Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Malware infection - redirects google links, can't run spybot, can&

Started by Wondamike7 , Apr 07 2009 07:51 PM

This topic is locked

#1
Wondamike7

Posted 07 April 2009 - 07:51 PM

Member

Member
16 posts

I'm assuming this all started when I (foolishly) tried to install a program called "Convert2Play" that was supposedly going to enable me to watch a movie file that wasn't working. So, yes, I'm an idiot, and now I need help.

I noticed the problem when clicking on any google search result would get redirected to random useless advertisement sites that have nothing to do with what i was originally searching for. When I realized something was wrong I went to SpyBot which won't load, and to my F-Prot Antivirus, which wouldn't update (but will run and scan like normal). I scanned the Convert2Play executable with both AV and SpyBot and got no hits previously, but obviously they missed something.

I've run through your malware removal stuff - couldn't download the anti-malware program though. I'm including the logs you request, starting with rooter.

Mike

Microsoft Windows XP Professional (5.1.2600) Service Pack 3

A:\ [Removable] (Total:0 Mo/Free:0 Mo)
C:\ [Fixed] - NTFS - (Total:38162 Mo/Free:2781 Mo)
D:\ [Fixed] - NTFS - (Total:10236 Mo/Free:1358 Mo)
E:\ [Fixed] - NTFS - (Total:20002 Mo/Free:3338 Mo)
F:\ [Fixed] - NTFS - (Total:60000 Mo/Free:1177 Mo)
G:\ [Fixed] - NTFS - (Total:14229 Mo/Free:41 Mo)
H:\ [Fixed] - NTFS - (Total:10001 Mo/Free:694 Mo)
I:\ [Fixed] - NTFS - (Total:250003 Mo/Free:2298 Mo)
J:\ [Fixed] - NTFS - (Total:250003 Mo/Free:3130 Mo)
S:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
T:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)

Tue 04/07/2009|22:04

----------------------\\ Processes..

--Locked-- [System Process]
---------- System
---------- \SystemRoot\System32\smss.exe
---------- \??\C:\WINDOWS\system32\csrss.exe
---------- \??\C:\WINDOWS\system32\winlogon.exe
---------- C:\WINDOWS\system32\services.exe
---------- C:\WINDOWS\system32\lsass.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\system32\svchost.exe
---------- C:\WINDOWS\Explorer.EXE
---------- C:\Program Files\Bonjour\mDNSResponder.exe
---------- C:\WINDOWS\System32\svchost.exe
---------- C:\Program Files\iTunes\iTunesHelper.exe
---------- C:\WINDOWS\system32\ctfmon.exe
---------- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
---------- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
---------- C:\WINDOWS\system32\IoctlSvc.exe
---------- C:\Program Files\iPod\bin\iPodService.exe
---------- C:\WINDOWS\System32\alg.exe
---------- C:\WINDOWS\system32\wscntfy.exe
---------- C:\Program Files\Windows Media Player\WMPNetwk.exe
---------- C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
---------- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
---------- C:\WINDOWS\system32\spoolsv.exe
---------- C:\Program Files\Internet Explorer\IEXPLORE.EXE
---------- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
---------- C:\WINDOWS\system32\cmd.exe
---------- C:\Rooter$\RK.exe

----------------------\\ Search..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}]
NameServer REG_SZ 85.255.112.115,85.255.112.205
==> WAREOUT <==

----------------------\\ ROOTKIT !!

----------------------\\ Cracks & Keygens..

C:\DOCUME~1\Home\Recent\adobe.photoshop.cs4.extended.v11.0.0.0.crack.only_nope.zip.lnk

1 - "C:\Rooter$\Rooter_1.txt" - Tue 04/07/2009|22:04

----------------------\\ Scan completed at 22:04

Edited by Wondamike7, 07 April 2009 - 08:08 PM.

#2
Wondamike7

Posted 07 April 2009 - 08:12 PM

Member

Topic Starter
Member
16 posts

OTListIt log

OTListIt logfile created on: 4/7/2009 10:06:24 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.12.1 Folder = C:\Documents and Settings\Home\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.72 Mb Total Physical Memory | 543.18 Mb Available Physical Memory | 53.11% Memory free
2.03 Gb Paging File | 1.69 Gb Available in Paging File | 83.38% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 2.72 Gb Free Space | 7.29% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.33 Gb Free Space | 53.28% Space Free | Partition Type: NTFS
Drive E: | 19.53 Gb Total Space | 7.26 Gb Free Space | 37.17% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 21.15 Gb Free Space | 36.10% Space Free | Partition Type: NTFS
Drive G: | 13.90 Gb Total Space | 4.04 Gb Free Space | 29.08% Space Free | Partition Type: NTFS
Drive H: | 9.77 Gb Total Space | 4.68 Gb Free Space | 47.90% Space Free | Partition Type: NTFS
Drive I: | 244.14 Gb Total Space | 174.24 Gb Free Space | 71.37% Space Free | Partition Type: NTFS
Drive J: | 244.14 Gb Total Space | 199.06 Gb Free Space | 81.53% Space Free | Partition Type: NTFS

Computer Name: NEWPC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
PRC - C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
PRC - C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe (FRISK Software International)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
PRC - C:\Documents and Settings\Home\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (FPAVServer [Auto | Running]) -- C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe (FRISK Software International)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Stopped]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Nero BackItUp Scheduler 3 [Auto | Running]) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NMIndexingService [On_Demand | Stopped]) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PLFlash DeviceIoControl Service [Auto | Running]) -- C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.)
SRV - (WMPNetworkSvc [Auto | Running]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (adfs [Auto | Running]) -- C:\WINDOWS\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (Cdr4_xp [System | Running]) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (Cdralw2k [System | Running]) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (cdudf_xp [System | Running]) -- C:\WINDOWS\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (dvd_2K [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (E1000 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\e1000325.sys (Intel Corporation)
DRV - (es1371 [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (FPAV_RTP [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\FStopW.sys (FRISK Software International)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (mmc_2K [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (pgfilter [On_Demand | Stopped]) -- C:\Program Files\PeerGuardian2\pgfilter.sys ()
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (pwd_2k [System | Running]) -- C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (sbpci [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sbpci.sys (Creative Technology Ltd.)
DRV - (SCDEmu [System | Running]) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SI3112 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3112.sys (Silicon Image, Inc.)
DRV - (SI3112r [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3112r.sys (Silicon Image, Inc)
DRV - (SI3124 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3124.sys (Silicon Image, Inc.)
DRV - (Si3124r5 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\Si3124r5.sys (Silicon Image, Inc)
DRV - (SiFilter [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (SiRemFil [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (UdfReadr_xp [System | Running]) -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys (Roxio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {44d0a1b4-9c90-4f86-ac92-8680b5d6549e}:0.6.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}:6.0.06
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.7

FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2008/12/07 11:38:17 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.7\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/01 16:29:46 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.7\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/01 16:29:46 | 00,000,000 | ---D | M]

[2009/02/12 18:05:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions
[2009/02/12 18:05:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2008/06/01 13:21:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions\[email protected]
[2009/03/24 08:06:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Firefox\Profiles\hmppqini.default\extensions
[2008/08/19 16:00:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Firefox\Profiles\hmppqini.default\extensions\{44d0a1b4-9c90-4f86-ac92-8680b5d6549e}
[2009/03/23 08:02:03 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/03/16 08:12:20 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/06/06 16:14:36 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
[2008/07/28 06:21:46 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2008/12/07 11:38:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/01/02 16:40:01 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/03/16 08:12:20 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/03/16 08:12:20 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/01/19 19:28:04 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/01/19 19:28:04 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/01/19 19:28:04 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/01/19 19:28:04 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/01/19 19:28:04 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/01/19 19:28:04 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/01/19 19:28:04 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (764 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" (Adobe Systems Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [F-PROT Antivirus Tray application] C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe (FRISK Software International)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 (Nero AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://zone.msn.com/...UI.cab55579.cab (StagingUI Object)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} http://zone.msn.com/...dy.cab55579.cab (MSN Games – Buddy Invite)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish...fishActivia.cab (Snapfish Activia)
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} http://zone.msn.com/...at.cab55579.cab (ZonePAChat Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1169077447250 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1209421641203 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} http://zone.msn.com/...he.cab75406.cab (MSN Games – Texas Holdem Poker)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.ma...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} http://zone.msn.com/...xy.cab55579.cab (MSN Games – Game Communicator)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/...ploader_v10.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.115,85.255.112.205
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}\\NameServer = 85.255.112.115,85.255.112.205
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\WINDOWS\system32\acaptuser32.dll (Adobe Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - I:\Autograph [2008/08/04 13:27:10 | 00,000,000 | ---D | M] - [ NTFS ]
O33 - MountPoints2\L\Shell - "" = AutoRun
O33 - MountPoints2\L\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\_AUTORUN\AUTORUN.EXE -- File not found
O33 - MountPoints2\L\Shell\readme\command - "" = notepad readme.txt
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[5 C:\WINDOWS\*.tmp files]
[2009/04/07 22:05:42 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\DOCUME~1\Home\Desktop\OTListIt2.exe
[2009/04/07 22:04:09 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/04/07 22:03:59 | 00,267,612 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\Rooter.exe
[2009/04/07 22:02:36 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/04/07 22:02:20 | 00,000,621 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\NTREGOPT.lnk
[2009/04/07 22:02:20 | 00,000,602 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\ERUNT.lnk
[2009/04/07 22:02:20 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/04/07 22:01:36 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\DOCUME~1\Home\Desktop\erunt_setup.exe
[2009/04/07 22:00:45 | 00,000,000 | ---D | C] -- C:\DOCUME~1\Home\Desktop\SysRestorePoint_v13
[2009/04/07 22:00:34 | 00,009,334 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\SysRestorePoint_v13.zip
[2009/04/07 21:41:37 | 00,001,744 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\HijackThis.lnk
[2009/04/07 21:41:37 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/04/03 23:28:11 | 00,001,684 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\Learn to Play Bridge 2.lnk
[2009/04/03 23:28:10 | 00,000,000 | ---D | C] -- C:\Program Files\Learn to Play Bridge 2
[2009/04/03 23:28:03 | 00,001,634 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\Learn to Play Bridge.lnk
[2009/04/03 23:28:02 | 00,286,720 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun506.exe
[2009/04/03 23:28:02 | 00,000,000 | ---D | C] -- C:\Program Files\Learn to Play Bridge
[2009/04/01 16:41:33 | 00,000,000 | ---D | C] -- C:\Program Files\iPod
[2009/04/01 16:41:24 | 00,000,000 | ---D | C] -- C:\Program Files\iTunes
[2009/04/01 16:41:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/04/01 16:32:23 | 00,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2009/04/01 16:28:51 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2009/04/01 16:26:47 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009/03/20 18:59:56 | 00,388,760 | ---- | C] () -- C:\DOCUME~1\Home\Desktop\08_540nrlong.pdf
[2009/03/20 17:26:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\TaxCut
[2009/03/20 17:26:22 | 00,001,634 | ---- | C] () -- C:\DOCUME~1\ALLUSE~1\Desktop\H&R Block TaxCut 2008.lnk
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Program Files\TaxCut08
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Program Files\PDF995
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\DOCUME~1\Home\My Documents\TaxCut
[2009/03/20 17:24:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2009/03/20 17:23:22 | 00,000,000 | -HSD | C] -- C:\WINDOWS\ftpcache
[2009/03/17 17:34:38 | 00,000,000 | ---D | C] -- C:\Netgear
[2009/03/14 14:52:44 | 00,111,992 | ---- | C] (Adobe Systems, Inc.) -- C:\WINDOWS\System32\acaptuser32.dll
[2008/07/20 23:02:50 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/04/28 18:01:47 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/04/28 16:04:03 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/04/28 16:04:02 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/03/31 17:25:46 | 00,831,488 | ---- | C] () -- C:\WINDOWS\System32\divx_xx0a.dll
[2008/03/21 16:30:08 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/03/21 16:28:54 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/03/21 16:28:54 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008/03/21 16:28:20 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/01/17 19:37:02 | 00,126,976 | R--- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2004/08/04 01:00:00 | 00,000,507 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/04 01:00:00 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[53 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[2009/04/07 22:05:44 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\DOCUME~1\Home\Desktop\OTListIt2.exe
[2009/04/07 22:04:00 | 00,267,612 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\Rooter.exe
[2009/04/07 22:02:20 | 00,000,621 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\NTREGOPT.lnk
[2009/04/07 22:02:20 | 00,000,602 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\ERUNT.lnk
[2009/04/07 22:01:37 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\DOCUME~1\Home\Desktop\erunt_setup.exe
[2009/04/07 22:00:34 | 00,009,334 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\SysRestorePoint_v13.zip
[2009/04/07 21:55:10 | 00,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{8855875C-9E65-4703-9811-6D6ABB107C4B}.job
[2009/04/07 21:41:37 | 00,001,744 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\HijackThis.lnk
[2009/04/07 21:37:22 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/07 21:37:17 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/07 21:37:12 | 10,724,76160 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/07 21:32:39 | 00,000,231 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/05 18:44:55 | 06,991,872 | ---- | M] () -- C:\DOCUME~1\Home\My Documents\MOVIES.mdb
[2009/04/03 23:28:11 | 00,001,684 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\Learn to Play Bridge 2.lnk
[2009/04/03 23:28:07 | 00,286,720 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun506.exe
[2009/04/03 23:28:03 | 00,001,634 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\Learn to Play Bridge.lnk
[2009/04/03 23:19:14 | 00,081,920 | ---- | M] () -- C:\Documents and Settings\Home\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/03 22:35:38 | 00,262,144 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\Finances_new.xls
[2009/04/03 22:11:57 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/04/03 16:50:55 | 00,000,943 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\Spybot - Search & Destroy.lnk
[2009/04/01 17:00:11 | 00,022,272 | ---- | M] () -- C:\Documents and Settings\Home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/03/31 23:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/03/25 18:53:10 | 02,001,704 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/25 18:52:55 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/03/20 20:31:31 | 00,000,532 | ---- | M] () -- C:\hpfr5550.xml
[2009/03/20 18:59:56 | 00,388,760 | ---- | M] () -- C:\DOCUME~1\Home\Desktop\08_540nrlong.pdf
[2009/03/20 17:26:22 | 00,001,634 | ---- | M] () -- C:\DOCUME~1\ALLUSE~1\Desktop\H&R Block TaxCut 2008.lnk
[2009/03/11 03:13:46 | 00,458,340 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/03/11 03:13:46 | 00,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/03/11 03:13:46 | 00,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/03/11 03:01:57 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
< End of report >

