,486,680 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe PRC - [2009/05/16 18:06:23 \| 00,594,712 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgnsx.exe PRC - [2009/02/06 12:39:29 \| 00,227,840 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2006/01/02 17:41:22 \| 00,045,056 \| ---- \| M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\cli.exe PRC - [2008/04/25 21:02:02 \| 00,185,896 \| ---- \| M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe PRC - [2009/02/16 00:10:22 \| 00,981,384 \| ---- \| M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe PRC - [2009/05/16 18:06:20 \| 01,947,928 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe PRC - [2009/05/14 14:21:58 \| 01,830,128 \| ---- \| M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2006/01/02 17:41:22 \| 00,045,056 \| ---- \| M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\cli.exe PRC - [2009/05/19 23:26:55 \| 00,501,248 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gavin\Desktop\OTListIt2.exe ========== Win32 Services (SafeList) ========== SRV - [2007/10/24 01:47:22 \| 00,033,800 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand \| Stopped]) SRV - [2006/05/03 12:43:46 \| 00,413,696 \| ---- \| M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\Ati2evxx.exe -- (Ati HotKey Poller [Auto \| Running]) SRV - [2006/05/03 11:57:00 \| 00,520,192 \| ---- \| M] () -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart [Auto \| Stopped]) SRV - [2009/05/16 18:06:19 \| 00,298,776 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd [Auto \| Running]) SRV - [2007/10/24 01:47:40 \| 00,070,144 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) SRV - [2004/08/04 03:56:44 \| 00,038,912 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto \| Running]) SRV - [2005/06/24 15:16:26 \| 00,331,776 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPodService [On_Demand \| Stopped]) SRV - [2007/08/24 03:19:12 \| 00,443,776 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand \| Stopped]) SRV - [2006/10/26 14:03:08 \| 00,145,184 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand \| Stopped]) SRV - [2002/04/11 06:36:26 \| 00,114,688 \| R--- \| M] (Matsushita Electric Industrial Co. ,Ltd,) -- C:\WINDOWS\PMJ151LA.BIN -- (PMJ151LA [Auto \| Running]) SRV - [2009/02/09 22:28:17 \| 00,066,872 \| ---- \| M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA [Auto \| Running]) SRV - [2009/02/14 23:20:26 \| 00,107,832 \| ---- \| M] () -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB [Auto \| Running]) SRV - [2005/08/04 09:58:35 \| 00,822,424 \| ---- \| M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC [On_Demand \| Stopped]) SRV - [2005/01/28 16:44:28 \| 00,038,912 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto \| Running]) SRV - [2007/10/18 11:31:54 \| 00,098,328 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe -- (usnjsvc [On_Demand \| Stopped]) SRV - [2009/02/16 00:10:22 \| 02,402,184 \| ---- \| M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- (vsmon [Auto \| Running]) SRV - [2007/10/25 15:27:54 \| 00,266,240 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc [On_Demand \| Stopped]) ========== Driver Services (SafeList) ========== DRV - [2002/10/27 20:26:30 \| 00,947,884 \| ---- \| M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand \| Running]) DRV - [2002/08/29 00:00:00 \| 00,005,248 \| ---- \| M] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde [Boot \| Running]) DRV - [2004/08/04 02:07:42 \| 00,043,008 \| ---- \| M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,026,496 \| ---- \| M] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,014,848 \| ---- \| M] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550 [Boot \| Running]) DRV - [2006/05/03 12:50:42 \| 01,540,608 \| ---- \| M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand \| Running]) DRV - [2005/05/30 18:58:52 \| 00,028,160 \| ---- \| M] (W1zzard) -- C:\WINDOWS\system32\DRIVERS\ATITool.sys -- (ATITool [System \| Running]) DRV - [2009/05/16 18:06:40 \| 00,325,896 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86 [System \| Running]) DRV - [2009/05/16 18:06:39 \| 00,027,784 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86 [System \| Running]) DRV - [2009/05/16 18:06:24 \| 00,108,552 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX [System \| Running]) DRV - [2001/10/04 00:40:52 \| 00,076,610 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\basic2.sys -- (basic2 [On_Demand \| Running]) DRV - [2002/08/29 00:00:00 \| 00,006,656 \| ---- \| M] (CMD Technology, Inc.) -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,179,584 \| ---- \| M] (Mylex Corporation) -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k [Boot \| Running]) DRV - [2001/10/04 00:55:56 \| 00,308,979 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\fallback.sys -- (Fallback [Auto \| Running]) DRV - [2001/10/04 01:12:38 \| 00,124,189 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\fsksnt.sys -- (Fsks [Auto \| Running]) DRV - [2004/08/04 02:08:21 \| 00,010,624 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys -- (gameenum [On_Demand \| Running]) DRV - [2001/10/04 01:16:38 \| 00,427,471 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\k56nt.sys -- (K56 [Auto \| Running]) DRV - [2002/08/29 00:00:00 \| 00,017,280 \| ---- \| M] (American Megatrends Inc.) -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x [Boot \| Running]) DRV - [2001/08/17 16:00:04 \| 00,002,944 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401 [On_Demand \| Running]) DRV - [2002/03/19 14:33:40 \| 00,014,848 \| R--- \| M] (Matsushita Electric Industrial Co. ,Ltd,) -- C:\WINDOWS\system32\DRIVERS\PMJ151NM.sys -- (PMJ151NM [Auto \| Running]) DRV - [2002/08/29 00:00:00 \| 00,017,792 \| ---- \| M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand \| Running]) DRV - [2005/03/11 18:28:13 \| 00,020,640 \| ---- \| M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,040,320 \| ---- \| M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080 [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,045,312 \| ---- \| M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160 [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,049,024 \| ---- \| M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280 [Boot \| Running]) DRV - [2001/10/04 00:39:12 \| 00,067,222 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\rksample.sys -- (Rksample [On_Demand \| Running]) DRV - [2001/08/23 00:03:54 \| 00,025,434 \| ---- \| M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand \| Running]) DRV - [2009/05/14 14:22:00 \| 00,009,968 \| ---- \| M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV [System \| Running]) DRV - [2009/05/14 14:22:02 \| 00,007,408 \| R--- \| M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM [On_Demand \| Running]) DRV - [2009/05/14 14:22:00 \| 00,072,944 \| ---- \| M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys -- (SASKUTIL [System \| Running]) DRV - [2007/11/13 06:25:53 \| 00,020,480 \| ---- \| M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand \| Stopped]) DRV - [2004/08/04 02:07:42 \| 00,041,088 \| ---- \| M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp [Boot \| Running]) DRV - [2001/10/04 01:06:06 \| 00,215,227 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\faxnt.sys -- (SoftFax [Auto \| Running]) DRV - [2001/08/17 13:56:16 \| 00,007,552 \| ---- \| M] (Sony Corporation) -- C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1 [On_Demand \| Stopped]) DRV - [2002/08/29 00:00:00 \| 00,019,072 \| ---- \| M] (Adaptec, Inc.) -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow [Boot \| Running]) DRV - [2008/11/17 02:24:00 \| 00,051,688 \| ---- \| M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan [Boot \| Running]) DRV - [2006/10/03 21:57:48 \| 00,002,368 \| ---- \| M] (AntiCracking) -- C:\WINDOWS\system32\SVKP.sys -- (SVKP [Auto \| Running]) DRV - [2003/08/01 15:00:40 \| 00,013,359 \| ---- \| M] (Windows ® 2000 DDK provider) -- C:\WINDOWS\system32\Drivers\sydexfdd.sys -- (SydexFDD [On_Demand \| Stopped]) DRV - [2002/08/29 00:00:00 \| 00,016,256 \| ---- \| M] (Symbios Logic Inc.) -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810 [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,032,640 \| ---- \| M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx [Boot \| Running]) DRV - [2005/08/04 10:25:50 \| 00,004,608 \| ---- \| M] (Symantec Corporation) -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd [Auto \| Running]) DRV - [2002/08/29 00:00:00 \| 00,028,384 \| ---- \| M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi [Boot \| Running]) DRV - [2002/08/29 00:00:00 \| 00,030,688 \| ---- \| M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3 [Boot \| Running]) DRV - [2001/10/04 00:58:10 \| 00,059,407 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\tonesnt.sys -- (Tones [Auto \| Running]) DRV - [2002/08/29 00:00:00 \| 00,036,736 \| ---- \| M] (Promise Technology, Inc.) -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra [Boot \| Running]) DRV - [2001/10/04 00:37:36 \| 00,540,157 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\v124nt.sys -- (V124 [Auto \| Running]) DRV - [2009/02/16 00:10:26 \| 00,353,672 \| ---- \| M] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsdatant.sys -- (vsdatant [System \| Running]) DRV - [2001/10/04 01:24:16 \| 00,585,792 \| ---- \| M] (Conexant Systems) -- C:\WINDOWS\System32\DRIVERS\HSF_MDM.sys -- (winachsf [On_Demand \| Running]) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ IE - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\S-1-5-21-3471760072-1514949407-1960508681-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.1.8.5 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}:6.0.01 FF - prefs.js..extensions.enabledItems: {77525D75-9388-437E-BB11-75BD4D11540D}:1.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD [2008/04/25 21:03:43 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\PROGRAM FILES\AVG\AVG8\FIREFOX [2009/05/16 18:06:19 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/05/16 17:15:37 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/05/17 16:26:10 \| 00,000,000 \| ---D \| M] [2008/09/03 17:19:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gavin\Application Data\mozilla\Extensions [2008/09/03 17:19:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gavin\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/05/19 20:25:35 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gavin\Application Data\mozilla\Firefox\Profiles\3xk1wvt8.default\extensions [2009/03/29 00:28:09 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gavin\Application Data\mozilla\Firefox\Profiles\3xk1wvt8.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34} [2007/09/19 16:16:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gavin\Application Data\mozilla\Firefox\Profiles\3xk1wvt8.default\extensions\videodowloader@videodownloader.net [2009/05/19 20:25:35 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions [2009/05/16 16:44:54 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{77525D75-9388-437E-BB11-75BD4D11540D} [2009/05/01 07:20:12 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2007/05/04 16:33:39 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [2009/05/01 07:20:03 \| 00,023,032 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/05/01 07:20:04 \| 00,134,648 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2008/07/02 12:31:38 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2008/07/02 12:31:38 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2008/07/02 12:31:38 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2008/11/13 20:48:12 \| 00,002,343 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2008/07/02 12:31:38 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2008/07/02 12:31:38 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager Corp., Tonec Inc.) O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll (BitComet) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - Reg Error: Key error. File not found O3 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found O4 - HKLM..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay (ATI Technologies Inc.) O4 - HKLM..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (RealNetworks, Inc.) O4 - HKLM..