Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

desperate need malware removal

Started by mancbluemoon , May 13 2011 04:42 PM

  • Please log in to reply

#1
mancbluemoon
Posted 13 May 2011 - 04:42 PM

mancbluemoon

    New Member

  • Member
  • Pip
  • 1 posts
we have only 3 desktop icons remaining whereas before there was at least 10 ! when i click start, all programmes , it says i only have 1 programme , all other docs have gone inc. 10 years worth of pics etc.....i`m now pulling my hair out and i`m very desperate to retrieve my files , i thankyou well in advance for all replies ! i have tried to use "superantispyware" cleaning tool but to no avail ...

heres what my OTL log says

Rick.


OTL logfile created on: 13/05/2011 23:33:49 - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\RICK.KIDSCOMP\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

767.00 Mb Total Physical Memory | 445.00 Mb Available Physical Memory | 58.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 58.00% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.36 Gb Total Space | 22.14 Gb Free Space | 31.03% Space Free | Partition Type: NTFS
Drive D: | 71.82 Gb Total Space | 61.96 Gb Free Space | 86.26% Space Free | Partition Type: FAT32

Computer Name: KIDSCOMP | User Name: RICK | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\RICK.KIDSCOMP\My Documents\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\Google\Update\1.3.21.53\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe (Sony Ericsson Mobile Communications AB)
PRC - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe (Acer Inc.)
PRC - C:\WINDOWS\system32\SysMonitor.exe ( )
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
PRC - C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe (Popwire AB)
PRC - C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe (Sony Ericsson Mobile Communications AB)
PRC - C:\Program Files\Common Files\Teleca Shared\Generic.exe (Teleca Software Solutions)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe ()


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\RICK.KIDSCOMP\My Documents\Downloads\OTL (1).exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\ScanSoft\OmniPageSE4\OpHookSE4.dll (Nuance Communications, Inc.)
MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\sysenv.dll (HiTRUST)
MOD - C:\WINDOWS\system32\MSNChatHook.dll (HiTRUST)
MOD - C:\WINDOWS\system32\CryptoAPI.dll (HiTRUST)
MOD - C:\WINDOWS\system32\mfc71u.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\MFC71ENU.DLL (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (iPod Service) -- File not found
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (NMSAccess) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (vvdsvc) -- C:\WINDOWS\system32\Nagasoft\vjocx.dll (南京纳加软件有限公司)
SRV - (Symantec Core LC) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (IJPLMSVC) -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe ()
SRV - (AcerMemUsageCheckService) -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe (Acer Inc.)
SRV - (BlueSoleil Hid Service) -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe ()


========== Driver Services (SafeList) ==========

DRV - (MREMPR5) -- C:\Program Files\Common Files\MOTIVE\MREMPR5.SYS ()
DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (fssfltr) -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (k750mdm) -- C:\WINDOWS\system32\drivers\k750mdm.sys (MCCI)
DRV - (k750mgmt) -- C:\WINDOWS\system32\drivers\k750mgmt.sys (MCCI)
DRV - (k750obex) -- C:\WINDOWS\system32\drivers\k750obex.sys (MCCI)
DRV - (k750bus) Sony Ericsson 750 driver (WDM) -- C:\WINDOWS\system32\drivers\k750bus.sys (MCCI)
DRV - (k750mdfl) -- C:\WINDOWS\system32\drivers\k750mdfl.sys (MCCI)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (symlcbrd) -- C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (SCDEmu) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM) -- C:\WINDOWS\system32\drivers\se27unic.sys (MCCI)
DRV - (SE27obex) -- C:\WINDOWS\system32\drivers\SE27obex.sys (MCCI)
DRV - (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS) -- C:\WINDOWS\system32\drivers\se27nd5.sys (MCCI)
DRV - (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\SE27mgmt.sys (MCCI)
DRV - (SE27mdm) -- C:\WINDOWS\system32\drivers\SE27mdm.sys (MCCI)
DRV - (SE27mdfl) -- C:\WINDOWS\system32\drivers\SE27mdfl.sys (MCCI)
DRV - (SE27bus) Sony Ericsson Device 039 Driver driver (WDM) -- C:\WINDOWS\system32\drivers\SE27bus.sys (MCCI)
DRV - (nvatabus) -- C:\WINDOWS\system32\drivers\nvatabus.sys (NVIDIA Corporation)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (ZD1211BU(ZyDAS)) ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS) -- C:\WINDOWS\system32\drivers\ZD1211BU.sys (ZyDAS Technology Corporation)
DRV - (ZD1211U(ZyDAS)) ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS) -- C:\WINDOWS\system32\drivers\ZD1211U.sys (ZyDAS Technology Corporation)
DRV - (BlueletAudio) -- C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation)
DRV - (Btcsrusb) -- C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation)
DRV - (USBCCID) -- C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (BTHidEnum) -- C:\WINDOWS\system32\drivers\vbtenum.sys ()
DRV - (BTHidMgr) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation)
DRV - (BT) -- C:\WINDOWS\system32\drivers\BtNetDrv.sys (IVT Corporation)
DRV - (VcommMgr) -- C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation)
DRV - (int15.sys) -- C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (BTNetFilter) -- C:\WINDOWS\system32\drivers\BTNetFilter.sys ()
DRV - (ZDPSp50) -- C:\WINDOWS\system32\drivers\ZDPSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (VComm) -- C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.client...fo/bt_side.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sky.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo....=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sky.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/03/30 15:53:18 | 000,000,000 | -H-D | M]