#3
Wondamike7

Posted 07 April 2009 - 08:16 PM

Member

Topic Starter
Member
16 posts

Extras log

OTListIt Extras logfile created on: 4/7/2009 10:06:24 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.12.1 Folder = C:\Documents and Settings\Home\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.72 Mb Total Physical Memory | 543.18 Mb Available Physical Memory | 53.11% Memory free
2.03 Gb Paging File | 1.69 Gb Available in Paging File | 83.38% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 2.72 Gb Free Space | 7.29% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.33 Gb Free Space | 53.28% Space Free | Partition Type: NTFS
Drive E: | 19.53 Gb Total Space | 7.26 Gb Free Space | 37.17% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 21.15 Gb Free Space | 36.10% Space Free | Partition Type: NTFS
Drive G: | 13.90 Gb Total Space | 4.04 Gb Free Space | 29.08% Space Free | Partition Type: NTFS
Drive H: | 9.77 Gb Total Space | 4.68 Gb Free Space | 47.90% Space Free | Partition Type: NTFS
Drive I: | 244.14 Gb Total Space | 174.24 Gb Free Space | 71.37% Space Free | Partition Type: NTFS
Drive J: | 244.14 Gb Total Space | 199.06 Gb Free Space | 81.53% Space Free | Partition Type: NTFS

Computer Name: NEWPC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent File not found
C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent (BitTorrent, Inc.)
C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer (Microsoft Corporation)
C:\Program Files\Magic Workstation\MWSPlay.exe:*:Enabled:Magic Workstation Play Module File not found
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 (Adobe Systems Incorporated)
T:\bin\IA\Core\MDM_Util.exe:*:Enabled:MDM_Util File not found
C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.)
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{162B71B8-8464-4680-A086-601D555B331D}" = Apple Mobile Device Support
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java™ 6 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{609F7AC8-C510-11D4-A788-009027ABA5D0}" = Easy CD Creator 5 Basic
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{6549AA0C-6D93-4E76-9A13-6A6A0AA4FD6D}" = TaxCut California 2008
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6DA9102E-199F-43A0-A36B-6EF48081A658}" = MobileMe Control Panel
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{900A92BA-19EF-4A34-86CF-7B6C85BDD971}" = VC_MergeModuleToMSI
"{91E30409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = DVD
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF7733C1-FB0B-4FED-9730-E0433AF7A2EF}" = Magic Online III
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BBB33AD6-BCF7-4002-B6A0-6DC679AE5C18}" = TaxCut Premium + State + Efile 2008
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{C26B06A9-27BB-45B0-9873-9C623EC2BA38}" = iTunes
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B6}" = WinZip 11.2
"{D55D73C4-E4D1-4EC2-9BA9-3068AE2006D8}" = TaxCut Virginia 2008
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E58B329B-FB28-4874-90DE-0D7CB2709267}" = F-PROT Antivirus for Windows
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"7-Zip" = 7-Zip 4.42
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"AoADVDCreator_is1" = AoADVDCreator
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-01-24
"ERUNT_is1" = ERUNT 1.1j
"Gateway Drivers and Applications Recovery" = Gateway Drivers and Applications Recovery
"Heroes of Might and Magic IV" = Heroes of Might and Magic® IV
"HijackThis" = HijackThis 2.0.2
"hp deskjet 5550 series" = hp deskjet 5550 series (Remove only)
"hp deskjet 5550 series_Driver" = hp deskjet 5550 series
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Learn_to_Play_Bridge" = Learn to Play Bridge
"Learn_to_Play_Bridge_2" = Learn to Play Bridge 2
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.0.7)" = Mozilla Firefox (3.0.7)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PeerGuardian_is1" = PeerGuardian 2.0
"PowerISO" = PowerISO
"PROSet" = Intel® PRO Network Adapters and Drivers
"SBPCIUnInstall" = Creative PCI Audio Drivers
"The Rosetta Stone" = The Rosetta Stone
"TomTom HOME" = TomTom HOME
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/20/2009 7:01:34 PM | Computer Name = NEWPC | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 9.1.0.163, faulting module
unknown, version 0.0.0.0, fault address 0x01f78fb7.

Error - 3/20/2009 7:02:03 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application Acrobat.exe, version 9.1.0.163, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/20/2009 7:02:07 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application Acrobat.exe, version 9.1.0.163, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/28/2009 12:06:59 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/30/2009 7:12:14 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/31/2009 9:50:56 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application Acrobat.exe, version 9.1.0.163, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/4/2009 11:09:53 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/4/2009 11:09:56 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2009 8:49:46 AM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8237.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2009 9:13:32 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8237.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 4/7/2009 7:39:17 AM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 4/7/2009 7:39:17 AM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 4/7/2009 9:17:33 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7034
Description = The PLFlash DeviceIoControl Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/7/2009 9:30:04 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 4/7/2009 9:38:46 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/7/2009 9:39:33 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.

Error - 4/7/2009 9:40:18 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7034
Description = The NMIndexingService service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/7/2009 9:40:21 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 4/7/2009 9:40:30 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The F-PROT Antivirus for Windows system service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
3600 milliseconds: Run the configured recovery program.

Error - 4/7/2009 9:40:40 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

< End of report >

#4
heir

Posted 11 April 2009 - 04:32 PM

Trusted Helper

Malware Removal
5,427 posts

Hello Wondamike7 !

Welcome to the site!

My nickname is heir and I'll be helping clean up your computer.

Before we proceed to clean your computer from malware, let's go over some points that will help both me and you, and prevent causing damage to your computer:

To make sure that you receive an email when I reply to this topic, please click here and check that this topic is listed under Malware Removal and Spyware Removal.
Please don't be afraid to ask questions! No question is considered dumb here. It's better to be safe than sorry!
When posting logs, please ensure Wordwrap is turned off in Notepad (to check, open Notepad in the menubar click on Format and make sure that Word Wrap is unchecked)
Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know.
NEVER fix anything in HijackThis or other programs on your own! This can be very dangerous and cause harm to your system. If you see a certain entry or program you're unsure about, please don't hesitate to ask!
Make sure you reply to this thread using the Add Reply button:

Please read my posts completely before following the instructions.
It may be easier for you if you copy and paste a post to a new text document or print it for reference later.
This is required when you won't have access to Internet.

I need a fresh set of logs, so please do this.

Step 1.
Scan with OTl2:

Download OTListIt2 to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
For the Extra Registry option select Use SafeList.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Step 2.
Lop S&D:

Disable resident protections (Antivirus...); you'll re-enable them after the scan

Download Lop S&D < here and save it to the desktop

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

Step 3.
Things I would like to see in your reply:

The content of the OTListIt.txt and Extras.txt from step 1.
The content of the C:\lopR.txt from step 2.

#5
Wondamike7

Posted 12 April 2009 - 09:41 AM

Member

Topic Starter
Member
16 posts

Thanks for helping, I really appreciate it!

OTListIt.txt

OTListIt logfile created on: 4/12/2009 11:33:26 AM - Run 2
OTListIt2 by OldTimer - Version 2.0.12.1 Folder = C:\Documents and Settings\Home\Desktop\Fix Comp
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.72 Mb Total Physical Memory | 584.66 Mb Available Physical Memory | 57.17% Memory free
2.03 Gb Paging File | 1.72 Gb Available in Paging File | 84.73% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 3.58 Gb Free Space | 9.60% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.33 Gb Free Space | 53.28% Space Free | Partition Type: NTFS
Drive E: | 19.53 Gb Total Space | 7.26 Gb Free Space | 37.17% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 21.15 Gb Free Space | 36.10% Space Free | Partition Type: NTFS
Drive G: | 13.90 Gb Total Space | 4.04 Gb Free Space | 29.08% Space Free | Partition Type: NTFS
Drive H: | 9.77 Gb Total Space | 4.68 Gb Free Space | 47.91% Space Free | Partition Type: NTFS
Drive I: | 244.14 Gb Total Space | 174.24 Gb Free Space | 71.37% Space Free | Partition Type: NTFS
Drive J: | 244.14 Gb Total Space | 199.06 Gb Free Space | 81.53% Space Free | Partition Type: NTFS

Computer Name: NEWPC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.)
PRC - C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Home\Desktop\Fix Comp\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Nero BackItUp Scheduler 3 [Auto | Running]) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NMIndexingService [On_Demand | Running]) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PLFlash DeviceIoControl Service [Auto | Running]) -- C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.)
SRV - (WMPNetworkSvc [Auto | Running]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (wwEngineSvc [Auto | Running]) -- C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)