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" (Check Point Software Technologies LTD) O4 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] Narrator.exe (Microsoft Corporation) O4 - HKU\S-1-5-18..\RunOnce: [RunNarrator] Narrator.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm (www.BitComet.com) O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm (www.BitComet.com) O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm (www.BitComet.com) O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm () O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm () O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll (Sun Microsystems, Inc.) O9 - Extra Button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll (BitComet) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\idmmbc.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\idmmbc.dll () O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/Facebo...toUploader5.cab (Facebook Photo Uploader 5) O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0...D0C/wmv9dmo.cab (Reg Error: Key error.) O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab (FilePlanet Download Control Class) O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m...96/mcinsctl.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn.com/download/MsnMesse...pDownloader.cab (MsnMessengerSetupDownloadControl Class) O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab (Reg Error: Key error.) O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} http://www.systemrequirementslab.com/sysreqlab.cab (System Requirements Lab Class) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_10) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\system32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O24 - Desktop Components:0 (My Current Home Page) - About:Home O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2002/10/30 03:13:48 \| 00,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - [2009/05/19 23:25:07 \| 00,000,000 \| ---D \| M] ========== Files/Folders - Created Within 30 Days ========== [2 C:\.tmp files] [2 C:\WINDOWS\.tmp files] [2009/05/19 23:26:54 \| 00,501,248 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Gavin\Desktop\OTListIt2.exe [2009/05/19 22:27:55 \| 00,000,211 \| ---- \| C] () -- C:\Boot.bak [2009/05/19 22:27:40 \| 00,260,272 \| ---- \| C] () -- C:\cmldr [2009/05/19 22:27:30 \| 00,000,000 \| RHSD \| C] -- C:\cmdcons [2009/05/19 22:25:53 \| 00,212,480 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2009/05/19 22:25:53 \| 00,161,792 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2009/05/19 22:25:53 \| 00,136,704 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2009/05/19 22:25:53 \| 00,117,248 \| ---- \| C] () -- C:\WINDOWS\vFind.exe [2009/05/19 22:25:53 \| 00,098,816 \| ---- \| C] () -- C:\WINDOWS\sed.exe [2009/05/19 22:25:53 \| 00,080,412 \| ---- \| C] () -- C:\WINDOWS\grep.exe [2009/05/19 22:25:53 \| 00,068,096 \| ---- \| C] () -- C:\WINDOWS\zip.exe [2009/05/19 22:25:53 \| 00,031,232 \| ---- \| C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2009/05/19 21:29:29 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\ERDNT [2009/05/19 21:29:21 \| 00,000,000 \| ---D \| C] -- C:\Qoobox [2009/05/19 20:20:28 \| 02,989,964 \| R--- \| C] () -- C:\Documents and Settings\Gavin\Desktop\ComboFix.exe [2009/05/17 23:55:30 \| 24,699,336 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009/05/17 18:59:37 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com [2009/05/17 18:59:28 \| 00,000,786 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk [2009/05/17 18:59:21 \| 00,000,000 \| ---D \| C] -- C:\Program Files\SUPERAntiSpyware [2009/05/17 18:59:21 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gavin\Application Data\SUPERAntiSpyware.com [2009/05/17 18:58:45 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Wise Installation Wizard [2009/05/17 17:04:06 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Spybot - Search & Destroy [2009/05/17 17:04:06 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy [2009/05/17 16:46:25 \| 00,001,740 \| ---- \| C] () -- C:\Documents and Settings\Gavin\Desktop\HijackThis.lnk [2009/05/17 16:46:25 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Trend Micro [2009/05/17 15:57:42 \| 01,147,904 \| ---- \| C] () -- C:\Documents and Settings\Gavin\Desktop\GAVIN NEW ORLEANS FOOD AND NUTRITION.doc [2009/05/17 15:57:38 \| 00,089,600 \| ---- \| C] () -- C:\Documents and Settings\Gavin\Desktop\NUTRITION QUESTIONS.doc [2009/05/16 22:27:32 \| 00,000,000 \| R--D \| C] -- C:\Documents and Settings\Gavin\Desktop\Second Term [2009/05/16 22:27:02 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gavin\My Documents\Strathcona Hotel [2009/05/16 22:26:10 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gavin\My Documents\Misc Pics [2009/05/16 22:25:29 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gavin\My Documents\School Work 2008 [2009/05/16 22:23:32 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gavin\Desktop\May 09 [2009/05/16 22:22:13 \| 00,000,000 \| R--D \| C] -- C:\Documents and Settings\Gavin\Desktop\Protection Set-Ups [2009/05/16 21:50:31 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gavin\Application Data\Malwarebytes [2009/05/16 21:50:13 \| 00,000,714 \| ---- \| C] () -- C:\Documents and Settings\Gavin\Desktop\Malwarebytes' Anti-Malware.lnk [2009/05/16 21:50:12 \| 00,015,504 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/05/16 21:50:09 \| 00,038,496 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/05/16 21:50:06 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/05/16 21:50:05 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/05/16 18:10:01 \| 00,000,000 \| -H-D \| C] -- C:\$AVG8.VAULT$ [2009/05/16 18:06:50 \| 00,011,952 \| ---- \| C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll [2009/05/16 18:06:50 \| 00,001,513 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk [2009/05/16 18:06:40 \| 00,325,896 \| ---- \| C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys [2009/05/16 18:06:39 \| 00,027,784 \| ---- \| C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys [2009/05/16 18:06:30 \| 36,240,826 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2009/05/16 18:06:30 \| 06,061,540 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg [2009/05/16 18:06:30 \| 00,434,673 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg [2009/05/16 18:06:30 \| 00,057,765 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg [2009/05/16 18:06:30 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\System32\drivers\Avg [2009/05/16 18:06:23 \| 00,108,552 \| ---- \| C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys [2009/05/16 18:06:19 \| 00,000,000 \| ---D \| C] -- C:\Program Files\AVG [2009/05/16 18:06:19 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\avg8 [2009/05/16 11:45:25 \| 00,078,848 \| ---- \| C] () -- C:\Documents and Settings\Gavin\Desktop\Organizational Behaviour Ch 3.doc [2009/02/09 22:28:37 \| 00,022,328 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2008/06/08 18:24:10 \| 00,002,059 \| ---- \| C] () -- C:\WINDOWS\wp2.ini [2008/06/08 18:07:56 \| 00,000,019 \| ---- \| C] () -- C:\WINDOWS\wp.ini [2008/06/08 18:07:38 \| 00,002,059 \| ---- \| C] () -- C:\WINDOWS\guess.ini [2008/06/08 18:07:26 \| 00,002,059 \| ---- \| C] () -- C:\WINDOWS\wp3.ini [2006/07/21 16:06:06 \| 00,796,584 \| ---- \| C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll [2006/05/06 10:44:33 \| 00,000,421 \| ---- \| C] () -- C:\WINDOWS\cdplayer.ini [2006/02/05 17:56:43 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\VPC32.INI [2005/10/16 10:57:37 \| 00,000,376 \| ---- \| C] () -- C:\WINDOWS\ODBC.INI [2005/09/26 22:11:20 \| 00,000,979 \| ---- \| C] () -- C:\WINDOWS\ATICIM.INI [2005/08/28 21:16:02 \| 00,000,067 \| ---- \| C] () -- C:\WINDOWS\IDMan.INI [2005/08/15 15:02:43 \| 00,043,520 \| ---- \| C] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2005/07/17 09:45:59 \| 00,036,864 \| ---- \| C] () -- C:\WINDOWS\System32\frapsvid.dll [2005/07/05 19:36:33 \| 00,000,192 \| ---- \| C] () -- C:\WINDOWS\winamp.ini [2005/07/05 16:54:01 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\ATIMMC.INI [2005/07/05 16:39:35 \| 00,000,314 \| ---- \| C] () -- C:\WINDOWS\WININIT.INI [2005/07/05 16:06:38 \| 00,363,520 \| ---- \| C] () -- C:\WINDOWS\System32\psisdecd.dll [2005/04/28 00:22:38 \| 03,596,288 \| ---- \| C] () -- C:\WINDOWS\System32\qt-dx331.dll [2005/04/28 00:22:34 \| 00,831,488 \| ---- \| C] () -- C:\WINDOWS\System32\libeay32.dll [2004/02/19 11:42:46 \| 00,131,072 \| ---- \| C] () -- C:\WINDOWS\System32\idmmbc.dll [2003/03/28 17:31:52 \| 00,013,601 \| ---- \| C] () -- C:\WINDOWS\System32\vctest.ini [2002/10/30 03:32:04 \| 00,049,152 \| ---- \| C] () -- C:\WINDOWS\System32\TransportUSB.dll [2002/10/30 03:32:04 \| 00,049,152 \| ---- \| C] () -- C:\WINDOWS\System32\TransportSerial.dll [2002/10/30 03:19:34 \| 00,000,061 \| ---- \| C] () -- C:\WINDOWS\smscfg.ini [2002/10/30 01:58:43 \| 00,001,532 \| ---- \| C] () -- C:\WINDOWS\System32\oeminfo.ini [2002/10/30 01:58:01 \| 00,000,655 \| ---- \| C] () -- C:\WINDOWS\win.ini [2002/10/30 01:57:55 \| 00,000,227 \| ---- \| C] () -- C:\WINDOWS\system.ini ========== Files - Modified Within 30 Days ========== [2 C:\.tmp files] [1 C:\WINDOWS\System32\.tmp files] [2 C:\WINDOWS\*.tmp files] [2009/05/19 23:26:55 \| 00,501,248 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gavin\Desktop\OTListIt2.exe [2009/05/19 23:24:53 \| 00,004,212 \| -H-- \| M] () -- C:\WINDOWS\System32\zllictbl.dat [2009/05/19 23:23:35 \| 00,350,197 \| -H-- \| M] () -- C:\WINDOWS\System32\vsconfig.xml [2009/05/19 23:22:58 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2009/05/19 23:22:25 \| 00,000,062 \| -HS- \| M] () -- C:\Documents and Settings\Gavin\Local Settings\desktop.ini [2009/05/19 23:22:17 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2009/05/19 22:37:03 \| 00,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2009/05/19 22:34:59 \| 00,000,027 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009/05/19 22:27:55 \| 00,000,281 \| RHS- \| M] () -- C:\boot.ini [2009/05/19 20:20:38 \| 02,989,964 \| R--- \| M] () -- C:\Documents and Settings\Gavin\Desktop\ComboFix.exe [2009/05/19 20:18:31 \| 36,240,826 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2009/05/19 20:18:31 \| 00,057,765 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg [2009/05/19 20:12:39 \| 00,001,158 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2009/05/17 18:59:28 \| 00,000,786 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk [2009/05/17 18:05:01 \| 00,000,314 \| ---- \| M] () -- C:\WINDOWS\WININIT.INI [2009/05/17 17:24:34 \| 00,089,600 \| ---- \| M] () -- C:\Documents and Settings\Gavin\Desktop\NUTRITION QUESTIONS.doc [2009/05/17 16:46:25 \| 00,001,740 \| ---- \| M] () -- C:\Documents and Settings\Gavin\Desktop\HijackThis.lnk [2009/05/17 15:57:44 \| 01,147,904 \| ---- \| M] () -- C:\Documents and Settings\Gavin\Desktop\GAVIN NEW ORLEANS FOOD AND NUTRITION.doc [2009/05/16 21:50:13 \| 00,000,714 \| ---- \| M] () -- C:\Documents and Settings\Gavin\Desktop\Malwarebytes' Anti-Malware.lnk [2009/05/16 21:11:08 \| 00,078,848 \| ---- \| M] () -- C:\Documents and Settings\Gavin\Desktop\Organizational Behaviour Ch 3.doc [2009/05/16 18:06:50 \| 00,011,952 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll [2009/05/16 18:06:50 \| 00,001,513 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk [2009/05/16 18:06:40 \| 00,325,896 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys [2009/05/16 18:06:39 \| 00,027,784 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys [2009/05/16 18:06:30 \| 06,061,540 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg [2009/05/16 18:06:30 \| 00,434,673 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg [2009/05/16 18:06:24 \| 00,108,552 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys [2009/05/14 17:50:08 \| 00,117,248 \| ---- \| M] () -- C:\WINDOWS\vFind.exe [2009/05/07 00:16:30 \| 24,699,336 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009/04/26 12:29:16 \| 00,464,684 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/04/26 12:29:16 \| 00,397,868 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2009/04/26 12:29:16 \| 00,059,896 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2009/04/20 12:56:28 \| 00,031,232 \| ---- \| M] (NirSoft) -- C:\WINDOWS\NIRCMD.exe < End of report >