[2009/06/10 13:53:15 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Mozilla\Extensions

O1 HOSTS File: ([2007/12/24 22:56:36 | 000,003,395 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 bin.errorprotector.com ## added by CiD
O1 - Hosts: 127.0.0.1 br.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 br.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 br.winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 cdn.drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 cdn.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 cdn.winsoftware.com ## added by CiD
O1 - Hosts: 127.0.0.1 de.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 de.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.cdn.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.cdn.winsoftware.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.systemdoctor.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.winantispyware.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.windrivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 dynamique.drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 errorprotector.com ## added by CiD
O1 - Hosts: 127.0.0.1 errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 es.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 fr.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 fr.winfixer.com ## added by CiD
O1 - Hosts: 46 more lines...
O2 - BHO: (ShoppingReport2) - {258C9770-1713-4021-8D7E-1F184A2BD754} - C:\Program Files\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.3.2.dll (BitComet)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Bitlord Toolbar) - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\prxtbTor0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Bitlord Toolbar) - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\prxtbTor0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Bitlord Toolbar) - {7C5C0F58-E061-457D-9033-77307F5ED00C} - C:\Program Files\TorrentMan\prxtbTor0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe ( )
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (Acer Inc.)
O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)
O4 - HKLM..\Run: [Motive SmartBridge] C:\Program Files\BT Home Hub\Help\SmartBridge\BTHelpNotifier.exe (Motive)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe (Sony Ericsson Mobile Communications AB)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKCU..\Run: [eyeBeam SIP Client] File not found
O4 - HKCU..\Run: [HUAWEI 3G Data Card MTS] File not found
O4 - HKCU..\Run: [Octoshape Streaming Services] C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\RICK.KIDSCOMP\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\RICK.KIDSCOMP\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2 ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - File not found
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.3.2.dll (BitComet)
O9 - Extra Button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - C:\Program Files\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O9 - Extra Button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - C:\Program Files\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail....es/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebo...toUploader3.cab (Facebook Photo Uploader 4 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zon...ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zon...nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} http://upload.facebo...Uploader4_5.cab (Facebook Photo Uploader 4)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zon...er.cab56986.cab (Minesweeper Flags Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop WallPaper: C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/11 22:04:08 | 000,000,050 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{c0ae767e-3f03-11dd-b02f-000272b00026}\Shell - "" = AutoRun
O33 - MountPoints2\{c0ae767e-3f03-11dd-b02f-000272b00026}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c0ae767e-3f03-11dd-b02f-000272b00026}\Shell\AutoRun\command - "" = K:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/11 21:43:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2011/05/08 02:30:49 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\ShoppingReport2
[2011/05/07 16:32:03 | 000,000,000 | -H-D | C] -- C:\Program Files\ShoppingReport2
[2011/04/20 21:15:04 | 000,000,000 | -HSD | C] -- C:\found.001
[2011/04/20 01:54:48 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\MOTIVE
[2011/04/18 10:30:51 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2011/04/17 23:08:44 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Home and Business (English)
[2011/04/17 23:06:47 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\DESIGNER
[2011/04/17 23:06:42 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Documents\SoftGrid Client
[2011/04/17 23:06:40 | 000,000,000 | -H-D | C] -- C:\Program Files\Microsoft Application Virtualization Client
[2011/04/17 23:06:40 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Microsoft
[2007/12/23 17:38:10 | 000,047,360 | -H-- | C] (VSO Software) -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\pcouffin.sys
[2007/02/01 22:15:40 | 000,016,384 | -H-- | C] ( ) -- C:\WINDOWS\System32\ClearEvent.exe
[2007/02/01 22:14:10 | 000,053,248 | -H-- | C] ( ) -- C:\WINDOWS\System32\Interop.Shell32.dll
[2007/02/01 22:14:10 | 000,049,152 | -H-- | C] ( ) -- C:\WINDOWS\System32\SysMonitor.exe
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/13 23:23:00 | 000,000,982 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1009UA.job
[2011/05/13 23:21:02 | 000,000,992 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1008UA.job
[2011/05/13 23:15:00 | 000,000,996 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1007UA.job
[2011/05/13 23:15:00 | 000,000,944 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1007Core.job
[2011/05/13 23:14:25 | 000,000,882 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/13 23:13:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/13 23:13:48 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/13 22:47:01 | 000,000,970 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1005UA.job
[2011/05/13 22:47:01 | 000,000,886 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/13 22:22:38 | 000,002,350 | -H-- | M] () -- C:\Documents and Settings\RICK.KIDSCOMP\Desktop\Google Chrome.lnk