========== Driver Services (SafeList) ==========

DRV - (adfs [Auto | Running]) -- C:\WINDOWS\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (AvgLdx86 [System | Running]) -- C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) -- C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Cdr4_xp [System | Running]) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (Cdralw2k [System | Running]) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (cdudf_xp [System | Running]) -- C:\WINDOWS\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (dvd_2K [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (E1000 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\e1000325.sys (Intel Corporation)
DRV - (es1371 [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (mmc_2K [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (pgfilter [On_Demand | Stopped]) -- C:\Program Files\PeerGuardian2\pgfilter.sys ()
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (pwd_2k [System | Running]) -- C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (sbpci [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sbpci.sys (Creative Technology Ltd.)
DRV - (SCDEmu [System | Running]) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SI3112 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3112.sys (Silicon Image, Inc.)
DRV - (SI3112r [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3112r.sys (Silicon Image, Inc)
DRV - (SI3124 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3124.sys (Silicon Image, Inc.)
DRV - (Si3124r5 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\Si3124r5.sys (Silicon Image, Inc)
DRV - (SiFilter [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (SiRemFil [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (tmcomm [Auto | Running]) -- C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (UdfReadr_xp [System | Running]) -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys (Roxio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {44d0a1b4-9c90-4f86-ac92-8680b5d6549e}:0.6.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8

FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/04/08 07:15:18 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\PROGRAM FILES\AVG\AVG8\FIREFOX [2009/04/10 20:12:49 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/10 19:53:09 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/10 19:53:09 | 00,000,000 | ---D | M]

[2009/02/12 18:05:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions
[2009/02/12 18:05:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2008/06/01 13:21:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions\[email protected]
[2009/04/10 20:20:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Firefox\Profiles\hmppqini.default\extensions
[2008/08/19 16:00:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Firefox\Profiles\hmppqini.default\extensions\{44d0a1b4-9c90-4f86-ac92-8680b5d6549e}
[2009/04/10 20:20:25 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/04/10 19:53:02 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/12/07 11:38:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/04/08 07:15:35 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/04/10 19:53:02 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/10 19:53:02 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/01/19 19:28:04 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/01/19 19:28:04 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/01/19 19:28:04 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/01/19 19:28:04 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/01/19 19:28:04 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/01/19 19:28:04 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/01/19 19:28:04 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (764 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" (Adobe Systems Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 (Nero AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://zone.msn.com/...UI.cab55579.cab (StagingUI Object)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} http://zone.msn.com/...dy.cab55579.cab (MSN Games – Buddy Invite)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish...fishActivia.cab (Snapfish Activia)
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} http://zone.msn.com/...at.cab55579.cab (ZonePAChat Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1169077447250 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1209421641203 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} http://zone.msn.com/...he.cab75406.cab (MSN Games – Texas Holdem Poker)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.ma...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} http://zone.msn.com/...xy.cab55579.cab (MSN Games – Game Communicator)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/...ploader_v10.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.115,85.255.112.205
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}\\NameServer = 85.255.112.115,85.255.112.205
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\WINDOWS\system32\acaptuser32.dll (Adobe Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\system32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - I:\Autograph [2008/08/04 13:27:10 | 00,000,000 | ---D | M] - [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[5 C:\WINDOWS\*.tmp files]
[2009/04/10 20:47:16 | 00,000,000 | -H-D | C] -- C:\$AVG8.VAULT$
[2009/04/10 20:24:19 | 02,348,416 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\FixDwndp.exe
[2009/04/10 20:13:13 | 00,108,552 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/04/10 20:13:13 | 00,010,520 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/04/10 20:13:13 | 00,001,517 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk
[2009/04/10 20:13:08 | 00,325,640 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/04/10 20:13:07 | 00,027,656 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/04/10 20:13:03 | 34,395,507 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/04/10 20:13:03 | 06,061,540 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/04/10 20:13:03 | 00,401,372 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/04/10 20:13:03 | 00,057,798 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/04/10 20:13:03 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg
[2009/04/10 20:12:49 | 00,000,000 | ---D | C] -- C:\Program Files\AVG
[2009/04/10 20:12:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg8
[2009/04/10 20:09:43 | 63,049,904 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Home\Desktop\avg_free_stf_en_85_285a1462.exe
[2009/04/10 19:54:39 | 00,001,606 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\Window Washer.lnk
[2009/04/10 19:54:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\Webroot
[2009/04/10 19:54:34 | 00,000,000 | ---D | C] -- C:\Program Files\Webroot
[2009/04/10 19:54:34 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Webroot Shared
[2009/04/10 19:54:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Webroot
[2009/04/10 19:54:31 | 00,196,424 | ---- | C] (Webroot Software, Inc.) -- C:\WINDOWS\Unwash6.exe
[2009/04/10 19:54:12 | 03,886,408 | ---- | C] (Webroot Software, Inc.) -- C:\Documents and Settings\Home\Desktop\WindowWasherTrialSetup.exe
[2009/04/10 11:57:55 | 00,138,384 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2009/04/10 01:31:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\HouseCall 6.6
[2009/04/08 07:34:29 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/08 07:34:27 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/08 07:34:26 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/04/08 07:34:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/04/08 07:32:02 | 01,340,961 | ---- | C] () -- C:\MGtools.exe
[2009/04/08 07:29:30 | 00,000,000 | ---D | C] -- C:\Malware Removal
[2009/04/08 07:24:13 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/04/08 07:16:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009/04/07 22:13:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Desktop\Fix Comp
[2009/04/07 22:04:09 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/04/07 22:02:36 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/04/07 22:02:20 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/04/07 21:41:37 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/04/03 23:28:11 | 00,001,684 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge 2.lnk
[2009/04/03 23:28:10 | 00,000,000 | ---D | C] -- C:\Program Files\Learn to Play Bridge 2
[2009/04/03 23:28:03 | 00,001,634 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge.lnk
[2009/04/03 23:28:02 | 00,286,720 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun506.exe
[2009/04/03 23:28:02 | 00,000,000 | ---D | C] -- C:\Program Files\Learn to Play Bridge
[2009/04/01 16:41:33 | 00,000,000 | ---D | C] -- C:\Program Files\iPod
[2009/04/01 16:41:24 | 00,000,000 | ---D | C] -- C:\Program Files\iTunes
[2009/04/01 16:41:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/04/01 16:32:23 | 00,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2009/04/01 16:28:51 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2009/03/20 18:59:56 | 00,388,760 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\08_540nrlong.pdf
[2009/03/20 17:26:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\TaxCut
[2009/03/20 17:26:22 | 00,001,634 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\H&R Block TaxCut 2008.lnk
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Program Files\TaxCut08
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Program Files\PDF995
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\My Documents\TaxCut
[2009/03/20 17:24:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2009/03/20 17:23:22 | 00,000,000 | -HSD | C] -- C:\WINDOWS\ftpcache
[2009/03/17 17:34:38 | 00,000,000 | ---D | C] -- C:\Netgear
[2009/03/14 14:52:44 | 00,111,992 | ---- | C] (Adobe Systems, Inc.) -- C:\WINDOWS\System32\acaptuser32.dll
[2008/07/20 23:02:50 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/04/28 18:01:47 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/04/28 16:04:03 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/04/28 16:04:02 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/03/31 17:25:46 | 00,831,488 | ---- | C] () -- C:\WINDOWS\System32\divx_xx0a.dll
[2008/03/21 16:30:08 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/03/21 16:28:54 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/03/21 16:28:54 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008/03/21 16:28:20 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/01/17 19:37:02 | 00,126,976 | R--- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2004/08/04 01:00:00 | 00,000,507 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/04 01:00:00 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[53 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[2009/04/12 11:20:17 | 00,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{8855875C-9E65-4703-9811-6D6ABB107C4B}.job
[2009/04/11 11:47:44 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/11 11:47:33 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/11 11:47:27 | 10,724,76160 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/10 20:24:19 | 02,348,416 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\FixDwndp.exe
[2009/04/10 20:13:13 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/04/10 20:13:13 | 00,010,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/04/10 20:13:13 | 00,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk
[2009/04/10 20:13:08 | 00,325,640 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/04/10 20:13:07 | 34,395,507 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/04/10 20:13:07 | 00,027,656 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/04/10 20:13:03 | 06,061,540 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/04/10 20:13:03 | 00,401,372 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/04/10 20:13:03 | 00,057,798 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/04/10 20:10:54 | 63,049,904 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Home\Desktop\avg_free_stf_en_85_285a1462.exe
[2009/04/10 19:54:39 | 00,001,606 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Window Washer.lnk
[2009/04/10 19:54:21 | 03,886,408 | ---- | M] (Webroot Software, Inc.) -- C:\Documents and Settings\Home\Desktop\WindowWasherTrialSetup.exe
[2009/04/08 07:32:03 | 01,340,961 | ---- | M] () -- C:\MGtools.exe
[2009/04/07 21:32:39 | 00,000,231 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/06 15:32:54 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/06 15:32:46 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/05 18:44:55 | 06,991,872 | ---- | M] () -- C:\Documents and Settings\Home\My Documents\MOVIES.mdb
[2009/04/03 23:28:11 | 00,001,684 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge 2.lnk
[2009/04/03 23:28:07 | 00,286,720 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun506.exe
[2009/04/03 23:28:03 | 00,001,634 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge.lnk
[2009/04/03 23:19:14 | 00,081,920 | ---- | M] () -- C:\Documents and Settings\Home\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/03 22:35:38 | 00,262,144 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Finances_new.xls
[2009/04/03 22:11:57 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/04/01 17:00:11 | 00,022,272 | ---- | M] () -- C:\Documents and Settings\Home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/03/31 23:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/03/25 18:53:10 | 02,001,704 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/25 18:52:55 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/03/20 20:31:31 | 00,000,532 | ---- | M] () -- C:\hpfr5550.xml
[2009/03/20 18:59:56 | 00,388,760 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\08_540nrlong.pdf
[2009/03/20 17:26:22 | 00,001,634 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\H&R Block TaxCut 2008.lnk
[2009/03/15 13:54:53 | 00,000,764 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
< End of report >

Extras.txt
OTListIt Extras logfile created on: 4/12/2009 11:33:26 AM - Run 2
OTListIt2 by OldTimer - Version 2.0.12.1 Folder = C:\Documents and Settings\Home\Desktop\Fix Comp
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.72 Mb Total Physical Memory | 584.66 Mb Available Physical Memory | 57.17% Memory free
2.03 Gb Paging File | 1.72 Gb Available in Paging File | 84.73% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 3.58 Gb Free Space | 9.60% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.33 Gb Free Space | 53.28% Space Free | Partition Type: NTFS
Drive E: | 19.53 Gb Total Space | 7.26 Gb Free Space | 37.17% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 21.15 Gb Free Space | 36.10% Space Free | Partition Type: NTFS
Drive G: | 13.90 Gb Total Space | 4.04 Gb Free Space | 29.08% Space Free | Partition Type: NTFS
Drive H: | 9.77 Gb Total Space | 4.68 Gb Free Space | 47.91% Space Free | Partition Type: NTFS
Drive I: | 244.14 Gb Total Space | 174.24 Gb Free Space | 71.37% Space Free | Partition Type: NTFS
Drive J: | 244.14 Gb Total Space | 199.06 Gb Free Space | 81.53% Space Free | Partition Type: NTFS