sage5 View Member Profile	May 20 2009, 01:36 AM Post #14
RIP 10/2009 Posts: 2,646 From: NE Victoria, Australia OS: WinXp SP3	Hi shbullets, Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems Ugrading Java: Download the latest version of Java Runtime Environment (JRE) 6 Update 11. Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 13". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version. Run OTListIt2.exe Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTLI PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) SRV - [2005/08/04 09:58:35 \| 00,822,424 \| ---- \| M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC [On_Demand \| Stopped]) DRV - [2005/08/04 10:25:50 \| 00,004,608 \| ---- \| M] (Symantec Corporation) -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd [Auto \| Running]) O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll (BitComet) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - Reg Error: Key error. File not found O3 - HKU\S-1-5-21-3471760072-1514949407-1960508681-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_10) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) :Services :Reg :Files C:\WINDOWS\wp2.ini C:\WINDOWS\wp.ini C:\WINDOWS\guess.ini C:\WINDOWS\wp3.ini :Commands [purity] [emptytemp] [resethosts] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Then post a new OTL2 log

shbullets View Member Profile	May 20 2009, 08:52 AM Post #15
Member Posts: 25 OS: XP	Hi, I am having trouble restarting/turning off my computer so I did a cold reboot, is that ok? Edit: Here is a log file 05202009_104518 QUOTE ========== OTLISTIT ========== Process explorer.exe killed successfully! Service\Driver Symantec Core LC deleted successfully. C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe moved successfully. Service\Driver symlcbrd stopped successfully. Service\Driver symlcbrd deleted successfully. C:\WINDOWS\system32\drivers\symlcbrd.sys moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\ deleted successfully. Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\ . C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll unregistered successfully. C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ not found. Registry value HKEY_USERS\S-1-5-21-3471760072-1514949407-1960508681-1006\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\WINDOWS\wp2.ini moved successfully. C:\WINDOWS\wp.ini moved successfully. C:\WINDOWS\guess.ini moved successfully. C:\WINDOWS\wp3.ini moved successfully. ========== COMMANDS ========== File delete failed. C:\Documents and Settings\Gavin\Local Settings\Temp\~DFFD90.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_b8c.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\ZLT035f1.TMP scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully Explorer started successfully OTListIt2 by OldTimer - Version 2.0.15.8 log created on 05202009_104518 Files moved on Reboot... File move failed. C:\Documents and Settings\Gavin\Local Settings\Temp\~DFFD90.tmp scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\Perflib_Perfdata_b8c.dat scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\ZLT035f1.TMP scheduled to be moved on reboot. Registry entries deleted on Reboot... This post has been edited by shbullets: May 20 2009, 08:53 AM

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

3 Pages

1 2 3 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Msn messenger virus that keeps coming back! [CLOSED]	2 / 3,608	22nd June 2005 - 02:59 PM AlainHsu started - last by greyknight17
Virus, Spyware and Trojan Removal mulitple malware that keeps coming back [RESOLVED] 123	36 / 2,196	31st March 2006 - 05:27 PM vbuck started - last by ukbiker
Virus, Spyware and Trojan Removal Having problems with a Trojan and Adware that keeps coming back [Solve 12	27 / 922	2nd April 2009 - 03:36 PM oliver amaya started - last by Essexboy
Virus, Spyware and Trojan Removal Very bad case of Malware [Solved]	8 / 177	24th May 2009 - 02:30 AM Paddling started - last by CatByte