Trojan sending spam emails from my computer- PLEASE help!

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

Trojan sending spam emails from my computer- PLEASE help!

Options

woofless View Member Profile	Nov 1 2009, 07:25 PM Post #1
Member Posts: 11 OS: windows vista	Hi, I posted here 2 weeks ago with this problem and nobody responded to my post Hoping that it just got overlooked, I'm trying again. I am at a loss for what to do- I have run multiple scans (AVG and McAfee), downloaded Malware Bytes anti-malware, and nothing seems to detect a problem. Actually- about 2 weeks ago, AVG did pop up with an "infection detected" alert, saying I had a Trojan, but it wouldn't let me remove it, only quarantine it. And of course it didn't stop the problem. Basically, McAfee email scan starts running in my toolbar whenever I sign on to the Internet, keeping tabs on how many emails are being sent- hundreds every hour. Occasionally, an alert pops up saying an email couldn't be sent because my IP has been "blacklisted" by somebody's spam-arresting program. At this point I can look at the email log & it is just hundreds of addresses in alphabetical order- obviously spam emails. I use webmail for my email so obviously I have no idea where these emails are originating. That- and my Myspace account has been repeatedly "phished" despite the fact that I sign on to it probably once a week and never click on links there. I have changed my password 10 times & it still happens. I have no idea if it is related but I also use my computer for online banking & am afraid whatever this is will somehow get ahold of that information! I downloaded Hijack This and here is my log- PLEASE can somebody offer some insight- it will be greatly appreciated! Thank you!!! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:17:08 PM, on 11/1/2009 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16916) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe C:\Program Files\Lexmark Z2400 Series\lxdqMsdMon.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Walgreens\Walgreens PhotoShow 4\data\Xtras\mssysmgr.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\Electronic Arts\EADM\Core.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe c:\PROGRA~1\COMMON~1\mcafee\emproxy\emtray.exe C:\Program Files\Microsoft Streets & Trips\Streets.exe C:\Windows\system32\Taskmgr.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe C:\Windows\System32\mobsync.exe C:\Windows\system32\taskeng.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [lxdqmon.exe] "C:\Program Files\Lexmark Z2400 Series\lxdqmon.exe" O4 - HKLM\..\Run: [lxdqamon] "C:\Program Files\Lexmark Z2400 Series\lxdqamon.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [Walgreens PhotoShow Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Startup: FREE OFFER from Audible.com.lnk = C:\Users\Danielle\AppData\Local\Temp\HelpInstaller_StartUp.exe O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Startup: VZAccess Manager.lnk = C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{85DA0C2A-FC2F-44A9-9189-2A4C839EBA6F}: NameServer = 75.116.63.154 75.116.127.154 O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll O23 - Service: McAfee Application Installer Cleanup (0120441256395952) (0120441256395952mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\012044~1.EXE O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: lxdqCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdqserv.exe O23 - Service: lxdq_device - - C:\Windows\system32\lxdqcoms.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: pinger - Unknown owner - C:\Toshiba\IVP\ISM\pinger.exe O23 - Service: SPCSUtilityService - Sprint Spectrum, L.L.C - C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 13166 bytes

2 Pages

1 2 >

Replies (1 - 14)

andrewuk View Member Profile	Nov 2 2009, 05:39 AM Post #2
Trusted Helper Posts: 4,613 From: London, UK OS: XP	Hello woofless welcome to geekstogo sorry to overlook your prior log. lets get some scans done for me to analyse, but firstly we need to sort out your security programs. you should only have one antivirus and one antispyware program running at anyone time. running more than one can cause conflict, slow down your machine and provide less, not more, protection. therefore, could you disable or uninstall two of them please. also, i would stop using this machine for online banking or accessing other password protected sites until we get it clean. from a clean machine, i would advise changing the passwords to those sites. and then: ====STEP 1==== go to http://www.geekstogo.com/forum/Malware-Spy...uide-t2852.html and run RootRepeal in Step Five: Rootkit Detection ====STEP 2==== from the same page, go to Step Six: Post an OTL Log and run the OTL log, include the custom scan as explained on that page. In your next reply could i see: 1. the RootRepeal log 2. the OTL log The text from these files may exceed the maximum post length for this forum. Hence, you may need to post the information over 2 or more posts. andrewuk

woofless View Member Profile	Nov 6 2009, 10:59 AM Post #3
Member Posts: 11 OS: windows vista	Hi, and THANK YOU for replying!! Sorry it took a while to respond, been busy & my rural wireless internet speed has been slow as molasses. Unfortunately, it seems Root Repeal isn't working properly for me. When I open the program I get an error message that says FOPS DeviceIOControl Error! Error Code = 0xc0000024 (Extended Info 0x00000134). Then when I follow the instructions to scan, it gives me this error report: 10:34:20: DeviceIoControl Error! Error Code = 0x0 10:34:20: DeviceIoControl Error! Error Code = 0x0 10:34:20: DeviceIoControl Error! Error Code = 0x0 10:34:20: DeviceIoControl Error! Error Code = 0x0 10:34:20: DeviceIoControl Error! Error Code = 0x0 10:34:20: DeviceIoControl Error! Error Code = 0x0 10:34:20: Could not get the name for PID 4. 10:34:20: Could not get the name for PID 468. 10:34:20: Could not get the name for PID 532. 10:34:20: Could not get the name for PID 580. 10:34:20: Could not get the name for PID 592. 10:34:20: Could not get the name for PID 636. 10:34:20: Could not get the name for PID 648. 10:34:20: Could not get the name for PID 656. 10:34:20: Could not get the name for PID 696. 10:34:20: Could not get the name for PID 936. 10:34:20: Could not get the name for PID 980. 10:34:20: Could not get the name for PID 1028. 10:34:20: Could not get the name for PID 1060. 10:34:20: Could not get the name for PID 1148. 10:34:20: Could not get the name for PID 1164. 10:34:20: Could not get the name for PID 1204. 10:34:20: Could not get the name for PID 1220. 10:34:20: Could not get the name for PID 1352. 10:34:20: Could not get the name for PID 1428. 10:34:20: Could not get the name for PID 1472. 10:34:20: Could not get the name for PID 1556. 10:34:20: Could not get the name for PID 1688. 10:34:20: Could not get the name for PID 1872. 10:34:20: Could not get the name for PID 1904. 10:34:20: Could not get the name for PID 484. 10:34:20: Could not get the name for PID 12. 10:34:20: Could not get the name for PID 836. 10:34:20: Could not get the name for PID 1640. 10:34:20: Could not get the name for PID 1972. 10:34:20: Could not get the name for PID 932. 10:34:20: Could not get the name for PID 812. 10:34:20: Could not get the name for PID 2060. 10:34:20: Could not get the name for PID 2072. 10:34:20: Could not get the name for PID 2152. 10:34:20: Could not get the name for PID 2160. 10:34:20: Could not get the name for PID 2256. 10:34:20: Could not get the name for PID 2296. 10:34:20: Could not get the name for PID 2344. 10:34:20: Could not get the name for PID 2368. 10:34:20: Could not get the name for PID 2420. 10:34:20: Could not get the name for PID 2480. 10:34:20: Could not get the name for PID 2504. 10:34:20: Could not get the name for PID 2532. 10:34:20: Could not get the name for PID 2556. 10:34:20: Could not get the name for PID 2596. 10:34:20: Could not get the name for PID 3980. 10:34:20: Could not get the name for PID 4060. 10:34:20: Could not get the name for PID 3784. 10:34:20: Could not get the name for PID 3364. 10:34:20: Could not get the name for PID 1944. 10:34:20: Could not get the name for PID 3112. 10:34:20: Could not get the name for PID 2652. 10:34:20: Could not get the name for PID 1960. 10:34:20: Could not get the name for PID 2620. 10:34:20: Could not get the name for PID 1468. 10:34:20: Could not get the name for PID 3884. 10:34:20: Could not get the name for PID 3316. 10:34:20: Could not get the name for PID 3340. 10:34:20: Could not get the name for PID 3400. 10:34:20: Could not get the name for PID 3908. 10:34:20: Could not get the name for PID 832. 10:34:20: Could not get the name for PID 2204. 10:34:20: Could not get the name for PID 2512. 10:34:20: Could not get the name for PID 3136. 10:34:20: Could not get the name for PID 5356. 10:34:20: Could not get the name for PID 5896. 10:34:20: Could not get the name for PID 3768. 10:34:20: Could not get the name for PID 4892. 10:34:20: Could not get the name for PID 5984. 10:34:20: Could not get the name for PID 4912. 10:34:20: Could not get the name for PID 4968. 10:34:20: Could not get the name for PID 5488. 10:34:20: Could not get the name for PID 5052. 10:34:20: DeviceIoControl Error! Error Code = 0xc0000024 10:34:20: DeviceIoControl Error! Error Code = 0xc0000024 10:34:40: Warning - the number of SSDT entries from the kernel and the number on-disk are different (0 and 398). 10:34:40: DeviceIoControl Error! Error Code = 0x0 10:34:40: WARNING: The SSDT in our driver has been faked (0x00000250)! 10:34:40: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x00000134) 10:34:40: Could not read system registry! Please contact the author! And this is all I get for a scan: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/11/06 10:34 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP0 ================================================== SSDT ------------------- SYSENTER/INT2E Hooked [0x8208c9c0]! ==EOF====EOF== I closed all the programs I had running (Internet explorer, Verizon Wireless & MS Streets & Trips) before the scan. I also tried selecting Run as administrator...every time, the same thing. What do I do? And let me know if you still want me to go ahead and try the OTL Log....I haven't downloaded it yet. Thanks!!