Computer Name: NEWPC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent File not found
C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent (BitTorrent, Inc.)
C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer (Microsoft Corporation)
C:\Program Files\Magic Workstation\MWSPlay.exe:*:Enabled:Magic Workstation Play Module File not found
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 (Adobe Systems Incorporated)
T:\bin\IA\Core\MDM_Util.exe:*:Enabled:MDM_Util File not found
C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.)
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)
C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe (AVG Technologies CZ, s.r.o.)
C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe (AVG Technologies CZ, s.r.o.)
C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{162B71B8-8464-4680-A086-601D555B331D}" = Apple Mobile Device Support
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{609F7AC8-C510-11D4-A788-009027ABA5D0}" = Easy CD Creator 5 Basic
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{6549AA0C-6D93-4E76-9A13-6A6A0AA4FD6D}" = TaxCut California 2008
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6DA9102E-199F-43A0-A36B-6EF48081A658}" = MobileMe Control Panel
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{900A92BA-19EF-4A34-86CF-7B6C85BDD971}" = VC_MergeModuleToMSI
"{91E30409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = DVD
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF7733C1-FB0B-4FED-9730-E0433AF7A2EF}" = Magic Online III
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BBB33AD6-BCF7-4002-B6A0-6DC679AE5C18}" = TaxCut Premium + State + Efile 2008
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{C26B06A9-27BB-45B0-9873-9C623EC2BA38}" = iTunes
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B6}" = WinZip 11.2
"{D55D73C4-E4D1-4EC2-9BA9-3068AE2006D8}" = TaxCut Virginia 2008
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"7-Zip" = 7-Zip 4.42
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"AoADVDCreator_is1" = AoADVDCreator
"AVG8Uninstall" = AVG 8.5
"CCleaner" = CCleaner (remove only)
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-01-24
"ERUNT_is1" = ERUNT 1.1j
"Gateway Drivers and Applications Recovery" = Gateway Drivers and Applications Recovery
"Heroes of Might and Magic IV" = Heroes of Might and Magic® IV
"HijackThis" = HijackThis 2.0.2
"hp deskjet 5550 series" = hp deskjet 5550 series (Remove only)
"hp deskjet 5550 series_Driver" = hp deskjet 5550 series
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Learn_to_Play_Bridge" = Learn to Play Bridge
"Learn_to_Play_Bridge_2" = Learn to Play Bridge 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.0.8)" = Mozilla Firefox (3.0.8)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PeerGuardian_is1" = PeerGuardian 2.0
"PowerISO" = PowerISO
"PROSet" = Intel® PRO Network Adapters and Drivers
"SBPCIUnInstall" = Creative PCI Audio Drivers
"The Rosetta Stone" = The Rosetta Stone
"TomTom HOME" = TomTom HOME
"Trend Micro HouseCall 6.6" = HouseCall 6.6
"Window Washer" = Window Washer
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/28/2009 12:06:59 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/30/2009 7:12:14 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/31/2009 9:50:56 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application Acrobat.exe, version 9.1.0.163, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/4/2009 11:09:53 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/4/2009 11:09:56 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2009 8:49:46 AM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8237.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/5/2009 9:13:32 PM | Computer Name = NEWPC | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.8237.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/8/2009 7:32:48 AM | Computer Name = NEWPC | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.26.0.1000, faulting
module superantispyware.exe, version 4.26.0.1000, fault address 0x000039e0.

Error - 4/8/2009 7:32:58 AM | Computer Name = NEWPC | Source = Application Error | ID = 1000
Description = Faulting application sas.exe, version 4.26.0.1000, faulting module
sas.exe, version 4.26.0.1000, fault address 0x000039e0.

Error - 4/8/2009 5:57:53 PM | Computer Name = NEWPC | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download....uthrootseq.txt>
with error: A connection with the server could not be established

[ System Events ]
Error - 4/7/2009 9:17:33 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7034
Description = The PLFlash DeviceIoControl Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/7/2009 9:30:04 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 4/7/2009 9:38:46 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/7/2009 9:39:33 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.

Error - 4/7/2009 9:40:18 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7034
Description = The NMIndexingService service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/7/2009 9:40:21 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 4/7/2009 9:40:30 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The F-PROT Antivirus for Windows system service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
3600 milliseconds: Run the configured recovery program.

Error - 4/7/2009 9:40:40 PM | Computer Name = NEWPC | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 4/10/2009 6:38:45 AM | Computer Name = NEWPC | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 4/12/2009 6:38:46 AM | Computer Name = NEWPC | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

< End of report >

LopR.txt

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.40GHz )
BIOS : BIOS Date: 04/21/04 17:05:39 Ver: 08.00.10
USER : Home ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.5 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:37 Go (Free:3 Go)
D:\ (Local Disk) - NTFS - Total:9 Go (Free:5 Go)
E:\ (Local Disk) - NTFS - Total:19 Go (Free:7 Go)
F:\ (Local Disk) - NTFS - Total:58 Go (Free:21 Go)
G:\ (Local Disk) - NTFS - Total:13 Go (Free:4 Go)
H:\ (Local Disk) - NTFS - Total:9 Go (Free:4 Go)
I:\ (Local Disk) - NTFS - Total:244 Go (Free:174 Go)
J:\ (Local Disk) - NTFS - Total:244 Go (Free:199 Go)
S:\ (CD or DVD)
T:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( Sun 04/12/2009|11:37 )

--------------------\\ Listing folders in APPLIC~1

[04/01/2009|04:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> {00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[02/14/2009|08:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe
[04/28/2008|06:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple
[04/28/2008|06:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer
[04/10/2009|08:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> avg8
[07/21/2008|06:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Crossword Forge
[02/14/2009|09:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> FLEXnet
[04/28/2008|03:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> FRISK Software
[04/08/2009|07:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes
[06/21/2008|07:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft
[07/19/2008|07:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Nero
[06/03/2008|05:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PopCap
[04/10/2009|08:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy
[03/20/2009|05:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TaxCut
[06/01/2008|01:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TomTom
[04/10/2009|07:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Webroot
[01/17/2007|07:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage
[06/22/2008|07:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WinZip

[01/17/2007|07:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

[03/15/2009|01:55] C:\DOCUME~1\Home\APPLIC~1\<DIR> Adobe
[11/13/2008|09:24] C:\DOCUME~1\Home\APPLIC~1\<DIR> AntispywareBot
[03/09/2009|09:09] C:\DOCUME~1\Home\APPLIC~1\<DIR> Apple Computer
[07/21/2008|06:21] C:\DOCUME~1\Home\APPLIC~1\<DIR> Crossword Forge Prefs Folder
[05/09/2008|04:38] C:\DOCUME~1\Home\APPLIC~1\<DIR> DivX
[02/13/2009|06:49] C:\DOCUME~1\Home\APPLIC~1\<DIR> Download Manager
[05/01/2008|11:42] C:\DOCUME~1\Home\APPLIC~1\<DIR> FRISK Software
[06/24/2008|05:08] C:\DOCUME~1\Home\APPLIC~1\<DIR> Help
[04/10/2009|07:48] C:\DOCUME~1\Home\APPLIC~1\<DIR> HouseCall 6.6
[01/17/2007|07:31] C:\DOCUME~1\Home\APPLIC~1\<DIR> Identities
[12/29/2008|11:52] C:\DOCUME~1\Home\APPLIC~1\<DIR> InstallShield
[04/28/2008|04:00] C:\DOCUME~1\Home\APPLIC~1\<DIR> InterVideo
[04/28/2008|03:40] C:\DOCUME~1\Home\APPLIC~1\<DIR> Macromedia
[02/13/2009|06:08] C:\DOCUME~1\Home\APPLIC~1\<DIR> Microsoft
[04/08/2009|05:58] C:\DOCUME~1\Home\APPLIC~1\<DIR> Move Networks
[06/01/2008|01:21] C:\DOCUME~1\Home\APPLIC~1\<DIR> Mozilla
[07/19/2008|07:23] C:\DOCUME~1\Home\APPLIC~1\<DIR> Nero
[07/18/2008|12:06] C:\DOCUME~1\Home\APPLIC~1\<DIR> Roxio
[08/01/2008|10:10] C:\DOCUME~1\Home\APPLIC~1\<DIR> Snapfish
[06/06/2008|04:14] C:\DOCUME~1\Home\APPLIC~1\<DIR> Sun
[03/20/2009|05:26] C:\DOCUME~1\Home\APPLIC~1\<DIR> TaxCut
[06/01/2008|01:21] C:\DOCUME~1\Home\APPLIC~1\<DIR> TomTom
[04/07/2009|09:36] C:\DOCUME~1\Home\APPLIC~1\<DIR> uTorrent
[04/10/2009|07:54] C:\DOCUME~1\Home\APPLIC~1\<DIR> Webroot
[12/29/2008|11:54] C:\DOCUME~1\Home\APPLIC~1\<DIR> Wizards of the Coast

[04/28/2008|05:57] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft

[01/17/2007|07:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[03/31/2009 11:31 PM][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[04/12/2009 11:35 AM][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{8855875C-9E65-4703-9811-6D6ABB107C4B}.job
[04/11/2009 11:47 AM][--ah-----] C:\WINDOWS\tasks\SA.DAT
[08/04/2004 01:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[12/15/2008|07:59] C:\Program Files\<DIR> 3DO
[07/07/2008|04:55] C:\Program Files\<DIR> 7-Zip
[02/14/2009|08:58] C:\Program Files\<DIR> Adobe
[02/14/2009|08:51] C:\Program Files\<DIR> Adobe Media Player
[07/20/2008|04:56] C:\Program Files\<DIR> AoA DVD Creator
[08/07/2008|06:50] C:\Program Files\<DIR> Apple Software Update
[04/10/2009|08:12] C:\Program Files\<DIR> AVG
[04/01/2009|04:32] C:\Program Files\<DIR> Bonjour
[04/08/2009|07:24] C:\Program Files\<DIR> CCleaner
[07/08/2008|04:35] C:\Program Files\<DIR> Combined Community Codec Pack
[04/10/2009|07:54] C:\Program Files\<DIR> Common Files
[01/17/2007|07:23] C:\Program Files\<DIR> ComPlus Applications
[04/28/2008|04:13] C:\Program Files\<DIR> DivX
[01/18/2007|12:33] C:\Program Files\<DIR> DVD
[04/07/2009|10:02] C:\Program Files\<DIR> ERUNT
[01/17/2007|07:33] C:\Program Files\<DIR> Gateway
[05/09/2008|04:41] C:\Program Files\<DIR> Hewlett-Packard
[05/09/2008|04:43] C:\Program Files\<DIR> hp deskjet 5550 series
[12/29/2008|11:54] C:\Program Files\<DIR> InstallShield Installation Information
[01/17/2007|07:40] C:\Program Files\<DIR> Intel
[02/12/2009|04:01] C:\Program Files\<DIR> Internet Explorer
[04/01/2009|04:41] C:\Program Files\<DIR> iPod
[04/01/2009|04:41] C:\Program Files\<DIR> iTunes
[04/08/2009|07:11] C:\Program Files\<DIR> Java
[04/04/2009|12:11] C:\Program Files\<DIR> Learn to Play Bridge
[04/03/2009|11:28] C:\Program Files\<DIR> Learn to Play Bridge 2
[04/08/2009|07:34] C:\Program Files\<DIR> Malwarebytes' Anti-Malware
[08/12/2008|04:53] C:\Program Files\<DIR> Messenger
[04/28/2008|06:01] C:\Program Files\<DIR> Microsoft ActiveSync
[01/17/2007|07:27] C:\Program Files\<DIR> microsoft frontpage
[04/28/2008|06:01] C:\Program Files\<DIR> Microsoft Office
[03/11/2009|03:08] C:\Program Files\<DIR> Microsoft Silverlight
[04/28/2008|06:01] C:\Program Files\<DIR> Microsoft.NET
[07/27/2008|09:12] C:\Program Files\<DIR> Movie Maker
[04/11/2009|12:29] C:\Program Files\<DIR> Mozilla Firefox
[01/17/2007|07:22] C:\Program Files\<DIR> MSN
[01/17/2007|07:23] C:\Program Files\<DIR> MSN Gaming Zone
[07/21/2008|05:04] C:\Program Files\<DIR> MSXML 4.0
[07/19/2008|07:19] C:\Program Files\<DIR> Nero
[04/28/2008|11:11] C:\Program Files\<DIR> Netflix
[07/27/2008|09:08] C:\Program Files\<DIR> NetMeeting
[01/17/2007|07:25] C:\Program Files\<DIR> Online Services
[07/27/2008|09:08] C:\Program Files\<DIR> Outlook Express
[03/20/2009|05:25] C:\Program Files\<DIR> PDF995
[08/14/2008|03:55] C:\Program Files\<DIR> PeerGuardian2
[04/08/2009|10:22] C:\Program Files\<DIR> PowerISO
[04/01/2009|04:29] C:\Program Files\<DIR> QuickTime
[01/18/2007|12:27] C:\Program Files\<DIR> Roxio
[04/10/2009|08:11] C:\Program Files\<DIR> Spybot - Search & Destroy
[03/20/2009|05:26] C:\Program Files\<DIR> TaxCut08
[07/22/2008|07:28] C:\Program Files\<DIR> The Rosetta Stone
[06/01/2008|01:21] C:\Program Files\<DIR> TomTom HOME
[04/07/2009|09:41] C:\Program Files\<DIR> Trend Micro
[01/17/2007|07:31] C:\Program Files\<DIR> Uninstall Information
[06/26/2008|09:00] C:\Program Files\<DIR> uTorrent
[04/10/2009|07:54] C:\Program Files\<DIR> Webroot
[04/28/2008|05:19] C:\Program Files\<DIR> Windows Media Connect 2
[07/27/2008|09:08] C:\Program Files\<DIR> Windows Media Player
[07/27/2008|09:08] C:\Program Files\<DIR> Windows NT
[01/17/2007|07:25] C:\Program Files\<DIR> WindowsUpdate
[04/28/2008|04:08] C:\Program Files\<DIR> WinRAR
[06/22/2008|07:55] C:\Program Files\<DIR> WinZip
[12/29/2008|11:53] C:\Program Files\<DIR> Wizards of the Coast
[01/17/2007|07:27] C:\Program Files\<DIR> xerox
[04/28/2008|04:04] C:\Program Files\<DIR> Xvid

--------------------\\ Listing Folders in C:\Program Files\Common Files

[12/15/2008|08:03] C:\Program Files\Common Files\<DIR> 3DO Shared
[01/18/2007|12:27] C:\Program Files\Common Files\<DIR> Adaptec Shared
[02/14/2009|08:55] C:\Program Files\Common Files\<DIR> Adobe
[02/14/2009|08:45] C:\Program Files\Common Files\<DIR> Adobe AIR
[04/01/2009|04:41] C:\Program Files\Common Files\<DIR> Apple
[04/28/2008|06:01] C:\Program Files\Common Files\<DIR> DESIGNER
[02/13/2009|06:16] C:\Program Files\Common Files\<DIR> InstallShield
[07/07/2008|05:18] C:\Program Files\Common Files\<DIR> Macrovision Shared
[04/28/2008|06:41] C:\Program Files\Common Files\<DIR> Microsoft Shared
[01/17/2007|07:24] C:\Program Files\Common Files\<DIR> MSSoap
[07/19/2008|07:21] C:\Program Files\Common Files\<DIR> Nero
[01/17/2007|02:17] C:\Program Files\Common Files\<DIR> ODBC
[01/17/2007|07:24] C:\Program Files\Common Files\<DIR> Services
[01/17/2007|02:17] C:\Program Files\Common Files\<DIR> SpeechEngines
[07/27/2008|09:08] C:\Program Files\Common Files\<DIR> System
[04/10/2009|07:54] C:\Program Files\Common Files\<DIR> Webroot Shared

--------------------\\ Process

( 42 Processes )

IEXPLORE.EXE ~ [PID:1116]

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-12 11:38:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
disk error: C:\WINDOWS\System32\
please note that you need administrator rights to perform deep scan

--------------------\\ Searching for other infections

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}]
NameServer REG_SZ 85.255.112.115,85.255.112.205
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}]
NameServer REG_SZ 85.255.112.115,85.255.112.205
==> WAREOUT <==

[F:1][D:11]-> C:\DOCUME~1\Home\LOCALS~1\Temp
[F:22][D:0]-> C:\DOCUME~1\Home\Cookies
[F:500][D:20]-> C:\DOCUME~1\Home\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Sun 04/12/2009|11:38 - Option : [1]

--------------------\\ Scan completed at 11:38:53

#6
heir

Posted 12 April 2009 - 12:57 PM

Trusted Helper

Malware Removal
5,427 posts

Let's start remove the malware then.

Step 1.
Unistall unwanted software:

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

µTorrent

Optional removals
µTorrent and P2P programs in general are legal themselves, but much of the content downloaded with them is downloaded illegally. They are also a great way to infect yourself with malware.
It's up to you if you want to remove the above programs, however I recommend you do.

Step 2.
OTL-fix:

Run OTListIt2.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O1 - Hosts: 127.0.0.1 activate.adobe.com
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [] File not found
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/popcaploader_v10.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.115,85.255.112.205
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}\\NameServer = 85.255.112.115,85.255.112.205
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\BitTorrent\bittorrent.exe=-
C:\Program Files\uTorrent\uTorrent.exe=-
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL2 fixlog

Step 3.
OTL-scan:

Download OTListIt2 to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window with OTListIt.Txt that's saved in the same location as OTListIt2.
Please copy (Edit->Select All, Edit->Copy) the contents of that file and post it with your next reply.

Step 4.
Things I would like to see in your reply:

Which P2P softwares were uninstalled in step 1.
The content of the fixlog from OTL2 in step 2.
The content of OTListIt.txt in step 3.
Information on how your computer is running now.

#7
Wondamike7

Posted 12 April 2009 - 02:57 PM

Member

Topic Starter
Member
16 posts

Heir,

Thanks for the continued support. Overall I still have problems, but some stuff is different. My AVG Anti-Virus now updated successfully which wasn't happening before. I didn't run a new scan. The firewall still gets turned off a little after start-up (I re-enable it). The google search links still redirect. And I still can't run the malwarebytes anti-malware software. Clicking on the program executable does nothing. I did uninstall uTorrent.

Here are the logs:
fixlog

========== OTLISTIT ==========
Process explorer.exe killed successfully!
127.0.0.1 activate.adobe.com removed from HOSTS file successfully
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Starting removal of ActiveX control {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
C:\WINDOWS\Downloaded Program Files\popcaploader.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\\NameServer| /E : value set successfully!
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FF67A87B-3E11-422B-AF24-EDE1C2E4FC1D}\\NameServer| /E : value set successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\BitTorrent\bittorrent.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\uTorrent\uTorrent.exe not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Home\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2fc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTListIt2 by OldTimer - Version 2.0.12.1 log created on 04122009_164546

Files moved on Reboot...
File C:\WINDOWS\temp\Perflib_Perfdata_2fc.dat not found!

Registry entries deleted on Reboot...

OTListIt.txt
OTListIt logfile created on: 4/12/2009 4:49:59 PM - Run 3
OTListIt2 by OldTimer - Version 2.0.12.1 Folder = C:\Documents and Settings\Home\Desktop\Fix Comp
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.72 Mb Total Physical Memory | 513.87 Mb Available Physical Memory | 50.25% Memory free
2.03 Gb Paging File | 1.62 Gb Available in Paging File | 79.70% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 3.53 Gb Free Space | 9.48% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.51 Gb Free Space | 55.15% Space Free | Partition Type: NTFS
Drive E: | 19.53 Gb Total Space | 7.26 Gb Free Space | 37.17% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 21.17 Gb Free Space | 36.12% Space Free | Partition Type: NTFS
Drive G: | 13.90 Gb Total Space | 4.11 Gb Free Space | 29.59% Space Free | Partition Type: NTFS
Drive H: | 9.77 Gb Total Space | 4.68 Gb Free Space | 47.96% Space Free | Partition Type: NTFS
Drive I: | 244.14 Gb Total Space | 174.24 Gb Free Space | 71.37% Space Free | Partition Type: NTFS
Drive J: | 244.14 Gb Total Space | 199.06 Gb Free Space | 81.53% Space Free | Partition Type: NTFS

Computer Name: NEWPC
Current User Name: Home
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.)
PRC - C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
PRC - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Documents and Settings\Home\Desktop\Fix Comp\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Nero BackItUp Scheduler 3 [Auto | Running]) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NMIndexingService [On_Demand | Running]) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PLFlash DeviceIoControl Service [Auto | Running]) -- C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.)
SRV - (WMPNetworkSvc [Auto | Running]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (wwEngineSvc [Auto | Running]) -- C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)

========== Driver Services (SafeList) ==========

DRV - (adfs [Auto | Running]) -- C:\WINDOWS\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (AvgLdx86 [System | Running]) -- C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) -- C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Cdr4_xp [System | Running]) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (Cdralw2k [System | Running]) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (cdudf_xp [System | Running]) -- C:\WINDOWS\System32\drivers\cdudf_xp.sys (Roxio)
DRV - (dvd_2K [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\Dvd_2k.sys (Roxio)
DRV - (E1000 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\e1000325.sys (Intel Corporation)
DRV - (es1371 [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (mmc_2K [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\Mmc_2k.sys (Roxio)
DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (pgfilter [On_Demand | Stopped]) -- C:\Program Files\PeerGuardian2\pgfilter.sys ()
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (pwd_2k [System | Running]) -- C:\WINDOWS\System32\drivers\pwd_2K.sys (Roxio)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (sbpci [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\sbpci.sys (Creative Technology Ltd.)
DRV - (SCDEmu [System | Running]) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SI3112 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3112.sys (Silicon Image, Inc.)
DRV - (SI3112r [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3112r.sys (Silicon Image, Inc)
DRV - (SI3124 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SI3124.sys (Silicon Image, Inc.)
DRV - (Si3124r5 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\Si3124r5.sys (Silicon Image, Inc)
DRV - (SiFilter [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (SiRemFil [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (tmcomm [Auto | Running]) -- C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (UdfReadr_xp [System | Running]) -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys (Roxio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {44d0a1b4-9c90-4f86-ac92-8680b5d6549e}:0.6.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8

FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/04/08 07:15:18 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\PROGRAM FILES\AVG\AVG8\FIREFOX [2009/04/10 20:12:49 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/10 19:53:09 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/10 19:53:09 | 00,000,000 | ---D | M]

[2009/02/12 18:05:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions
[2009/02/12 18:05:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2008/06/01 13:21:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Extensions\[email protected]
[2009/04/10 20:20:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Firefox\Profiles\hmppqini.default\extensions
[2008/08/19 16:00:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Home\Application Data\mozilla\Firefox\Profiles\hmppqini.default\extensions\{44d0a1b4-9c90-4f86-ac92-8680b5d6549e}
[2009/04/10 20:20:25 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/04/10 19:53:02 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/12/07 11:38:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/04/08 07:15:35 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/04/10 19:53:02 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/10 19:53:02 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/01/19 19:28:04 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/01/19 19:28:04 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/01/19 19:28:04 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/01/19 19:28:04 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/01/19 19:28:04 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/01/19 19:28:04 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/01/19 19:28:04 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (1474 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" (Adobe Systems Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 (Nero AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://zone.msn.com/...UI.cab55579.cab (StagingUI Object)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} http://zone.msn.com/...dy.cab55579.cab (MSN Games – Buddy Invite)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish...fishActivia.cab (Snapfish Activia)
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} http://zone.msn.com/...at.cab55579.cab (ZonePAChat Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1169077447250 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1209421641203 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} http://zone.msn.com/...he.cab75406.cab (MSN Games – Texas Holdem Poker)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.ma...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} http://zone.msn.com/...xy.cab55579.cab (MSN Games – Game Communicator)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\WINDOWS\system32\acaptuser32.dll (Adobe Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\system32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - I:\Autograph [2008/08/04 13:27:10 | 00,000,000 | ---D | M] - [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[5 C:\WINDOWS\*.tmp files]
[2009/04/12 16:45:46 | 00,000,000 | ---D | C] -- C:\_OTListIt
[2009/04/12 11:37:21 | 00,000,000 | ---D | C] -- C:\Lop SD
[2009/04/10 20:47:16 | 00,000,000 | -H-D | C] -- C:\$AVG8.VAULT$
[2009/04/10 20:24:19 | 02,348,416 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\FixDwndp.exe
[2009/04/10 20:13:13 | 00,108,552 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/04/10 20:13:13 | 00,010,520 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/04/10 20:13:13 | 00,001,517 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk
[2009/04/10 20:13:08 | 00,325,640 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/04/10 20:13:07 | 00,027,656 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/04/10 20:13:03 | 35,064,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/04/10 20:13:03 | 06,061,540 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/04/10 20:13:03 | 00,401,372 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/04/10 20:13:03 | 00,093,231 | ---- | C] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/04/10 20:13:03 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\Avg
[2009/04/10 20:12:49 | 00,000,000 | ---D | C] -- C:\Program Files\AVG
[2009/04/10 20:12:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg8
[2009/04/10 20:09:43 | 63,049,904 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Home\Desktop\avg_free_stf_en_85_285a1462.exe
[2009/04/10 19:54:39 | 00,001,606 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\Window Washer.lnk
[2009/04/10 19:54:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\Webroot
[2009/04/10 19:54:34 | 00,000,000 | ---D | C] -- C:\Program Files\Webroot
[2009/04/10 19:54:34 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Webroot Shared
[2009/04/10 19:54:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Webroot
[2009/04/10 19:54:31 | 00,196,424 | ---- | C] (Webroot Software, Inc.) -- C:\WINDOWS\Unwash6.exe
[2009/04/10 19:54:12 | 03,886,408 | ---- | C] (Webroot Software, Inc.) -- C:\Documents and Settings\Home\Desktop\WindowWasherTrialSetup.exe
[2009/04/10 11:57:55 | 00,138,384 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2009/04/10 01:31:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\HouseCall 6.6
[2009/04/08 07:34:29 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/08 07:34:27 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/08 07:34:26 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/04/08 07:34:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/04/08 07:32:02 | 01,340,961 | ---- | C] () -- C:\MGtools.exe
[2009/04/08 07:29:30 | 00,000,000 | ---D | C] -- C:\Malware Removal
[2009/04/08 07:24:13 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/04/08 07:16:04 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009/04/07 22:13:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Desktop\Fix Comp
[2009/04/07 22:04:09 | 00,000,000 | ---D | C] -- C:\Rooter$
[2009/04/07 22:02:36 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/04/07 22:02:20 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/04/07 21:41:37 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/04/03 23:28:11 | 00,001,684 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge 2.lnk
[2009/04/03 23:28:10 | 00,000,000 | ---D | C] -- C:\Program Files\Learn to Play Bridge 2
[2009/04/03 23:28:03 | 00,001,634 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge.lnk
[2009/04/03 23:28:02 | 00,286,720 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun506.exe
[2009/04/03 23:28:02 | 00,000,000 | ---D | C] -- C:\Program Files\Learn to Play Bridge
[2009/04/01 16:41:33 | 00,000,000 | ---D | C] -- C:\Program Files\iPod
[2009/04/01 16:41:24 | 00,000,000 | ---D | C] -- C:\Program Files\iTunes
[2009/04/01 16:41:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/04/01 16:32:23 | 00,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2009/04/01 16:28:51 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2009/03/20 18:59:56 | 00,388,760 | ---- | C] () -- C:\Documents and Settings\Home\Desktop\08_540nrlong.pdf
[2009/03/20 17:26:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\Application Data\TaxCut
[2009/03/20 17:26:22 | 00,001,634 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\H&R Block TaxCut 2008.lnk
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Program Files\TaxCut08
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Program Files\PDF995
[2009/03/20 17:25:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Home\My Documents\TaxCut
[2009/03/20 17:24:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2009/03/20 17:23:22 | 00,000,000 | -HSD | C] -- C:\WINDOWS\ftpcache
[2009/03/17 17:34:38 | 00,000,000 | ---D | C] -- C:\Netgear
[2009/03/14 14:52:44 | 00,111,992 | ---- | C] (Adobe Systems, Inc.) -- C:\WINDOWS\System32\acaptuser32.dll
[2008/07/20 23:02:50 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/04/28 18:01:47 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/04/28 16:04:03 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/04/28 16:04:02 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/03/31 17:25:46 | 00,831,488 | ---- | C] () -- C:\WINDOWS\System32\divx_xx0a.dll
[2008/03/21 16:30:08 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/03/21 16:28:54 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/03/21 16:28:54 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008/03/21 16:28:20 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/01/17 19:37:02 | 00,126,976 | R--- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2004/08/04 01:00:00 | 00,000,507 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/04 01:00:00 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[53 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[2009/04/12 16:50:17 | 00,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{8855875C-9E65-4703-9811-6D6ABB107C4B}.job
[2009/04/12 16:49:13 | 35,064,464 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/04/12 16:48:39 | 00,093,231 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/04/12 16:47:02 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/04/12 16:46:57 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/04/12 16:46:51 | 10,724,76160 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/12 16:45:46 | 00,001,474 | RH-- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/04/10 20:24:19 | 02,348,416 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\FixDwndp.exe
[2009/04/10 20:13:13 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/04/10 20:13:13 | 00,010,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/04/10 20:13:13 | 00,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 8.5.lnk
[2009/04/10 20:13:08 | 00,325,640 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/04/10 20:13:07 | 00,027,656 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/04/10 20:13:03 | 06,061,540 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/04/10 20:13:03 | 00,401,372 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/04/10 20:10:54 | 63,049,904 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Home\Desktop\avg_free_stf_en_85_285a1462.exe
[2009/04/10 19:54:39 | 00,001,606 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Window Washer.lnk
[2009/04/10 19:54:21 | 03,886,408 | ---- | M] (Webroot Software, Inc.) -- C:\Documents and Settings\Home\Desktop\WindowWasherTrialSetup.exe
[2009/04/08 07:32:03 | 01,340,961 | ---- | M] () -- C:\MGtools.exe
[2009/04/07 21:32:39 | 00,000,231 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/06 15:32:54 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/04/06 15:32:46 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/04/05 18:44:55 | 06,991,872 | ---- | M] () -- C:\Documents and Settings\Home\My Documents\MOVIES.mdb
[2009/04/03 23:28:11 | 00,001,684 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge 2.lnk
[2009/04/03 23:28:07 | 00,286,720 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun506.exe
[2009/04/03 23:28:03 | 00,001,634 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Learn to Play Bridge.lnk
[2009/04/03 23:19:14 | 00,081,920 | ---- | M] () -- C:\Documents and Settings\Home\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/03 22:35:38 | 00,262,144 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\Finances_new.xls
[2009/04/03 22:11:57 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/04/01 17:00:11 | 00,022,272 | ---- | M] () -- C:\Documents and Settings\Home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/03/31 23:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/03/25 18:53:10 | 02,001,704 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/25 18:52:55 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/03/20 20:31:31 | 00,000,532 | ---- | M] () -- C:\hpfr5550.xml
[2009/03/20 18:59:56 | 00,388,760 | ---- | M] () -- C:\Documents and Settings\Home\Desktop\08_540nrlong.pdf
[2009/03/20 17:26:22 | 00,001,634 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\H&R Block TaxCut 2008.lnk
< End of report >

#8
heir

Posted 12 April 2009 - 06:12 PM

Trusted Helper

Malware Removal
5,427 posts

We're making progress.
Let's move on

Step 1.
OTL-fix:

Run OTListIt2.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
:Files
C:\DOCUME~1\Home\APPLIC~1\<DIR> uTorrent
C:\Program Files\<DIR> uTorrent
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL2 fixlog

Step 2.
Gooredfix-scan:

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Double-click GooredFix.exe to run it.
Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: Do not run Option #2 yet.

Step 3.
ComboFix:

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Step 4.
Things I would like to see in your reply:

The content of the fixlog from OTL2 in step 1.
The content of GooredLog.txt from step 2.
The content of C:\ComboFix.txt from step 3.

#9
Wondamike7

Posted 12 April 2009 - 09:17 PM

Member

Topic Starter
Member
16 posts

Thanks so much for the help. It seems like things are working right now, everything I tested that wasn't working before is now working. I've posted the logs, please let me know if there is anything else I should do. And, once again, THANKS!!!

Fixlog:
========== OTLISTIT ==========
Process explorer.exe killed successfully!
========== FILES ==========
File/Folder C:\DOCUME~1\Home\APPLIC~1\<DIR> uTorrent not found.
File/Folder C:\Program Files\<DIR> uTorrent not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Home\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_124.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTListIt2 by OldTimer - Version 2.0.12.1 log created on 04122009_225140

Files moved on Reboot...
File C:\WINDOWS\temp\Perflib_Perfdata_124.dat not found!

Registry entries deleted on Reboot...

GooredLog.txt:
GooredFix v1.92 by jpshortstuff
Log created at 22:54 on 12/04/2009 running Option #1 (Home)
Firefox version 3.0.8 (en-US)

=====Suspect Goored Entries=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.8\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.8\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[email protected]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

ComboFix.txt:
ComboFix 09-04-13.07 - Home 2009-04-12 23:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.680 [GMT -4:00]
Running from: c:\documents and settings\Home\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Home\Application Data\AntispywareBot
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\acaptuser32.dll
c:\windows\system32\drivers\gaopdxmnethesbxwpmpuwqxjkddviellooxxyy.sys
c:\windows\system32\gaopdxcounter
c:\windows\system32\gaopdxuwkmovdnqyacpmbpxnrwxymepxysmfbh.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gaopdxserv.sys

((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-12 20:45 . 2009-04-12 20:45 -------- d-----w C:\_OTListIt
2009-04-12 15:37 . 2009-04-12 15:38 -------- d-----w C:\Lop SD
2009-04-11 00:47 . 2009-04-11 15:44 -------- d--h--w C:\$AVG8.VAULT$
2009-04-11 00:13 . 2009-04-11 00:13 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-11 00:13 . 2009-04-11 00:13 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-04-11 00:13 . 2009-04-11 00:13 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-11 00:13 . 2009-04-12 20:49 -------- d-----w c:\windows\system32\drivers\Avg
2009-04-11 00:12 . 2009-04-11 00:12 -------- d-----w c:\program files\AVG
2009-04-11 00:12 . 2009-04-11 00:12 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\documents and settings\Home\Application Data\Webroot
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\program files\Common Files\Webroot Shared
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\program files\Webroot
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\documents and settings\All Users\Application Data\Webroot
2009-04-10 23:54 . 2007-10-03 13:27 196424 ----a-w c:\windows\Unwash6.exe
2009-04-10 15:57 . 2007-12-24 21:37 138384 ----a-w c:\windows\system32\drivers\tmcomm.sys
2009-04-10 05:31 . 2009-04-10 23:48 -------- d-----w c:\documents and settings\Home\Application Data\HouseCall 6.6
2009-04-08 11:34 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-08 11:34 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-08 11:34 . 2009-04-08 11:34 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 11:34 . 2009-04-08 11:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-08 11:32 . 2009-04-08 11:32 1340961 ----a-w C:\MGtools.exe
2009-04-08 11:29 . 2009-04-08 11:32 -------- d-----w C:\Malware Removal
2009-04-08 11:24 . 2009-04-08 11:24 -------- d-----w c:\program files\CCleaner
2009-04-08 11:15 . 2009-04-08 11:15 73728 ----a-w c:\windows\system32\javacpl.cpl
2009-04-08 02:04 . 2009-04-08 02:04 -------- d-----w C:\Rooter$
2009-04-08 02:02 . 2009-04-08 02:02 -------- d-----w c:\program files\ERUNT
2009-04-08 01:41 . 2009-04-08 01:41 -------- d-----w c:\program files\Trend Micro
2009-04-04 03:28 . 2009-04-04 03:28 -------- d-----w c:\program files\Learn to Play Bridge 2
2009-04-04 03:28 . 2009-04-04 04:11 -------- d-----w c:\program files\Learn to Play Bridge
2009-04-04 03:28 . 2009-04-04 03:28 286720 ----a-w c:\windows\iun506.exe
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\program files\iPod
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\program files\iTunes
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-04-01 20:32 . 2009-04-01 20:32 -------- d-----w c:\program files\Bonjour
2009-04-01 20:28 . 2009-04-01 20:29 -------- d-----w c:\program files\QuickTime
2009-03-20 21:26 . 2009-03-20 21:26 -------- d-----w c:\documents and settings\Home\Application Data\TaxCut
2009-03-20 21:25 . 2009-03-20 21:26 -------- d-----w c:\program files\TaxCut08
2009-03-20 21:25 . 2009-03-20 21:25 -------- d-----w c:\program files\PDF995
2009-03-20 21:24 . 2009-03-20 21:24 -------- d-----w c:\documents and settings\All Users\Application Data\TaxCut
2009-03-20 21:23 . 2009-03-20 21:23 -------- d-sh--w c:\windows\ftpcache
2009-03-17 21:34 . 2009-03-17 21:45 -------- d-----w C:\Netgear