[2011/05/13 22:22:38 | 000,002,328 | -H-- | M] () -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/05/13 22:21:00 | 000,000,940 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1008Core.job
[2011/05/13 18:23:00 | 000,000,930 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1009Core.job
[2011/05/13 00:32:23 | 114,895,907 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/05/12 23:47:00 | 000,000,918 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2155152350-2319816222-2258518634-1005Core.job
[2011/05/11 21:43:20 | 000,001,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/05/11 18:15:45 | 000,000,127 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI
[2011/05/11 11:52:36 | 000,000,152 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~19193636
[2011/05/11 11:52:34 | 000,000,128 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~19193636r
[2011/05/11 11:52:24 | 000,000,328 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\19193636
[2011/05/09 09:19:23 | 000,191,471 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/05/09 03:43:52 | 000,000,012 | -H-- | M] () -- C:\WINDOWS\bthservsdp.dat
[2011/05/07 16:31:12 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\ppsrc.ini
[2011/04/25 21:01:39 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2011/04/25 10:20:10 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/18 22:33:28 | 000,444,034 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/18 22:33:28 | 000,072,932 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/04/15 21:29:40 | 000,239,144 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/11 21:43:20 | 000,001,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/05/11 21:15:08 | 804,835,328 | -HS- | C] () -- C:\hiberfil.sys
[2011/05/11 11:52:34 | 000,000,152 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19193636
[2011/05/11 11:52:34 | 000,000,128 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19193636r
[2011/05/11 11:52:24 | 000,000,328 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\19193636
[2011/01/16 01:02:21 | 000,013,304 | -H-- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2011/01/16 01:02:21 | 000,011,860 | -H-- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys
[2009/12/25 16:40:45 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/12/25 16:26:10 | 000,007,168 | -H-- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/04/30 14:54:29 | 000,000,412 | -H-- | C] () -- C:\WINDOWS\MAXLINK.INI
[2009/02/03 12:04:20 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2008/11/27 15:56:18 | 000,000,671 | -H-- | C] () -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\vso_ts_preview.xml
[2008/09/20 17:35:57 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/06/21 01:49:20 | 000,000,012 | -H-- | C] () -- C:\WINDOWS\bthservsdp.dat
[2008/06/14 12:11:24 | 000,069,632 | RH-- | C] () -- C:\WINDOWS\System32\xmltok.dll
[2008/06/14 12:11:24 | 000,036,864 | RH-- | C] () -- C:\WINDOWS\System32\xmlparse.dll
[2007/12/23 17:38:10 | 000,087,608 | -H-- | C] () -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\inst.exe
[2007/12/23 17:38:10 | 000,007,887 | -H-- | C] () -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\pcouffin.cat
[2007/12/23 17:38:10 | 000,001,144 | -H-- | C] () -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\pcouffin.inf
[2007/08/29 20:26:30 | 000,000,013 | -H-- | C] () -- C:\WINDOWS\msgtn.ini
[2007/08/24 23:35:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\ppsrc.ini.bak
[2007/08/24 23:35:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\ppsrc.ini
[2007/08/24 23:22:46 | 000,000,034 | -H-- | C] () -- C:\WINDOWS\Powerplayer.ini
[2007/08/24 23:22:42 | 000,000,278 | -H-- | C] () -- C:\WINDOWS\psnetwork.ini
[2007/06/18 11:52:29 | 000,000,543 | -H-- | C] () -- C:\WINDOWS\eReg.dat
[2007/04/30 11:10:13 | 000,001,755 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/03/03 16:45:55 | 000,002,584 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/03/02 02:25:35 | 000,027,136 | -H-- | C] () -- C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/03/01 01:16:59 | 000,000,136 | -H-- | C] () -- C:\Documents and Settings\RICK.KIDSCOMP\Local Settings\Application Data\fusioncache.dat
[2007/02/28 19:36:05 | 000,000,552 | -H-- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2007/02/23 13:28:05 | 000,000,017 | -H-- | C] () -- C:\WINDOWS\crwcu.ini
[2007/02/23 13:23:27 | 000,001,081 | -H-- | C] () -- C:\WINDOWS\CafeUK.ini
[2007/02/08 21:58:01 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2007/02/08 21:56:43 | 000,006,550 | -H-- | C] () -- C:\WINDOWS\jautoexp.dat
[2007/02/03 04:10:30 | 000,056,832 | -H-- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2007/02/02 20:21:33 | 000,000,155 | -H-- | C] () -- C:\WINDOWS\SillySoccer.ini
[2007/02/01 22:16:09 | 000,114,688 | -H-- | C] () -- C:\WINDOWS\PowerOption.exe
[2007/02/01 22:16:09 | 000,000,294 | -H-- | C] () -- C:\WINDOWS\PowerOption.ini
[2007/02/01 22:14:10 | 000,331,776 | -H-- | C] () -- C:\WINDOWS\System32\ScrollBarLib.dll
[2006/08/11 22:07:32 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/08/11 22:07:24 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2006/08/11 22:06:08 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\commercial.ini
[2006/08/11 22:05:40 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\System32\MWLPS.dll
[2006/08/11 22:04:30 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2006/08/11 22:03:44 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2006/08/11 22:03:44 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2006/08/11 22:03:44 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2006/08/11 22:03:44 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2006/08/11 21:54:50 | 000,444,034 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/08/11 21:54:50 | 000,072,932 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/08/11 21:51:34 | 000,239,144 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/08/11 21:40:32 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/08/11 21:38:38 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/07/11 23:19:00 | 001,724,416 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/07/11 23:19:00 | 001,657,376 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/07/11 23:19:00 | 001,503,232 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/07/11 23:19:00 | 001,346,080 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/07/11 23:19:00 | 001,101,824 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/07/11 23:19:00 | 000,581,632 | -H-- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/07/11 23:19:00 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/07/11 23:19:00 | 000,449,056 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/07/11 23:19:00 | 000,436,768 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/07/11 23:19:00 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/05/29 15:05:58 | 000,303,104 | -H-- | C] () -- C:\WINDOWS\CreateLnk.exe