andrewuk View Member Profile	Nov 6 2009, 11:06 AM Post #4
Trusted Helper Posts: 4,613 From: London, UK OS: XP	yes, carry on with the OTL scan. andrewuk

woofless View Member Profile	Nov 6 2009, 04:03 PM Post #6
Member Posts: 11 OS: windows vista	Ok, here is my OTL scan & I will post the OTL Extras file in the next post. Also I will mention I did uninstall Avast & disabled as much of McAfee as I could figure out how to...it is still showing up on this scan but as far as I can tell AVG is the only program running scans currently. OTL logfile created on: 11/6/2009 11:42:00 AM - Run 1 OTL by OldTimer - Version 3.1.4.0 Folder = C:\Users\Danielle\Desktop Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.16916) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 893.44 Mb Total Physical Memory \| 445.43 Mb Available Physical Memory \| 49.86% Memory free 1.99 Gb Paging File \| 1.11 Gb Available in Paging File \| 55.46% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files Drive C: \| 184.84 Gb Total Space \| 112.59 Gb Free Space \| 60.91% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DANIELLE-PC Current User Name: Danielle Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2009/11/06 11:39:46 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Users\Danielle\Desktop\OTL.exe PRC - [2009/11/03 09:22:43 \| 02,028,312 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe PRC - [2009/10/01 20:02:03 \| 00,595,736 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgnsx.exe PRC - [2009/10/01 20:02:03 \| 00,486,680 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe PRC - [2009/10/01 20:02:01 \| 00,693,016 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgcsrvx.exe PRC - [2009/10/01 20:01:37 \| 00,908,056 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe PRC - [2009/10/01 20:01:34 \| 00,297,752 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe PRC - [2009/09/16 13:48:40 \| 00,092,296 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe PRC - [2009/08/27 05:24:26 \| 00,301,568 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\ieuser.exe PRC - [2009/01/11 16:39:40 \| 00,039,408 \| ---- \| M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2008/10/29 00:20:29 \| 02,923,520 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008/06/19 19:18:04 \| 00,046,104 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe PRC - [2008/06/13 17:27:34 \| 02,752,512 \| ---- \| M] (Electronic Arts) -- C:\Program Files\Electronic Arts\EADM\Core.exe PRC - [2008/03/27 09:04:22 \| 00,025,256 \| ---- \| M] () -- C:\Program Files\Lexmark Z2400 Series\lxdqmsdmon.exe PRC - [2008/02/27 17:09:44 \| 00,594,600 \| ---- \| M] ( ) -- C:\Windows\System32\lxdqcoms.exe PRC - [2008/01/25 00:38:12 \| 02,458,128 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe PRC - [2008/01/09 15:50:22 \| 00,767,976 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe PRC - [2007/08/30 16:43:18 \| 00,103,664 \| ---- \| M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe PRC - [2007/08/03 22:33:14 \| 00,582,992 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe PRC - [2007/07/13 07:14:56 \| 00,265,040 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\McAfee\MSC\mcuimgr.exe PRC - [2007/06/19 07:55:24 \| 00,841,256 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe PRC - [2007/04/27 21:15:46 \| 00,114,688 \| ---- \| M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe PRC - [2007/04/24 22:55:58 \| 00,593,920 \| ---- \| M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe PRC - [2007/04/24 22:55:58 \| 00,593,920 \| ---- \| M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe PRC - [2007/04/02 17:21:54 \| 00,131,072 \| ---- \| M] (Sprint Spectrum, L.L.C) -- C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe PRC - [2007/03/29 11:39:20 \| 00,427,576 \| ---- \| M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe PRC - [2007/02/25 22:55:18 \| 00,125,048 \| ---- \| M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe PRC - [2007/02/13 11:09:12 \| 00,540,776 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe PRC - [2007/01/25 18:50:26 \| 00,063,096 \| ---- \| M] () -- c:\Toshiba\IVP\swupdate\swupdtmr.exe PRC - [2007/01/25 18:47:50 \| 00,136,816 \| ---- \| M] () -- C:\Toshiba\IVP\ISM\pinger.exe PRC - [2007/01/22 09:59:08 \| 00,417,792 \| ---- \| M] (TOSHIBA) -- C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe PRC - [2006/11/14 21:33:10 \| 00,040,960 \| ---- \| M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe PRC - [2006/11/02 03:46:02 \| 00,143,360 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\WUDFHost.exe PRC - [2006/10/26 21:24:54 \| 00,098,632 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE PRC - [2006/10/05 13:10:12 \| 00,009,216 \| ---- \| M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe PRC - [2006/09/28 19:09:14 \| 00,700,416 \| ---- \| M] () -- C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe PRC - [2006/09/11 16:21:16 \| 00,180,224 \| ---- \| M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\Apoint.exe PRC - [2006/09/08 16:06:08 \| 00,040,960 \| ---- \| M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApntEx.exe PRC - [2006/09/08 15:54:30 \| 00,042,544 \| ---- \| M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApMsgFwd.exe PRC - [2006/08/23 17:39:48 \| 00,049,152 \| ---- \| M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe PRC - [2006/05/25 19:30:16 \| 00,114,688 \| ---- \| M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe PRC - [2006/04/20 00:35:00 \| 00,237,568 \| ---- \| M] (Simple Star, Inc.) -- C:\Program Files\Walgreens\Walgreens PhotoShow 4\data\Xtras\mssysmgr.exe PRC - [1999/12/12 11:01:00 \| 00,044,032 \| ---- \| M] (Creative Technology Ltd) -- C:\Windows\System32\CTSVCCDA.EXE ========== Modules (SafeList) ========== MOD - [2009/11/06 11:39:46 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Users\Danielle\Desktop\OTL.exe MOD - [2009/10/06 10:42:48 \| 00,014,544 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\sahook.dll MOD - [2009/10/01 20:04:59 \| 00,011,952 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll MOD - [2007/05/16 17:29:03 \| 01,648,128 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.20533_none_4634c4a0218d65c1\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009/10/01 20:01:37 \| 00,908,056 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc) SRV - [2009/10/01 20:01:34 \| 00,297,752 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd) SRV - [2009/09/16 13:48:40 \| 00,092,296 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service) SRV - [2009/05/03 00:50:09 \| 00,182,768 \| ---- \| M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2008/07/27 12:00:25 \| 00,069,632 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008/06/19 19:18:04 \| 00,046,104 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0) SRV - [2008/06/19 19:17:50 \| 00,132,096 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing) SRV - [2008/06/19 19:17:49 \| 00,881,664 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc) SRV - [2008/02/27 17:09:44 \| 00,594,600 \| ---- \| M] ( ) -- C:\Windows\System32\lxdqcoms.exe -- (lxdq_device) SRV - [2008/02/27 17:09:33 \| 00,098,984 \| ---- \| M] () -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxdqserv.exe -- (lxdqCATSCustConnectService) SRV - [2008/01/25 00:38:12 \| 02,458,128 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc) SRV - [2008/01/09 15:50:22 \| 00,767,976 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc) SRV - [2007/09/02 07:32:43 \| 00,265,912 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007/06/19 07:55:24 \| 00,841,256 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService) SRV - [2007/05/21 12:31:44 \| 01,862,144 \| ---- \| M] (Google) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager) SRV - [2007/04/27 21:15:46 \| 00,114,688 \| ---- \| M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv) SRV - [2007/04/24 22:55:58 \| 00,593,920 \| ---- \| M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe -- (Ati External Event Utility) SRV - [2007/04/02 17:21:54 \| 00,131,072 \| ---- \| M] (Sprint Spectrum, L.L.C) -- C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe -- (SPCSUtilityService) SRV - [2007/03/29 11:39:20 \| 00,427,576 \| ---- \| M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv) SRV - [2007/02/25 22:55:18 \| 00,125,048 \| ---- \| M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2007/02/13 11:09:12 \| 00,540,776 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe -- (McAfee HackerWatch Service) SRV - [2007/01/25 18:50:26 \| 00,063,096 \| ---- \| M] () -- c:\Toshiba\IVP\swupdate\swupdtmr.exe -- (Swupdtmr) SRV - [2007/01/25 18:47:50 \| 00,136,816 \| ---- \| M] () -- C:\Toshiba\IVP\ISM\pinger.exe -- (pinger) SRV - [2006/11/14 21:33:10 \| 00,040,960 \| ---- \| M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs) SRV - [2006/11/02 06:36:04 \| 00,895,488 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2006/11/02 06:35:29 \| 00,131,072 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched) SRV - [2006/11/02 06:35:29 \| 00,013,312 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart) SRV - [2006/11/02 06:35:28 \| 00,291,840 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehrecvr.exe -- (ehRecvr) SRV - [2006/10/26 20:49:34 \| 00,441,136 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006/10/26 15:03:08 \| 00,145,184 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2006/10/05 13:10:12 \| 00,009,216 \| ---- \| M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2006/08/23 17:39:48 \| 00,049,152 \| ---- \| M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) SRV - [2006/05/25 19:30:16 \| 00,114,688 \| ---- \| M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv) SRV - [2005/04/03 23:41:10 \| 00,069,632 \| ---- \| M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [1999/12/12 11:01:00 \| 00,044,032 \| ---- \| M] (Creative Technology Ltd) -- C:\Windows\System32\CTSVCCDA.EXE -- (Creative Service for CDROM Access) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2009/11/05 14:58:21 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/08 02:02:16 \| 00,000,000 \| ---D \| M] O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [lxdqamon] C:\Program Files\Lexmark Z2400 Series\lxdqamon.exe () O4 - HKLM..\Run: [lxdqmon.exe] C:\Program Files\Lexmark Z2400 Series\lxdqmon.exe () O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKCU..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe () O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) O4 - HKCU..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe File not found O4 - HKCU..\Run: [Walgreens PhotoShow Media Manager] C:\Program Files\Walgreens\Walgreens PhotoShow 4\data\Xtras\mssysmgr.exe (Simple Star, Inc.) O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.) O4 - Startup: C:\Users\Danielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FREE OFFER from Audible.com.lnk = C:\Users\Danielle\AppData\Local\Temp\HelpInstaller_StartUp.exe (Audible Inc.) O4 - Startup: C:\Users\Danielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O4 - Startup: C:\Users\Danielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VZAccess Manager.lnk = C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe (Smith Micro Software, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 15:43:36 \| 00,000,024 \| ---- \| M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found O35 - comfile [open] -- "%1" % File not found O35 - exefile [open] -- "%1" %* File not found NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias [2006/11/02 05:18:47 \| 00,000,000 \| ---D \| M] NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found ========== Files/Folders - Created Within 14 Days ========== [2009/11/06 11:39:39 \| 00,528,896 \| ---- \| C] (OldTimer Tools) -- C:\Users\Danielle\Desktop\OTL.exe [2009/11/06 10:27:40 \| 00,472,064 \| ---- \| C] ( ) -- C:\Users\Danielle\Desktop\RootRepeal.exe [2009/03/17 19:18:39 \| 00,438,272 \| ---- \| C] ( ) -- C:\Windows\System32\LXDQhcp.dll [2009/03/17 19:18:38 \| 00,364,544 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqinpa.dll [2009/03/17 19:18:38 \| 00,339,968 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqiesc.dll [2009/03/17 19:18:36 \| 01,101,824 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqserv.dll [2009/03/17 19:18:36 \| 00,843,776 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqusb1.dll [2009/03/17 19:18:35 \| 00,647,168 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqpmui.dll [2009/03/17 19:18:35 \| 00,569,344 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqlmpm.dll [2009/03/17 19:18:35 \| 00,053,248 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqprox.dll [2009/03/17 19:18:33 \| 00,663,552 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqhbn3.dll [2009/03/17 19:18:30 \| 00,851,968 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqcomc.dll [2009/03/17 19:18:30 \| 00,376,832 \| ---- \| C] ( ) -- C:\Windows\System32\lxdqcomm.dll [1 C:\Windows\.tmp files -> C:\Windows\.tmp -> ] [1 C:\Users\Danielle\Desktop\.tmp files -> C:\Users\Danielle\Desktop\.tmp -> ] ========== Files - Modified Within 14 Days ========== [2009/11/06 11:42:04 \| 02,883,584 \| -HS- \| M] () -- C:\Users\Danielle\NTUSER.DAT [2009/11/06 11:39:46 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Users\Danielle\Desktop\OTL.exe [2009/11/06 11:28:04 \| 00,003,456 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009/11/06 11:28:04 \| 00,003,456 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009/11/06 10:35:54 \| 00,002,068 \| ---- \| M] () -- C:\Users\Danielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VZAccess Manager.lnk [2009/11/06 10:29:57 \| 00,000,000 \| ---- \| M] () -- C:\Users\Danielle\Desktop\settings.dat [2009/11/06 10:28:01 \| 00,472,064 \| ---- \| M] ( ) -- C:\Users\Danielle\Desktop\RootRepeal.exe [2009/11/06 09:53:40 \| 44,744,893 \| ---- \| M] () -- C:\Windows\System32\drivers\Avg\incavi.avm [2009/11/06 08:50:43 \| 00,002,525 \| ---- \| M] () -- C:\Users\Danielle\Desktop\Microsoft Streets & Trips 2007.lnk [2009/11/05 17:46:54 \| 00,086,225 \| ---- \| M] () -- C:\Windows\System32\drivers\Avg\microavi.avg [2009/11/05 15:34:27 \| 00,729,436 \| ---- \| M] () -- C:\Windows\System32\PerfStringBackup.INI [2009/11/05 15:34:27 \| 00,626,976 \| ---- \| M] () -- C:\Windows\System32\perfh009.dat [2009/11/05 15:34:27 \| 00,107,714 \| ---- \| M] () -- C:\Windows\System32\perfc009.dat [2009/11/05 15:28:01 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\tasks\SA.DAT [2009/11/05 15:27:51 \| 00,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2009/11/05 15:27:10 \| 93,747,6096 \| -HS- \| M] () -- C:\hiberfil.sys [2009/11/05 15:25:31 \| 00,019,596 \| ---- \| M] () -- C:\Windows\System32\Config.MPF [2009/11/05 15:23:40 \| 06,291,456 \| -H-- \| M] () -- C:\Users\Danielle\AppData\Local\IconCache.db [1 C:\Windows\.tmp files -> C:\Windows\.tmp -> ] [1 C:\Users\Danielle\Desktop\.tmp files -> C:\Users\Danielle\Desktop\.tmp -> ] ========== Files Created - No Company Name ========== [2009/11/06 10:29:57 \| 00,000,000 \| ---- \| C] () -- C:\Users\Danielle\Desktop\settings.dat [2009/05/26 06:50:23 \| 00,026,340 \| ---- \| C] () -- C:\Users\Danielle\AppData\Roaming\UserTile.png [2009/03/17 19:25:39 \| 00,348,160 \| ---- \| C] () -- C:\Windows\System32\lxdqcoin.dll [2009/03/17 19:19:22 \| 00,000,044 \| ---- \| C] () -- C:\Windows\System32\lxdqrwrd.ini [2009/03/17 19:18:39 \| 00,348,160 \| ---- \| C] () -- C:\Windows\System32\LXDQinst.dll [2009/03/17 19:18:32 \| 00,208,896 \| ---- \| C] () -- C:\Windows\System32\lxdqgrd.dll [2009/02/11 22:11:29 \| 06,291,456 \| -H-- \| C] () -- C:\Users\Danielle\AppData\Local\IconCache.db [2009/01/28 17:44:23 \| 00,000,250 \| ---- \| C] () -- C:\Windows\gmer.ini [2009/01/28 17:44:12 \| 00,884,736 \| ---- \| C] () -- C:\Windows\gmer.dll [2008/04/08 22:27:52 \| 00,000,117 \| ---- \| C] () -- C:\Windows\civ.ini [2008/02/04 07:48:09 \| 00,000,067 \| ---- \| C] () -- C:\Users\Danielle\AppData\Roaming\photoshow_express_setup.txt [2007/11/28 11:51:49 \| 00,040,960 \| ---- \| C] () -- C:\Windows\System32\lxdqvs.dll [2007/10/12 20:38:34 \| 00,000,067 \| ---- \| C] () -- C:\Windows\swupdate.INI [2007/08/30 14:27:49 \| 00,000,432 \| ---- \| C] () -- C:\Users\Danielle\AppData\Roaming\wklnhst.dat [2007/08/30 01:26:04 \| 00,011,264 \| ---- \| C] () -- C:\Users\Danielle\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007/08/29 23:33:12 \| 00,000,680 \| ---- \| C] () -- C:\Users\Danielle\AppData\Local\d3d9caps.dat [2007/08/29 21:32:04 \| 00,082,720 \| ---- \| C] () -- C:\Users\Danielle\AppData\Local\GDIPFONTCACHEV1.DAT [2007/05/16 19:46:23 \| 00,524,288 \| -HS- \| C] () -- C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000002.regtrans-ms [2007/05/16 19:46:23 \| 00,524,288 \| -HS- \| C] () -- C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms [2007/05/16 19:46:23 \| 00,065,536 \| -HS- \| C] () -- C:\ProgramData\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TM.blf [2007/05/16 19:46:22 \| 00,524,288 \| -HS- \| C] () -- C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000002.regtrans-ms [2007/05/16 19:46:22 \| 00,524,288 \| -HS- \| C] () -- C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms [2007/05/16 19:46:22 \| 00,065,536 \| -HS- \| C] () -- C:\ProgramData\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TM.blf [2007/05/16 19:46:21 \| 00,262,144 \| ---- \| C] () -- C:\ProgramData\ntuser.dat [2007/05/16 19:46:21 \| 00,005,120 \| -H-- \| C] () -- C:\ProgramData\ntuser.dat.LOG1 [2007/05/16 19:46:21 \| 00,000,000 \| -H-- \| C] () -- C:\ProgramData\ntuser.dat.LOG2 [2007/05/16 19:40:56 \| 00,204,800 \| ---- \| C] () -- C:\Windows\System32\IVIresizeW7.dll [2007/05/16 19:40:55 \| 00,200,704 \| ---- \| C] () -- C:\Windows\System32\IVIresizeA6.dll [2007/05/16 19:40:55 \| 00,192,512 \| ---- \| C] () -- C:\Windows\System32\IVIresizeP6.dll [2007/05/16 19:40:55 \| 00,192,512 \| ---- \| C] () -- C:\Windows\System32\IVIresizeM6.dll [2007/05/16 19:40:55 \| 00,188,416 \| ---- \| C] () -- C:\Windows\System32\IVIresizePX.dll [2007/05/16 19:40:55 \| 00,020,480 \| ---- \| C] () -- C:\Windows\System32\IVIresize.dll [2007/05/16 18:46:42 \| 00,000,000 \| ---- \| C] () -- C:\Windows\NDSTray.INI [2007/05/16 18:30:13 \| 00,036,864 \| ---- \| C] () -- C:\Windows\System32\HWS_Ctrl.dll [2007/05/16 18:15:16 \| 00,128,113 \| ---- \| C] () -- C:\Windows\System32\csellang.ini [2007/05/16 18:15:16 \| 00,045,056 \| ---- \| C] () -- C:\Windows\System32\csellang.dll [2007/05/16 18:15:16 \| 00,010,150 \| ---- \| C] () -- C:\Windows\System32\tosmreg.ini [2007/05/16 18:15:16 \| 00,007,671 \| ---- \| C] () -- C:\Windows\System32\cseltbl.ini [2007/05/16 18:13:14 \| 00,000,291 \| ---- \| C] () -- C:\Windows\RtDefLvl.ini [2007/04/24 22:57:36 \| 00,159,744 \| ---- \| C] () -- C:\Windows\System32\atitmmxx.dll [2006/12/05 14:05:06 \| 00,114,688 \| ---- \| C] () -- C:\Windows\System32\TosBtAcc.dll [2006/11/02 06:50:50 \| 00,000,174 \| -HS- \| C] () -- C:\Program Files\desktop.ini [2006/11/02 06:37:35 \| 00,030,808 \| ---- \| C] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont [2006/11/02 06:37:35 \| 00,029,779 \| ---- \| C] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2006/11/02 06:37:35 \| 00,026,489 \| ---- \| C] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2006/11/02 06:37:35 \| 00,026,040 \| ---- \| C] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2006/11/02 06:35:32 \| 00,005,632 \| ---- \| C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 04:23:31 \| 00,000,219 \| ---- \| C] () -- C:\Windows\system.ini [2006/11/02 04:23:31 \| 00,000,192 \| ---- \| C] () -- C:\Windows\win.ini [2006/11/02 01:40:29 \| 00,013,750 \| ---- \| C] () -- C:\Windows\System32\pacerprf.ini [2006/05/10 09:58:56 \| 00,147,456 \| ---- \| C] () -- C:\Windows\pcmgrfx.dll [2006/05/09 10:36:24 \| 00,151,552 \| ---- \| C] () -- C:\Windows\pmwssrv.dll [2006/05/09 10:36:24 \| 00,151,552 \| ---- \| C] () -- C:\Windows\pcmsrv32.dll [2005/11/23 15:55:42 \| 00,024,576 \| ---- \| C] () -- C:\Windows\System32\SPCtl.dll [2005/07/22 22:30:20 \| 00,065,536 \| ---- \| C] () -- C:\Windows\System32\TosCommAPI.dll ========== LOP Check ========== [2007/08/29 21:33:17 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\ATI [2008/03/24 17:39:01 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\MusicNet [2009/05/26 06:50:21 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\PeerNetworking [2007/08/29 22:13:03 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\PlayFirst [2007/08/29 23:08:48 \| 00,000,000 \| RH-D \| M] -- C:\Users\Danielle\AppData\Roaming\SecuROM [2008/02/04 07:48:04 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Simple Star [2009/04/11 20:23:16 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Smith Micro [2009/05/25 23:43:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\SPORE Creature Creator [2007/11/01 20:39:19 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Template [2008/04/21 17:21:57 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\TOSHIBA [2008/08/26 10:52:19 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Ulead Systems [2009/08/16 07:09:49 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Uniblue [2009/01/02 21:29:08 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\W Photo Studio [2009/01/02 21:25:58 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\W Photo Studio Viewer [2007/12/27 13:30:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Wal-Mart [2009/08/24 21:11:21 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Walgreens [2007/08/29 21:37:33 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\WildTangent [2007/08/29 22:16:12 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\WinBatch [2009/10/15 03:00:11 \| 00,000,342 \| ---- \| M] () -- C:\Windows\Tasks\McDefragTask.job [2009/09/01 00:00:25 \| 00,000,334 \| ---- \| M] () -- C:\Windows\Tasks\McQcTask.job [2009/11/05 15:28:01 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\Tasks\SA.DAT [2009/11/05 15:25:26 \| 00,032,590 \| ---- \| M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < %SYSTEMDRIVE%\eventlog.dll /s /md5 > < %SYSTEMDRIVE%\scecli.dll /s /md5 > [2008/01/19 01:36:19 \| 00,177,152 \| ---- \| M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2006/11/02 03:46:12 \| 00,176,640 \| ---- \| M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll [2006/11/02 03:46:12 \| 00,176,640 \| ---- \| M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll < %SYSTEMDRIVE%\netlogon.dll /s /md5 > [2008/01/19 01:35:36 \| 00,592,384 \| ---- \| M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll [2006/11/02 03:46:11 \| 00,559,616 \| ---- \| M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll [2006/11/02 03:46:11 \| 00,559,616 \| ---- \| M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll < %SYSTEMDRIVE%\cngaudit.dll /s /md5 > [2006/11/02 03:46:03 \| 00,011,776 \| ---- \| M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006/11/02 03:46:03 \| 00,011,776 \| ---- \| M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < %SYSTEMDRIVE%\sceclt.dll /s /md5 > < %SYSTEMDRIVE%\ntelogon.dll /s /md5 > < %SYSTEMDRIVE%\logevent.dll /s /md5 > < %SYSTEMDRIVE%\iaStor.sys /s /md5 > < %SYSTEMDRIVE%\nvstor.sys /s /md5 > [2008/01/19 01:42:09 \| 00,045,112 \| ---- \| M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys [2006/11/02 03:50:13 \| 00,040,040 \| ---- \| M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys [2006/11/02 03:50:13 \| 00,040,040 \| ---- \| M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys < %SYSTEMDRIVE%\atapi.sys /s /md5 > [2008/01/19 01:41:30 \| 00,021,560 \| ---- \| M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2008/02/15 03:06:52 \| 00,021,560 \| ---- \| M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\drivers\atapi.sys [2008/02/15 03:06:52 \| 00,021,560 \| ---- \| M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys [2006/11/02 03:49:36 \| 00,019,048 \| ---- \| M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008/02/15 03:06:52 \| 00,021,560 \| ---- \| M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys [2008/02/15 03:06:50 \| 00,021,560 \| ---- \| M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys < %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 > < %SYSTEMDRIVE%\viasraid.sys /s /md5 > < %SYSTEMDRIVE%\AGP440.sys /s /md5 > [2008/01/19 01:42:25 \| 00,056,376 \| ---- \| M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2006/11/02 03:49:52 \| 00,053,864 \| ---- \| M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys [2006/11/02 03:49:52 \| 00,053,864 \| ---- \| M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < %SYSTEMDRIVE%\vaxscsi.sys /s /md5 > ========== Alternate Data Streams ========== @Alternate Data Stream - 64 bytes -> C:\Users\Danielle\Documents\04 Falling Down.mp3:TOC.WMV < End of report >

andrewuk View Member Profile	Nov 6 2009, 04:10 PM Post #8
Trusted Helper Posts: 4,613 From: London, UK OS: XP	We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/combofix/how-to-use-combofix * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review. also: We will run OTL , but go for a shortened log. Close all windows and open it by double clicking on the icon we are targetting a selective output, hence: on the left hand side, in the box titled "Processes" select none on the left hand side, in the box titled "Drivers" select none on the left hand side, in the box titled "Extra Registry" select none on the right hand side, in the box titled "Files created within" select none on the right hand side, in the box titled "Files modified within" select none tick both the boxes marked Purity check and Lop check Click Run Scan and let the program run uninterrupted It will produce one log for you called OTL.txt. Please post that log here in reply. You may need to use two posts to get it all on the forum andrewuk

woofless View Member Profile	Nov 7 2009, 02:50 PM Post #9
Member Posts: 11 OS: windows vista	Okay, here is my ComboFix log first. I did everything I could think of to try & disable AVG fully, but it wouldn't let me...the only info I found online told me to "exit" AVG from the toolbar & that would disable it. I did that, and even though Windows told me it was disabled, ComboFix still said it was active. Beyond uninstalling it, I wasn't sure what to do, hopefully it didn't cause a problem: ComboFix 09-11-06.03 - Danielle 11/07/2009 12:50.1.2 - NTFSx86 Microsoft� Windows Vista� Home Premium 6.0.6000.0.1252.1.1033.18.893.151 [GMT -6:00] Running from: c:\users\Danielle\Desktop\ComboFix.exe AV: AVG Anti-Virus Free On-access scanning disabled (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: McAfee Personal Firewall enabled {94894B63-8C7F-4050-BDA4-813CA00DA3E8} SP: AVG Anti-Virus Free enabled (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} SP: Windows Defender disabled (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1893239248-1700074592-3436296051-500 c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500 c:\$recycle.bin\S-1-5-21-526720123-3731369257-2385391353-500 c:\$recycle.bin\S-1-5-21-943590177-4096490480-332556678-500 c:\programdata\ntuser.dat{0a1e0be4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms c:\programdata\ntuser.dat{0a1e0bf4-0416-11dc-9bb7-0016d4f84854}.TMContainer00000000000000000001.regtrans-ms c:\windows\COUPON~1.OCX c:\windows\CouponPrinter.ocx . ((((((((((((((((((((((((( Files Created from 2009-10-07 to 2009-11-07 ))))))))))))))))))))))))))))))) . 2009-11-07 19:06 . 2009-11-07 19:06 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-11-07 16:30 . 2009-11-07 16:30 -------- d-----w- c:\programdata\Lexmark Z2400 Series 2009-11-07 16:28 . 2009-11-07 16:28 -------- d-----w- c:\users\Danielle\AppData\Roaming\Lexmark Productivity Studio 2009-11-05 23:11 . 2009-11-03 02:42 195456 ------w- c:\windows\system32\MpSigStub.exe 2009-11-03 15:38 . 2009-10-12 13:09 3510552 ----a-w- c:\programdata\avg8\update\backup\avgui.exe 2009-10-30 02:16 . 2009-09-10 15:29 311296 ----a-w- c:\windows\system32\unregmp2.exe 2009-10-30 02:16 . 2009-09-10 17:39 7680 ----a-w- c:\windows\system32\spwmp.dll 2009-10-30 02:16 . 2009-09-10 17:40 4096 ----a-w- c:\windows\system32\dxmasf.dll 2009-10-30 02:15 . 2009-09-10 15:29 8147968 ----a-w- c:\windows\system32\wmploc.DLL 2009-10-15 23:20 . 2009-10-15 23:20 -------- d-----w- c:\users\Danielle\AppData\Roaming\Malwarebytes 2009-10-15 23:19 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-15 23:19 . 2009-10-15 23:19 -------- d-----w- c:\programdata\Malwarebytes 2009-10-15 23:19 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-15 23:19 . 2009-10-15 23:20 4096 d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-14 19:14 . 2009-10-14 19:14 -------- d-----w- c:\program files\Trend Micro 2009-10-14 04:11 . 2009-06-15 15:23 494592 ----a-w- c:\windows\system32\kerberos.dll 2009-10-14 04:10 . 2009-06-15 15:28 272384 ----a-w- c:\windows\system32\schannel.dll 2009-10-13 21:34 . 2009-08-31 15:16 428032 ----a-w- c:\windows\system32\EncDec.dll 2009-10-13 21:34 . 2009-08-31 15:21 292352 ----a-w- c:\windows\system32\psisdecd.dll 2009-10-13 21:34 . 2009-08-31 15:17 1244672 ----a-w- c:\windows\system32\mcmde.dll 2009-10-13 21:33 . 2009-09-10 17:38 216576 ----a-w- c:\windows\system32\msv1_0.dll 2009-10-13 21:33 . 2009-06-15 15:29 175104 ----a-w- c:\windows\system32\wdigest.dll 2009-10-13 21:33 . 2009-06-15 15:23 1233920 ----a-w- c:\windows\system32\lsasrv.dll 2009-10-13 21:33 . 2009-06-15 18:12 408136 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-10-13 21:33 . 2009-06-15 15:28 72704 ----a-w- c:\windows\system32\secur32.dll 2009-10-13 21:33 . 2009-06-15 13:10 7680 ----a-w- c:\windows\system32\lsass.exe 2009-10-13 21:28 . 2009-08-05 14:28 3467864 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-10-13 21:28 . 2009-08-05 14:28 3502152 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-10-13 21:12 . 2009-09-04 12:38 60928 ----a-w- c:\windows\system32\msasn1.dll 2009-10-13 21:12 . 2009-09-14 09:50 130048 ----a-w- c:\windows\system32\drivers\srv2.sys 2009-10-13 21:06 . 2009-04-02 11:50 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL 2009-10-12 13:12 . 2009-10-21 14:12 2064152 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll 2009-10-12 13:12 . 2009-10-21 14:12 2025752 ----a-w- c:\programdata\avg8\update\backup\avgtray.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-07 16:47 . 2009-03-18 01:41 4096 d-----w- c:\programdata\Lx_cats 2009-11-05 21:01 . 2007-05-17 01:51 4096 d-----w- c:\program files\Common Files\McAfee 2009-11-05 21:01 . 2007-05-17 01:51 4096 d-----w- c:\program files\McAfee 2009-11-05 21:01 . 2007-05-17 01:51 4096 d-----w- c:\programdata\McAfee 2009-11-05 20:58 . 2008-03-24 07:52 4096 d-----w- c:\program files\Creative 2009-10-14 03:52 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail 2009-10-02 02:08 . 2008-12-19 00:04 4096 d-----w- c:\programdata\Yahoo! Companion 2009-10-02 02:08 . 2009-10-02 02:02 -------- d-----w- c:\programdata\AVG Security Toolbar 2009-10-02 02:04 . 2009-10-02 02:04 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-10-02 02:04 . 2009-10-02 02:04 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-10-02 02:04 . 2009-10-02 02:04 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-10-02 02:04 . 2009-10-02 02:04 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-10-02 02:01 . 2009-10-02 02:01 -------- d-----w- c:\program files\AVG 2009-10-02 02:01 . 2009-10-02 02:01 4096 d-----w- c:\programdata\avg8 2009-10-02 01:43 . 2009-10-02 01:43 -------- d-----w- c:\users\Danielle\AppData\Roaming\AVG8 2009-09-10 11:44 . 2009-09-10 11:44 471664 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbBDA9.tmp.exe 2009-08-29 03:41 . 2009-09-02 19:20 1686528 ----a-w- c:\windows\system32\gameux.dll 2009-08-29 03:40 . 2009-09-02 19:20 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-08-28 23:31 . 2009-09-02 19:20 4247552 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-27 14:02 . 2009-10-13 21:35 832512 ----a-w- c:\windows\system32\wininet.dll 2009-08-27 13:57 . 2009-10-13 21:35 56320 ----a-w- c:\windows\system32\iesetup.dll 2009-08-27 13:57 . 2009-10-13 21:35 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-08-27 13:56 . 2009-10-13 21:35 72704 ----a-w- c:\windows\system32\admparse.dll 2009-08-27 11:24 . 2009-10-13 21:35 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-08-27 09:51 . 2009-10-13 21:35 48128 ----a-w- c:\windows\system32\mshtmler.dll 2009-08-14 17:16 . 2009-09-09 15:27 213592 ----a-w- c:\windows\system32\drivers\netio.sys 2009-08-14 16:42 . 2009-09-09 15:27 167424 ----a-w- c:\windows\system32\tcpipcfg.dll 2009-08-14 16:40 . 2009-09-09 15:27 103936 ----a-w- c:\windows\system32\netiohlp.dll 2009-08-14 16:40 . 2009-09-09 15:27 15360 ----a-w- c:\windows\system32\netevent.dll 2009-08-14 14:25 . 2009-09-09 15:27 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-08-14 14:25 . 2009-09-09 15:27 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-08-14 14:25 . 2009-09-09 15:27 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-08-14 14:25 . 2009-09-09 15:27 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-08-14 14:25 . 2009-09-09 15:27 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-08-14 14:25 . 2009-09-09 15:27 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-08-14 14:25 . 2009-09-09 15:27 10240 ----a-w- c:\windows\system32\finger.exe 2009-08-14 14:24 . 2009-09-09 15:27 813568 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-08-14 14:23 . 2009-09-09 15:27 22016 ----a-w- c:\windows\system32\netiougc.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-09-02 16:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-01-22 417792] "Walgreens PhotoShow Media Manager"="c:\progra~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe" [2006-04-20 237568] "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-29 700416] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-06-13 2752512] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-11 39408] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-11-24 2356088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-11 180224] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "lxdqmon.exe"="c:\program files\Lexmark Z2400 Series\lxdqmon.exe" [2008-03-27 656040] "lxdqamon"="c:\program files\Lexmark Z2400 Series\lxdqamon.exe" [2008-03-27 16040] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-03 2028312] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-19 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] SetupExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [10/1/2009 8:04 PM 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [10/1/2009 8:04 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [10/1/2009 8:01 PM 908056] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [10/1/2009 8:01 PM 297752] R2 lxdq_device;lxdq_device;c:\windows\system32\lxdqcoms.exe -service --> c:\windows\system32\lxdqcoms.exe -service [?] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/24/2009 8:51 AM 92296] R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\System32\drivers\nwusbser2.sys [4/19/2007 10:09 AM 99200] S2 lxdqCATSCustConnectService;lxdqCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdqserv.exe [2/27/2008 5:09 PM 98984] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [10/15/2009 5:19 PM 38224] --- Other Services/Drivers In Memory --- NewlyCreated - MBR NewlyCreated - PROCEXP113 Deregistered - mbr Deregistered - PROCEXP113 . Contents of the 'Scheduled Tasks' folder 2009-10-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-08 18:32] 2009-09-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-08 18:32] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.toshibadirect.com/dpdstart uDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 TCP: {85DA0C2A-FC2F-44A9-9189-2A4C839EBA6F} = 75.116.63.154 75.116.127.154 . . ------- File Associations ------- . regedit=regedit.exe "%1" . - - - - ORPHANS REMOVED - - - - HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\uniblue\registrybooster\StartRegistryBooster.exe AddRemove-Mah Jong Quest - c:\program files\iWin.com ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-07 13:06 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i????????g??????~?@?~?x?~???~??? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msiserver] "ImagePath"="%systemroot%\system32\msiexec /V" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\S-1-5-21-943590177-4096490480-332556678-1000\Software\SecuROM\License information*] "datasecu"=hex:08,a8,94,60,d2,a1,cd,74,7a,6b,6f,21,39,f3,18,9f,2a,ec,ad,b0,f0, 3c,21,6a,72,56,6d,f2,52,50,7b,01,4a,84,a9,dd,68,3c,ca,b5,cd,80,b0,9c,e8,90,\ "rkeysecu"=hex:3b,cc,a7,9b,a0,a0,66,f4,20,c8,3a,d6,9b,34,a2,dc [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2009-11-07 13:17 ComboFix-quarantined-files.txt 2009-11-07 19:17 Pre-Run: 121,633,722,368 bytes free Post-Run: 122,513,653,760 bytes free - - End Of File - - 51AED71F7346702D53F0BB88A99FB6BB