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 20:43 . 2008-06-27 01:00 -------- d-----w c:\documents and settings\Home\Application Data\uTorrent
2009-04-12 15:39 . 2009-04-12 15:37 12877 ----a-w C:\lopR.txt
2009-04-11 00:11 . 2008-11-13 12:41 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-11 00:11 . 2008-07-16 21:52 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-08 21:58 . 2008-10-21 22:49 -------- d-----w c:\documents and settings\Home\Application Data\Move Networks
2009-04-08 14:22 . 2008-06-19 20:47 -------- d-----w c:\program files\PowerISO
2009-04-08 11:15 . 2008-12-07 15:38 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-08 11:11 . 2008-06-06 20:13 -------- d-----w c:\program files\Java
2009-04-08 02:04 . 2009-04-08 02:04 3290 ----a-w C:\Rooter.txt
2009-04-01 21:00 . 2007-01-18 00:18 22272 ----a-w c:\documents and settings\Home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 20:41 . 2008-04-28 22:52 -------- d-----w c:\program files\Common Files\Apple
2009-03-21 00:31 . 2008-05-22 23:18 532 ----a-w C:\hpfr5550.xml
2009-03-21 00:31 . 2008-05-22 23:18 25887 ----a-w C:\hpfr5550.log
2009-03-11 07:08 . 2008-04-28 22:23 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-10 01:09 . 2008-04-28 22:55 -------- d-----w c:\documents and settings\Home\Application Data\Apple Computer
2009-02-14 13:07 . 2009-02-14 13:07 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-02-14 12:55 . 2008-05-07 20:54 -------- d-----w c:\program files\Common Files\Adobe
2009-02-14 12:51 . 2009-02-14 12:51 -------- d-----w c:\program files\Adobe Media Player
2009-02-14 12:45 . 2009-02-14 12:45 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-13 22:49 . 2009-02-13 22:23 -------- d-----w c:\documents and settings\Home\Application Data\Download Manager
2009-02-13 22:16 . 2007-01-17 23:40 -------- d-----w c:\program files\Common Files\InstallShield
2009-02-09 11:13 . 2004-08-04 05:00 1846784 ----a-w c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-07-19 684032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-09 188416]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-02-27 38768]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-02-27 640376]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-08 148888]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-10 1932568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-10 20:13 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=acaptuser32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

S0 SI3112r;Silicon Image SiI 3512 SATARaid Controller;c:\windows\system32\DRIVERS\SI3112r.sys [2007-08-29 116264]
S0 SI3124;SiI-3124 SATALink Controller;c:\windows\system32\DRIVERS\SI3124.sys [2006-11-02 76208]
S0 Si3124r5;SiI-3124 SoftRaid 5 Controller;c:\windows\system32\DRIVERS\Si3124r5.sys [2006-09-19 207152]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-10 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-10 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-10 908056]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-10 298264]
S2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2007-10-03 598856]

.
Contents of the 'Scheduled Tasks' folder

2009-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-04-13 c:\windows\Tasks\User_Feed_Synchronization-{8855875C-9E65-4703-9811-6D6ABB107C4B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeBridge - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Home\Application Data\Mozilla\Firefox\Profiles\hmppqini.default\
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-12 23:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2009-04-12 23:08
ComboFix-quarantined-files.txt 2009-04-13 03:07

Pre-Run: 3,745,796,096 bytes free
Post-Run: 3,733,467,136 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

187 --- E O F --- 2009-03-13 07:02

#10
heir

Posted 13 April 2009 - 03:27 AM

Trusted Helper

Malware Removal
5,427 posts

Glad that your computer is functioning better.

There is a file though i need you to upload for analysis.

Open notepad and copy/paste the text in the codebox below into it:

http://www.geekstogo.com/forum/Malware-infection-redirects-google-links-can-t-run-spybot-canand-t234865.html

Suspect::
C:\Qoobox\Quarantine\c\windows\system32\acaptuser32.dll.vir
c:\windows\system32\acaptuser32.dll

Save this as CFScript.txt

Posted Image

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

Let me know when you've succeeded to submit.

Edited by heir, 13 April 2009 - 03:27 AM.

#11
Wondamike7

Posted 13 April 2009 - 06:16 AM

Member

Topic Starter
Member
16 posts

I was able to successfully upload the files through ComboFix.

I don't know if you need it, but here's the CF log again.

Thanks!

ComboFix 09-04-13.A2 - Home 2009-04-13 8:06.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.574 [GMT -4:00]
Running from: c:\documents and settings\Home\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Home\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-13 03:15 . 2009-04-13 03:15 -------- d-----w c:\documents and settings\Home\Application Data\Malwarebytes
2009-04-12 20:45 . 2009-04-12 20:45 -------- d-----w C:\_OTListIt
2009-04-12 15:37 . 2009-04-12 15:38 -------- d-----w C:\Lop SD
2009-04-11 00:47 . 2009-04-11 15:44 -------- d--h--w C:\$AVG8.VAULT$
2009-04-11 00:13 . 2009-04-11 00:13 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-11 00:13 . 2009-04-11 00:13 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-04-11 00:13 . 2009-04-11 00:13 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-11 00:13 . 2009-04-12 20:49 -------- d-----w c:\windows\system32\drivers\Avg
2009-04-11 00:12 . 2009-04-11 00:12 -------- d-----w c:\program files\AVG
2009-04-11 00:12 . 2009-04-11 00:12 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\documents and settings\Home\Application Data\Webroot
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\program files\Common Files\Webroot Shared
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\program files\Webroot
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\documents and settings\All Users\Application Data\Webroot
2009-04-10 23:54 . 2007-10-03 13:27 196424 ----a-w c:\windows\Unwash6.exe
2009-04-10 15:57 . 2007-12-24 21:37 138384 ----a-w c:\windows\system32\drivers\tmcomm.sys
2009-04-10 05:31 . 2009-04-10 23:48 -------- d-----w c:\documents and settings\Home\Application Data\HouseCall 6.6
2009-04-08 11:34 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-08 11:34 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-08 11:34 . 2009-04-08 11:34 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 11:34 . 2009-04-08 11:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-08 11:32 . 2009-04-08 11:32 1340961 ----a-w C:\MGtools.exe
2009-04-08 11:29 . 2009-04-08 11:32 -------- d-----w C:\Malware Removal
2009-04-08 11:24 . 2009-04-08 11:24 -------- d-----w c:\program files\CCleaner
2009-04-08 11:15 . 2009-04-08 11:15 73728 ----a-w c:\windows\system32\javacpl.cpl
2009-04-08 02:04 . 2009-04-08 02:04 -------- d-----w C:\Rooter$
2009-04-08 02:02 . 2009-04-08 02:02 -------- d-----w c:\program files\ERUNT
2009-04-08 01:41 . 2009-04-08 01:41 -------- d-----w c:\program files\Trend Micro
2009-04-04 03:28 . 2009-04-04 03:28 -------- d-----w c:\program files\Learn to Play Bridge 2
2009-04-04 03:28 . 2009-04-04 04:11 -------- d-----w c:\program files\Learn to Play Bridge
2009-04-04 03:28 . 2009-04-04 03:28 286720 ----a-w c:\windows\iun506.exe
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\program files\iPod
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\program files\iTunes
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-04-01 20:32 . 2009-04-01 20:32 -------- d-----w c:\program files\Bonjour
2009-04-01 20:28 . 2009-04-01 20:29 -------- d-----w c:\program files\QuickTime
2009-03-20 21:26 . 2009-03-20 21:26 -------- d-----w c:\documents and settings\Home\Application Data\TaxCut
2009-03-20 21:25 . 2009-03-20 21:26 -------- d-----w c:\program files\TaxCut08
2009-03-20 21:25 . 2009-03-20 21:25 -------- d-----w c:\program files\PDF995
2009-03-20 21:24 . 2009-03-20 21:24 -------- d-----w c:\documents and settings\All Users\Application Data\TaxCut
2009-03-20 21:23 . 2009-03-20 21:23 -------- d-sh--w c:\windows\ftpcache
2009-03-17 21:34 . 2009-03-17 21:45 -------- d-----w C:\Netgear

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 20:43 . 2008-06-27 01:00 -------- d-----w c:\documents and settings\Home\Application Data\uTorrent
2009-04-12 15:39 . 2009-04-12 15:37 12877 ----a-w C:\lopR.txt
2009-04-11 00:11 . 2008-11-13 12:41 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-11 00:11 . 2008-07-16 21:52 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-08 21:58 . 2008-10-21 22:49 -------- d-----w c:\documents and settings\Home\Application Data\Move Networks
2009-04-08 14:22 . 2008-06-19 20:47 -------- d-----w c:\program files\PowerISO
2009-04-08 11:15 . 2008-12-07 15:38 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-08 11:11 . 2008-06-06 20:13 -------- d-----w c:\program files\Java
2009-04-08 02:04 . 2009-04-08 02:04 3290 ----a-w C:\Rooter.txt
2009-04-01 21:00 . 2007-01-18 00:18 22272 ----a-w c:\documents and settings\Home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 20:41 . 2008-04-28 22:52 -------- d-----w c:\program files\Common Files\Apple
2009-03-21 00:31 . 2008-05-22 23:18 532 ----a-w C:\hpfr5550.xml
2009-03-21 00:31 . 2008-05-22 23:18 25887 ----a-w C:\hpfr5550.log
2009-03-11 07:08 . 2008-04-28 22:23 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-10 01:09 . 2008-04-28 22:55 -------- d-----w c:\documents and settings\Home\Application Data\Apple Computer
2009-02-14 13:07 . 2009-02-14 13:07 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-02-14 12:55 . 2008-05-07 20:54 -------- d-----w c:\program files\Common Files\Adobe
2009-02-14 12:51 . 2009-02-14 12:51 -------- d-----w c:\program files\Adobe Media Player
2009-02-14 12:45 . 2009-02-14 12:45 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-13 22:49 . 2009-02-13 22:23 -------- d-----w c:\documents and settings\Home\Application Data\Download Manager
2009-02-13 22:16 . 2007-01-17 23:40 -------- d-----w c:\program files\Common Files\InstallShield
2009-02-09 11:13 . 2004-08-04 05:00 1846784 ----a-w c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-04-12_23.06.57.65 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-13 11:56 . 2009-04-13 11:56 16384 c:\windows\Temp\Perflib_Perfdata_c8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-07-19 684032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-09 188416]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-02-27 38768]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-02-27 640376]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-08 148888]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-10 1932568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-10 20:13 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=acaptuser32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

S0 SI3112r;Silicon Image SiI 3512 SATARaid Controller;c:\windows\system32\DRIVERS\SI3112r.sys [2007-08-29 116264]
S0 SI3124;SiI-3124 SATALink Controller;c:\windows\system32\DRIVERS\SI3124.sys [2006-11-02 76208]
S0 Si3124r5;SiI-3124 SoftRaid 5 Controller;c:\windows\system32\DRIVERS\Si3124r5.sys [2006-09-19 207152]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-10 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-10 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-10 908056]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-10 298264]
S2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2007-10-03 598856]

.
Contents of the 'Scheduled Tasks' folder

2009-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-04-13 c:\windows\Tasks\User_Feed_Synchronization-{8855875C-9E65-4703-9811-6D6ABB107C4B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Home\Application Data\Mozilla\Firefox\Profiles\hmppqini.default\
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 08:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(1576)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-04-13 8:12
ComboFix-quarantined-files.txt 2009-04-13 12:12
ComboFix2.txt 2009-04-13 03:08

Pre-Run: 3,799,912,448 bytes free
Post-Run: 3,791,314,944 bytes free

173 --- E O F --- 2009-03-13 07:02

#12
heir

Posted 14 April 2009 - 07:53 AM

Trusted Helper

Malware Removal
5,427 posts

Hmm.. as I suspected that file was legit. We need to put it back again.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the codebox below into it:

FCopy::
C:\Qoobox\Quarantine\c\windows\system32\acaptuser32.dll.vir.vir | c:\windows\system32\acaptuser32.dll
Filelook::
c:\windows\system32\acaptuser32.dll

Save this as CFScript.txt, in the same location as ComboFix.exe

Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your reply.

#13
Wondamike7

Posted 14 April 2009 - 12:12 PM

Member

Topic Starter
Member
16 posts

Heir,

Thanks again for the help. I ran the CFScript in ComboFix. Here's the log:

ComboFix 09-04-14.09 - Home 04/14/2009 14:01.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.563 [GMT -4:00]
Running from: c:\documents and settings\Home\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Home\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.

2009-04-13 03:15 . 2009-04-13 03:15 -------- d-----w c:\documents and settings\Home\Application Data\Malwarebytes
2009-04-12 20:45 . 2009-04-12 20:45 -------- d-----w C:\_OTListIt
2009-04-12 15:37 . 2009-04-12 15:38 -------- d-----w C:\Lop SD
2009-04-11 00:47 . 2009-04-11 15:44 -------- d--h--w C:\$AVG8.VAULT$
2009-04-11 00:13 . 2009-04-11 00:13 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-11 00:13 . 2009-04-11 00:13 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-04-11 00:13 . 2009-04-11 00:13 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-11 00:13 . 2009-04-14 11:58 -------- d-----w c:\windows\system32\drivers\Avg
2009-04-11 00:12 . 2009-04-11 00:12 -------- d-----w c:\program files\AVG
2009-04-11 00:12 . 2009-04-11 00:12 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\documents and settings\Home\Application Data\Webroot
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\program files\Common Files\Webroot Shared
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\program files\Webroot
2009-04-10 23:54 . 2009-04-10 23:54 -------- d-----w c:\documents and settings\All Users\Application Data\Webroot
2009-04-10 23:54 . 2007-10-03 13:27 196424 ----a-w c:\windows\Unwash6.exe
2009-04-10 15:57 . 2007-12-24 21:37 138384 ----a-w c:\windows\system32\drivers\tmcomm.sys
2009-04-10 05:31 . 2009-04-10 23:48 -------- d-----w c:\documents and settings\Home\Application Data\HouseCall 6.6
2009-04-08 11:34 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-08 11:34 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-08 11:34 . 2009-04-08 11:34 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 11:34 . 2009-04-08 11:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-08 11:32 . 2009-04-08 11:32 1340961 ----a-w C:\MGtools.exe
2009-04-08 11:29 . 2009-04-08 11:32 -------- d-----w C:\Malware Removal
2009-04-08 11:24 . 2009-04-08 11:24 -------- d-----w c:\program files\CCleaner
2009-04-08 11:15 . 2009-04-08 11:15 73728 ----a-w c:\windows\system32\javacpl.cpl
2009-04-08 02:04 . 2009-04-08 02:04 -------- d-----w C:\Rooter$
2009-04-08 02:02 . 2009-04-08 02:02 -------- d-----w c:\program files\ERUNT
2009-04-08 01:41 . 2009-04-08 01:41 -------- d-----w c:\program files\Trend Micro
2009-04-04 03:28 . 2009-04-04 03:28 -------- d-----w c:\program files\Learn to Play Bridge 2
2009-04-04 03:28 . 2009-04-04 04:11 -------- d-----w c:\program files\Learn to Play Bridge
2009-04-04 03:28 . 2009-04-04 03:28 286720 ----a-w c:\windows\iun506.exe
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\program files\iPod
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\program files\iTunes
2009-04-01 20:41 . 2009-04-01 20:41 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-04-01 20:32 . 2009-04-01 20:32 -------- d-----w c:\program files\Bonjour
2009-04-01 20:28 . 2009-04-01 20:29 -------- d-----w c:\program files\QuickTime
2009-03-20 21:26 . 2009-03-20 21:26 -------- d-----w c:\documents and settings\Home\Application Data\TaxCut
2009-03-20 21:25 . 2009-03-20 21:26 -------- d-----w c:\program files\TaxCut08
2009-03-20 21:25 . 2009-03-20 21:25 -------- d-----w c:\program files\PDF995
2009-03-20 21:24 . 2009-03-20 21:24 -------- d-----w c:\documents and settings\All Users\Application Data\TaxCut
2009-03-20 21:23 . 2009-03-20 21:23 -------- d-sh--w c:\windows\ftpcache
2009-03-17 21:34 . 2009-03-17 21:45 -------- d-----w C:\Netgear

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 20:43 . 2008-06-27 01:00 -------- d-----w c:\documents and settings\Home\Application Data\uTorrent
2009-04-12 15:39 . 2009-04-12 15:37 12877 ----a-w C:\lopR.txt
2009-04-11 00:11 . 2008-11-13 12:41 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-11 00:11 . 2008-07-16 21:52 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-08 21:58 . 2008-10-21 22:49 -------- d-----w c:\documents and settings\Home\Application Data\Move Networks
2009-04-08 14:22 . 2008-06-19 20:47 -------- d-----w c:\program files\PowerISO
2009-04-08 11:15 . 2008-12-07 15:38 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-08 11:11 . 2008-06-06 20:13 -------- d-----w c:\program files\Java
2009-04-08 02:04 . 2009-04-08 02:04 3290 ----a-w C:\Rooter.txt
2009-04-01 21:00 . 2007-01-18 00:18 22272 ----a-w c:\documents and settings\Home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 20:41 . 2008-04-28 22:52 -------- d-----w c:\program files\Common Files\Apple
2009-03-21 00:31 . 2008-05-22 23:18 532 ----a-w C:\hpfr5550.xml
2009-03-21 00:31 . 2008-05-22 23:18 25887 ----a-w C:\hpfr5550.log
2009-03-11 07:08 . 2008-04-28 22:23 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-10 01:09 . 2008-04-28 22:55 -------- d-----w c:\documents and settings\Home\Application Data\Apple Computer
2009-02-14 13:07 . 2009-02-14 13:07 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-02-14 12:55 . 2008-05-07 20:54 -------- d-----w c:\program files\Common Files\Adobe
2009-02-14 12:51 . 2009-02-14 12:51 -------- d-----w c:\program files\Adobe Media Player
2009-02-14 12:45 . 2009-02-14 12:45 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-13 22:49 . 2009-02-13 22:23 -------- d-----w c:\documents and settings\Home\Application Data\Download Manager
2009-02-13 22:16 . 2007-01-17 23:40 -------- d-----w c:\program files\Common Files\InstallShield
2009-02-09 11:13 . 2004-08-04 05:00 1846784 ----a-w c:\windows\system32\win32k.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\acaptuser32.dll -- Invalid filepath or file no longer exist

((((((((((((((((((((((((((((( SnapShot@2009-04-12_23.06.57.65 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-14 11:56 . 2009-04-14 11:56 16384 c:\windows\Temp\Perflib_Perfdata_1f4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-07-19 684032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 188416]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-02-27 38768]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-02-27 640376]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-04 111936]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-08 148888]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-11 1932568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-11 00:13 10520 ----a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=acaptuser32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

S0 SI3112r;Silicon Image SiI 3512 SATARaid Controller;c:\windows\system32\DRIVERS\SI3112r.sys [2007-08-29 116264]
S0 SI3124;SiI-3124 SATALink Controller;c:\windows\system32\DRIVERS\SI3124.sys [2006-11-02 76208]
S0 Si3124r5;SiI-3124 SoftRaid 5 Controller;c:\windows\system32\DRIVERS\Si3124r5.sys [2006-09-20 207152]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-11 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-11 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-11 908056]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-11 298264]
S2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2007-10-03 598856]

.
Contents of the 'Scheduled Tasks' folder

2009-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]

2009-04-14 c:\windows\Tasks\User_Feed_Synchronization-{8855875C-9E65-4703-9811-6D6ABB107C4B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 22:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Home\Application Data\Mozilla\Firefox\Profiles\hmppqini.default\
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 14:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3696)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: ~,10time:~,-3
ComboFix-quarantined-files.txt 2009-04-14 18:05
ComboFix2.txt 2009-04-13 12:12
ComboFix3.txt 2009-04-13 03:08

Pre-Run: 3,317,383,168 bytes free
Post-Run: 3,336,527,872 bytes free

178 --- E O F --- 2009-03-13 07:02

#14
heir

Posted 14 April 2009 - 12:27 PM

Trusted Helper

Malware Removal
5,427 posts

Hm... the file didn't get copied.

let's have a look what's in the quarantine

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:dir
C:\Qoobox\Quarantine /s
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

#15
Wondamike7

Posted 14 April 2009 - 12:53 PM

Member

Topic Starter
Member
16 posts

SystemLook.txt

SystemLook v1.0 by jpshortstuff (14.04.09)
Log created at 14:53 on 14/04/2009 by Home (Administrator - Elevation successful)

========== dir ==========

C:\Qoobox\Quarantine - Parameters: "/s"

---Files---
catchme.log --a--- 344 bytes [02:56 13/04/2009] [18:01 14/04/2009]
[4][email protected] --a--- 70611 bytes [12:06 13/04/2009] [12:12 13/04/2009]

C:\Qoobox\Quarantine\C d----- [02:58 13/04/2009]

C:\Qoobox\Quarantine\C\WINDOWS d----- [02:58 13/04/2009]

C:\Qoobox\Quarantine\C\WINDOWS\system32 d----- [02:58 13/04/2009]
acaptuser32.dll.vir --a--- 111992 bytes [18:52 14/03/2009] [16:55 27/02/2009]
gaopdxcounter.vir --a--- 4 bytes [12:02 07/04/2009] [02:52 13/04/2009]
gaopdxuwkmovdnqyacpmbpxnrwxymepxysmfbh.dll.vir --a--- 13824 bytes [12:02 07/04/2009] [12:02 07/04/2009]
_000005_.tmp.dll.vir --a--- 144896 bytes [05:00 04/08/2004] [05:00 04/08/2004]
_000006_.tmp.dll.vir --a--- 984064 bytes [05:00 04/08/2004] [10:55 05/07/2006]
_000007_.tmp.dll.vir --a--- 721920 bytes [05:00 04/08/2004] [12:28 17/08/2006]
_000008_.tmp.dll.vir --a--- 1839488 bytes [05:00 04/08/2004] [00:05 06/10/2005]
_000009_.tmp.dll.vir --a--- 553472 bytes [05:00 04/08/2004] [05:00 04/08/2004]

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers d----- [02:58 13/04/2009]
gaopdxmnethesbxwpmpuwqxjkddviellooxxyy.sys.vir --a--- 34816 bytes [12:02 07/04/2009] [12:02 07/04/2009]

C:\Qoobox\Quarantine\Registry_backups d----- [02:55 13/04/2009]
HKCU-Run-AdobeBridge.reg.dat --a--- 98 bytes [03:07 13/04/2009] [03:07 13/04/2009]
Service_gaopdxserv.sys.reg.dat --a--- 865 bytes [02:58 13/04/2009] [02:58 13/04/2009]
tcpip.reg --a--- 4879 bytes [03:06 13/04/2009] [18:04 14/04/2009]

-=End Of File=-