[2006/04/12 23:08:36 | 000,061,440 | -H-- | C] () -- C:\WINDOWS\System32\InstallCheck.dll
[2006/03/09 02:19:28 | 001,421,824 | -H-- | C] () -- C:\WINDOWS\System32\UIVCL.dll
[2006/03/09 02:11:30 | 000,057,344 | -H-- | C] () -- C:\WINDOWS\System32\APISlice.dll
[2006/03/03 04:35:48 | 000,067,584 | -H-- | C] () -- C:\WINDOWS\System32\HTCA_SelfExtract.bin
[2005/11/17 06:11:52 | 000,024,576 | RH-- | C] () -- C:\WINDOWS\System32\Kill1211.exe
[2005/11/10 20:27:42 | 000,003,218 | -H-- | C] () -- C:\WINDOWS\System32\drivers\WINIO.sys
[2005/10/31 03:17:38 | 000,135,168 | -H-- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2005/10/26 07:25:28 | 000,008,073 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/10/12 17:43:40 | 000,000,095 | -H-- | C] () -- C:\WINDOWS\alaunch.ini
[2005/08/05 22:01:54 | 000,235,008 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/07/15 01:48:00 | 000,040,960 | -H-- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2005/07/12 22:44:42 | 000,015,872 | -H-- | C] () -- C:\WINDOWS\System32\InsDrvZD64.DLL
[2005/04/04 08:44:04 | 000,000,258 | -H-- | C] () -- C:\WINDOWS\Clearlnk.ini
[2004/12/17 03:14:44 | 000,013,952 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004/08/10 21:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 21:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 21:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 21:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 21:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 21:00:00 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 21:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 21:00:00 | 000,001,793 | -H-- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 21:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/03/24 00:38:00 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll
[2004/01/30 09:37:50 | 000,000,092 | RH-- | C] () -- C:\WINDOWS\System32\FTDIUN2K.INI
[2003/08/07 17:51:32 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\reboot.exe
[2003/08/07 03:32:24 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\KCMDNIns.exe
[2003/03/14 20:24:00 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\ZyDelReg.exe
[2002/05/23 17:34:46 | 000,032,768 | -H-- | C] () -- C:\WINDOWS\AMove.exe
[2002/03/01 14:43:34 | 000,028,008 | -H-- | C] () -- C:\WINDOWS\System32\SUSUSB.SYS
[2001/12/26 23:12:30 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001/09/04 06:46:38 | 000,110,592 | -H-- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001/08/25 18:04:08 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/25 18:02:42 | 000,004,524 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/07/30 23:33:56 | 000,118,784 | -H-- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/24 05:04:36 | 000,118,784 | -H-- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2010/04/02 03:21:27 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ashampoo
[2011/04/21 07:55:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2008/12/09 02:38:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\AVG7
[2010/10/19 23:03:32 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2011/01/16 01:05:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Bluetooth
[2011/03/23 22:19:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2009/04/30 14:48:48 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011/04/25 10:23:42 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
[2010/10/19 23:30:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2007/05/05 03:10:57 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2011/05/07 00:46:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2008/01/05 18:37:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\NtiDvdCopy
[2007/05/13 23:09:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\pixelStorm
[2009/04/30 14:54:21 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/02/23 12:41:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Screentime
[2007/08/25 00:39:12 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Storm
[2008/03/23 10:32:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Teleca
[2009/02/25 15:47:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008/01/01 22:34:38 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\third lies itch ford
[2011/04/18 10:30:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2008/01/05 19:43:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/04/02 03:26:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Ashampoo
[2010/10/19 23:31:34 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\AVG10
[2011/01/10 19:26:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Canon
[2008/12/15 10:27:25 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2007/08/27 22:59:18 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\FrostWire
[2007/08/16 21:27:38 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Leadertech
[2009/03/08 15:37:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\LimeWire
[2010/09/25 23:17:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\MSNInstaller
[2009/02/08 18:01:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\OpenOffice.org
[2007/07/09 08:42:37 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Opera
[2007/08/24 23:24:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\PPMate
[2007/08/29 20:23:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\PPStream
[2011/05/08 02:31:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\ShoppingReport2
[2009/11/10 15:56:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Sony Online Entertainment
[2008/03/14 23:16:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Sports Interactive
[2007/08/25 11:20:47 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\StromII
[2007/04/22 11:40:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Teleca
[2009/08/27 02:28:02 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\TigerPlayer
[2007/11/25 00:44:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\uTorrent
[2009/08/27 11:13:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\RICK.KIDSCOMP\Application Data\Vso