woofless View Member Profile	Nov 7 2009, 02:51 PM Post #10
Member Posts: 11 OS: windows vista	And here is my new OTL log: OTL logfile created on: 11/7/2009 2:42:52 PM - Run 2 OTL by OldTimer - Version 3.1.4.0 Folder = C:\Users\Danielle\Desktop Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.16916) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 893.44 Mb Total Physical Memory \| 330.96 Mb Available Physical Memory \| 37.04% Memory free 1.99 Gb Paging File \| 1.13 Gb Available in Paging File \| 56.66% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files Drive C: \| 184.84 Gb Total Space \| 113.17 Gb Free Space \| 61.22% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DANIELLE-PC Current User Name: Danielle Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Modules (SafeList) ========== MOD - [2009/11/06 11:39:46 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Users\Danielle\Desktop\OTL.exe MOD - [2007/05/16 17:29:03 \| 01,648,128 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.20533_none_4634c4a0218d65c1\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009/10/01 20:01:37 \| 00,908,056 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc) SRV - [2009/10/01 20:01:34 \| 00,297,752 \| ---- \| M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd) SRV - [2009/09/16 13:48:40 \| 00,092,296 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service) SRV - [2009/05/03 00:50:09 \| 00,182,768 \| ---- \| M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2008/07/27 12:00:25 \| 00,069,632 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008/06/19 19:18:04 \| 00,046,104 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0) SRV - [2008/06/19 19:17:50 \| 00,132,096 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing) SRV - [2008/06/19 19:17:49 \| 00,881,664 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc) SRV - [2008/02/27 17:09:44 \| 00,594,600 \| ---- \| M] ( ) -- C:\Windows\System32\lxdqcoms.exe -- (lxdq_device) SRV - [2008/02/27 17:09:33 \| 00,098,984 \| ---- \| M] () -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxdqserv.exe -- (lxdqCATSCustConnectService) SRV - [2008/01/25 00:38:12 \| 02,458,128 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc) SRV - [2008/01/09 15:50:22 \| 00,767,976 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc) SRV - [2007/09/02 07:32:43 \| 00,265,912 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007/06/19 07:55:24 \| 00,841,256 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService) SRV - [2007/05/21 12:31:44 \| 01,862,144 \| ---- \| M] (Google) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager) SRV - [2007/04/27 21:15:46 \| 00,114,688 \| ---- \| M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv) SRV - [2007/04/24 22:55:58 \| 00,593,920 \| ---- \| M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe -- (Ati External Event Utility) SRV - [2007/04/02 17:21:54 \| 00,131,072 \| ---- \| M] (Sprint Spectrum, L.L.C) -- C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe -- (SPCSUtilityService) SRV - [2007/03/29 11:39:20 \| 00,427,576 \| ---- \| M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv) SRV - [2007/02/25 22:55:18 \| 00,125,048 \| ---- \| M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2007/02/13 11:09:12 \| 00,540,776 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe -- (McAfee HackerWatch Service) SRV - [2007/01/25 18:50:26 \| 00,063,096 \| ---- \| M] () -- c:\Toshiba\IVP\swupdate\swupdtmr.exe -- (Swupdtmr) SRV - [2007/01/25 18:47:50 \| 00,136,816 \| ---- \| M] () -- C:\Toshiba\IVP\ISM\pinger.exe -- (pinger) SRV - [2006/11/14 21:33:10 \| 00,040,960 \| ---- \| M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs) SRV - [2006/11/02 06:36:04 \| 00,895,488 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2006/11/02 06:35:29 \| 00,131,072 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched) SRV - [2006/11/02 06:35:29 \| 00,013,312 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart) SRV - [2006/11/02 06:35:28 \| 00,291,840 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehrecvr.exe -- (ehRecvr) SRV - [2006/10/26 20:49:34 \| 00,441,136 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006/10/26 15:03:08 \| 00,145,184 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2006/10/05 13:10:12 \| 00,009,216 \| ---- \| M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2006/08/23 17:39:48 \| 00,049,152 \| ---- \| M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) SRV - [2006/05/25 19:30:16 \| 00,114,688 \| ---- \| M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv) SRV - [2005/04/03 23:41:10 \| 00,069,632 \| ---- \| M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [1999/12/12 11:01:00 \| 00,044,032 \| ---- \| M] (Creative Technology Ltd) -- C:\Windows\System32\CTSVCCDA.EXE -- (Creative Service for CDROM Access) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2009/11/05 14:58:21 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/08 02:02:16 \| 00,000,000 \| ---D \| M] O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [lxdqamon] C:\Program Files\Lexmark Z2400 Series\lxdqamon.exe () O4 - HKLM..\Run: [lxdqmon.exe] C:\Program Files\Lexmark Z2400 Series\lxdqmon.exe () O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKCU..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe () O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) O4 - HKCU..\Run: [Walgreens PhotoShow Media Manager] C:\Program Files\Walgreens\Walgreens PhotoShow 4\data\Xtras\mssysmgr.exe (Simple Star, Inc.) O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.) O4 - Startup: C:\Users\Danielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FREE OFFER from Audible.com.lnk = C:\Users\Danielle\AppData\Local\Temp\HelpInstaller_StartUp.exe File not found O4 - Startup: C:\Users\Danielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O4 - Startup: C:\Users\Danielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VZAccess Manager.lnk = C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe (Smith Micro Software, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - AppInit_DLLs: (C:\Windows\System32\avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 15:43:36 \| 00,000,024 \| ---- \| M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found O35 - comfile [open] -- "%1" % File not found O35 - exefile [open] -- "%1" %* File not found ========== LOP Check ========== [2007/08/29 21:33:17 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\ATI [2009/11/07 10:28:10 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Lexmark Productivity Studio [2008/03/24 17:39:01 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\MusicNet [2009/05/26 06:50:21 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\PeerNetworking [2007/08/29 22:13:03 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\PlayFirst [2007/08/29 23:08:48 \| 00,000,000 \| RH-D \| M] -- C:\Users\Danielle\AppData\Roaming\SecuROM [2008/02/04 07:48:04 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Simple Star [2009/04/11 20:23:16 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Smith Micro [2009/05/25 23:43:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\SPORE Creature Creator [2007/11/01 20:39:19 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Template [2008/04/21 17:21:57 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\TOSHIBA [2008/08/26 10:52:19 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Ulead Systems [2009/08/16 07:09:49 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Uniblue [2009/01/02 21:29:08 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\W Photo Studio [2009/01/02 21:25:58 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\W Photo Studio Viewer [2007/12/27 13:30:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Wal-Mart [2009/08/24 21:11:21 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\Walgreens [2007/08/29 21:37:33 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\WildTangent [2007/08/29 22:16:12 \| 00,000,000 \| ---D \| M] -- C:\Users\Danielle\AppData\Roaming\WinBatch [2009/10/15 03:00:11 \| 00,000,342 \| ---- \| M] () -- C:\Windows\Tasks\McDefragTask.job [2009/09/01 00:00:25 \| 00,000,334 \| ---- \| M] () -- C:\Windows\Tasks\McQcTask.job [2009/11/07 11:51:23 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\Tasks\SA.DAT [2009/11/07 11:48:01 \| 00,032,590 \| ---- \| M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report >

andrewuk View Member Profile	Nov 7 2009, 06:18 PM Post #11
Trusted Helper Posts: 4,613 From: London, UK OS: XP	looks like it ran ok. though looks like it ran twice. could you post the log of of the first run, if it exists. you will find it in the folder c:\qoobox\ the file will be called ComboFix2 where the 2 may be another number, but it will be the earliest file in this folder. let me know if it is not there andrewuk

woofless View Member Profile	Nov 9 2009, 04:56 AM Post #12
Member Posts: 11 OS: windows vista	Actually, no....I found Qoobox but there isn't a file named Combofix with a number. Just two folders called BackEnv, Quarantine, two text files called Combofix-Quarantined-files and Add-Remove Programs, and a DAT file called Snapshot@2009-11-07. My computer says it can't open the DAT file.

andrewuk View Member Profile	Nov 9 2009, 12:47 PM Post #13
Trusted Helper Posts: 4,613 From: London, UK OS: XP	ok, lets see if we can get RootRepeal to run again. go again to this page here and follow the instructions at Step Four: Rootkit Detection. however, this time given you are a vista user . . . . . I will require that all the programmes I ask you to run, be run by right clicking the icon and selecting Run as Administrator. Otherwise some programmes may fail to do their job properly andrewuk

woofless View Member Profile	Nov 11 2009, 07:41 PM Post #14
Member Posts: 11 OS: windows vista	Nope- RootRepeal didn't work again. I selected Run as Administrator & got the same error code as before. "Error dumping SSDT" when I click Scan, and after that "Cannot read system registry. Please contact the author". I did try running the scan again just without clicking "SSDT" and it was no different. The "error dumping SSDT" didn't come up but the "cannot read registry" did. Yeah. Vista sucks. I'd love to slap the guy who told me how great it was when selling me this laptop. That'll teach me to buy without doing my research.

andrewuk View Member Profile	Nov 12 2009, 05:29 AM Post #15
Trusted Helper Posts: 4,613 From: London, UK OS: XP	ok, lets move on and see where we stand after this. i dont see anything else in your logs at present, so in this post we will do some general scans to clear out the remnants and ensure nothing else sneaked onto your machine. the scans will likely take 4 hours, quite possibly much longer. so just let them run. we will also update your java ====STEP 1==== Please download ATF Cleaner by Atribune. Caution: This program is for Windows 2000, XP and Vista only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ====STEP 2==== we will update and re-run your malwarebytes: double click the malwarebytes icon on your desktop to open the program on the tabs at the top, select Update and then press the Check for Updates button on that page. If an update is found, it will download and install the latest version. once complete (a new version of malwarebytes may download) select the tab Scanner select "Perform Full Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. ====STEP 3==== Download and scan with SUPERAntiSpyware Free for Home Users Double-click SUPERAntiSpyware.exe and use the default settings for installation. An icon will be created on your desktop. Double-click that icon to launch the program. If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.) Under "*Configuration and Preferences", click the Preferences* button. Click the Scanning Control tab. Under Scanner Options make sure the following are checked (leave all others unchecked): Close browsers before scanning. Scan for tracking cookies. Terminate memory threats before quarantining. Click the "Close" button to leave the control center screen. Back on the main screen, under "*Scan for Harmful Software" click Scan your computer. On the left, make sure you check C:\Fixed Drive. On the right, under "Complete Scan", choose Perform Complete Scan. Click "Next" to start the scan. Please be patient while it scans your computer. After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". Make sure everything has a checkmark next to it and click "Next". A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. If asked if you want to reboot, click "Yes". To retrieve the removal information after reboot, launch SUPERAntispyware again. Click Preferences, then click the Statistics/Logs tab.* Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. Please copy and paste the Scan Log results in your next reply. Click Close to exit the program. ====STEP 4==== Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. NOT supported for use in 9x or ME Upgrading Java: Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 17. Click the "Download" button to the right. Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.". Click on Continue. Click on the link to download Windows Offline Installation (jre-6u17-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager.. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u17-windows-i586.exe and select "Run as an Administrator.") ====STEP 5==== Please do an online scan with Kaspersky WebScanner (this will identify any issues, we will clear them in the following post) Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure the following is checked. Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply. Upgrading Java, if required: Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 17. Click the "Download" button to the right. Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.". Click on Continue. Click on the link to download Windows Offline Installation (jre-6u17-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager.. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u17-windows-i586.exe and select "Run as an Administrator.") In your next reply could i see: 1. the malwarebytes log 2. the superantispyware log 3. the kaspersky log 4. some idea of how your machine is running now The text from these files may exceed the maximum post length for this forum. Hence, you may need to post the information over 2 or more posts. andrewuk

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Please Help me remove a Trojan Vundo and more from my computer [Closed	3 / 1,153	31st October 2007 - 05:48 PM mo.otss started - last by kahdah
Windows XP�, 2000, 2003, NT A million problems with my computer..... please help!	6 / 515	16th July 2008 - 09:08 AM PILL5B3RRY started - last by The Admiral
Virus, Spyware and Trojan Removal Help! Virus is sending out emails from my PC! [Closed]	13 / 1,460	26th February 2009 - 11:55 PM Sending started - last by Jimmy2012
Virus, Spyware and Trojan Removal Something is wrong on my computer: Please help! [Solved] 123	31 / 756	23rd August 2009 - 07:16 AM Kritayot started - last by Essexboy