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9D1B94FD

< End of report >
  • 0

Advertisements

#2
RKinner
Posted 14 May 2011 - 10:05 AM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
Copy the text in the code box by highlighting and Ctrl + c 


:Services
symlcbrd
eeCtrl

:OTL
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (symlcbrd) -- C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.3.2.dll (BitComet)
O2 - BHO: (Bitlord Toolbar) - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\prxtbTor0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bitlord Toolbar) - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\prxtbTor0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Bitlord Toolbar) - {7C5C0F58-E061-457D-9033-77307F5ED00C} - C:\Program Files\TorrentMan\prxtbTor0.dll (Conduit Ltd.)
O4 - HKCU..\Run: [eyeBeam SIP Client] File not found
O4 - HKCU..\Run: [HUAWEI 3G Data Card MTS] File not found
O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - File not found
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.3.2.dll (BitComet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O33 - MountPoints2\{c0ae767e-3f03-11dd-b02f-000272b00026}\Shell - "" = AutoRun
O33 - MountPoints2\{c0ae767e-3f03-11dd-b02f-000272b00026}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c0ae767e-3f03-11dd-b02f-000272b00026}\Shell\AutoRun\command - "" = K:\AutoRun.exe
[2011/05/11 11:52:34 | 000,000,152 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19193636
[2011/05/11 11:52:34 | 000,000,128 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~19193636r
[2011/05/11 11:52:24 | 000,000,328 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\19193636

:Files
C:\Program Files\Common Files\Symantec Shared
C:\WINDOWS\system32\drivers\symlcbrd.sys

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"
     
:Commands
[RESETHOSTS]
[purity]
[emptytemp]
[Reboot]
then run OTL and Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the Run Fix button at the top
Let the program run unhindered, OTL will reboot the PC when it is done. Save the log and copy and paste it to a reply.

Open OTL again and select either the Use SafeList or All option in the Extra Registry group then the Run Scan button. Post the two logs it produces in your next reply.

Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:

http://www.malwarebytes.org/mbam.php

SAVE Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
Posted Image

On completion of the scan (Note if the Fix button is enabled and tell me) click save log, save it to your desktop and post in your next reply
Posted Image

Download, Save and run unhide.exe

http://download.blee...nler/unhide.exe

Ron
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP