Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

System Repair Virus Removal

Started by lbkpenneys , Jul 13 2011 04:25 PM

  • This topic is locked This topic is locked

#1
lbkpenneys
Posted 13 July 2011 - 04:25 PM

lbkpenneys

    Member

  • Member
  • PipPip
  • 10 posts
I received a very fun virus this afternoon. A box pops up saying System Repair and that there is Hard Disk error. Now it is saying RAM memory usage is critically high. RAM memory failure. "The system has detected a problem with one or more IDE/SATA hard disks." All of my programs are now hidden and I can't locate them. There are also redirects on the internet. I have run rkills and tried to install malwarebytes but it says access is denied and won't let me install. I then installed SUPERAntiSpyware and it installed and detected 300+ issues and when asked to reboot the whole virus started all over again. Please Help!! Your help is muchly appreciated in advance!

HERE IS MY OTL REPORT:

OTL logfile created on: 5/13/2011 9:58:21 PM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Regina Penney\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 604.00 Mb Available Physical Memory | 60.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): c:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 931.48 Gb Total Space | 888.79 Gb Free Space | 95.42% Space Free | Partition Type: NTFS
Drive G: | 465.75 Gb Total Space | 24.90 Gb Free Space | 5.35% Space Free | Partition Type: NTFS

Computer Name: PENNEY | User Name: Regina Penney | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/11 19:06:59 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Regina Penney\Desktop\OTL.exe
PRC - [2008/04/14 07:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/05/16 23:15:10 | 000,071,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe


========== Modules (SafeList) ==========

MOD - [2011/05/11 19:06:59 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Regina Penney\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2006/11/15 23:05:40 | 000,101,152 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2006/11/15 23:03:36 | 000,109,344 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- c:\Program Files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)


========== Driver Services (SafeList) ==========

DRV - File not found [File_System | Unknown | Running] -- -- (setup_9.0.0.722_12.05.2011_22-04drv)
DRV - File not found [Kernel | Unknown | Running] -- -- (42491252)
DRV - File not found [Kernel | Disabled | Running] -- -- (42491251)
DRV - [2009/02/06 18:08:42 | 000,055,152 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2008/04/14 07:00:00 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2007/05/02 19:56:51 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2007/02/02 04:00:00 | 000,009,464 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2007/02/02 04:00:00 | 000,009,336 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2006/11/15 23:03:12 | 000,024,736 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2006/11/15 23:02:50 | 001,962,912 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2006/11/15 23:00:56 | 001,678,368 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2006/11/10 20:48:02 | 000,040,352 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2006/11/10 20:43:16 | 000,933,536 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2006/11/10 20:43:16 | 000,013,344 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/05/23 16:00:26 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2006/02/10 11:19:12 | 001,107,224 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2003/11/17 14:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 14:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 14:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.condui...&ctid=CT2642706
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.co...-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"

FF - HKLM\software\mozilla\Firefox\extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2011/05/11 15:12:55 | 000,000,000 | ---D | M]

[2010/08/19 10:40:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Regina Penney\Application Data\Mozilla\Firefox\Profiles\xge1a9zs.default\extensions
[2010/02/04 16:45:40 | 000,002,254 | ---- | M] () -- C:\Documents and Settings\Regina Penney\Application Data\Mozilla\Firefox\Profiles\xge1a9zs.default\searchplugins\askcom.xml
[2007/02/26 16:02:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2007/02/26 15:59:03 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2011/05/12 15:08:35 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\Program Files\Real\realplayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://help.live.co...veX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} http://armadillocame...PUploader45.cab (Image Uploader Control)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Reg Error: Key error.)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace....ploader1006.cab (MySpace Uploader Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://by24fd.bay24....es/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.babysites...geUploader5.cab (Image Uploader Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onec...lscbase5036.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.babysites...geUploader4.cab (Image Uploader Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} http://web1.shutterf...ds/Uploader.cab (Shutterfly Picture Upload Plugin)
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} http://photo.walmart...ploadClient.cab (FujifilmUploader Class)
O16 - DPF: {AE6C4705-0F11-4ACB-BDD4-37F138BEF289} http://www.hebphoto....PUploader45.cab (Image Uploader Control)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail....ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 208.180.83.133 208.180.42.68
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 13:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/12 15:39:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2011/05/12 15:38:30 | 115,814,720 | ---- | C] ( ) -- C:\Documents and Settings\Regina Penney\Desktop\setup_9.0.0.722_12.05.2011_22-04.exe
[2011/05/12 15:01:44 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/05/12 15:01:44 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/05/12 15:01:44 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/05/12 15:01:44 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/05/12 08:29:32 | 000,589,632 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Regina Penney\Desktop\aswMBR.exe
[2011/05/12 08:22:31 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/05/11 19:06:58 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Regina Penney\Desktop\OTL.exe
[2011/05/11 18:57:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Regina Penney\Desktop\tdsskiller
[2011/05/11 16:34:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Regina Penney\Desktop\GooredFix Backups
[2011/05/11 16:34:16 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Documents and Settings\Regina Penney\Desktop\GooredFix.exe
[2011/05/11 16:24:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Regina Penney\Desktop\erunt
[2011/05/11 10:57:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Regina Penney\Application Data\Malwarebytes
[2011/05/11 10:57:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/11 10:57:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/11 10:57:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/05/11 10:57:47 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/11 10:57:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/10 05:02:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\Threat Expert
[2011/05/10 04:28:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2011/05/02 09:08:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Regina Penney\Start Menu\Programs\BrowserPlus
[2011/05/02 09:08:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\Yahoo!

========== Files - Modified Within 30 Days ==========

[2011/05/13 21:13:00 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/13 12:38:21 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/05/13 12:31:22 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{981FC436-4AEF-45D6-82D0-6C84152FC012}.job
[2011/05/13 11:13:00 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/12 15:38:35 | 115,814,720 | ---- | M] ( ) -- C:\Documents and Settings\Regina Penney\Desktop\setup_9.0.0.722_12.05.2011_22-04.exe
[2011/05/12 15:08:35 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/05/12 15:00:04 | 004,347,036 | R--- | M] () -- C:\Documents and Settings\Regina Penney\Desktop\ComboFix.exe
[2011/05/12 12:27:05 | 000,002,535 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Scrapbook Factory Deluxe.lnk
[2011/05/12 08:30:43 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Regina Penney\Desktop\MBR.dat
[2011/05/12 08:29:39 | 000,589,632 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Regina Penney\Desktop\aswMBR.exe
[2011/05/12 08:25:26 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/12 08:24:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/12 08:24:45 | 1063,407,616 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/11 20:16:20 | 000,459,841 | ---- | M] () -- C:\Documents and Settings\Regina Penney\Desktop\Drew001.jpg
[2011/05/11 19:06:59 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Regina Penney\Desktop\OTL.exe
[2011/05/11 18:57:17 | 001,280,815 | ---- | M] () -- C:\Documents and Settings\Regina Penney\Desktop\tdsskiller.zip
[2011/05/11 18:54:15 | 001,703,008 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/05/11 16:34:16 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Documents and Settings\Regina Penney\Desktop\GooredFix.exe
[2011/05/11 16:24:08 | 000,513,320 | ---- | M] () -- C:\Documents and Settings\Regina Penney\Desktop\erunt.zip
[2011/05/11 12:27:45 | 000,000,281 | -HS- | M] () -- C:\boot.ini
[2011/05/11 10:57:51 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/10 04:32:02 | 000,525,428 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2011/05/10 04:28:40 | 000,512,992 | ---- | M] () -- C:\Documents and Settings\Regina Penney\Desktop\sdsetup_aff[1].exe
[2011/04/26 10:13:05 | 000,109,150 | ---- | M] () -- C:\Documents and Settings\Regina Penney\My Documents\Empire Paper Company.pdf
[2011/04/18 22:41:17 | 000,345,654 | ---- | M] () -- C:\Documents and Settings\Regina Penney\My Documents\wedding invitation samples.pdf
[2011/04/18 10:06:44 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2011/04/13 22:16:02 | 000,034,304 | ---- | M] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2011/05/12 15:01:44 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/05/12 15:01:44 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/05/12 15:01:44 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/05/12 15:01:44 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/05/12 15:01:44 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/05/12 14:59:58 | 004,347,036 | R--- | C] () -- C:\Documents and Settings\Regina Penney\Desktop\ComboFix.exe
[2011/05/12 08:30:43 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Desktop\MBR.dat
[2011/05/11 18:57:11 | 001,280,815 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Desktop\tdsskiller.zip
[2011/05/11 16:24:05 | 000,513,320 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Desktop\erunt.zip
[2011/05/11 10:57:51 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/10 04:31:50 | 000,525,428 | ---- | C] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2011/05/10 04:28:40 | 000,512,992 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Desktop\sdsetup_aff[1].exe
[2011/04/26 10:13:03 | 000,109,150 | ---- | C] () -- C:\Documents and Settings\Regina Penney\My Documents\Empire Paper Company.pdf
[2011/04/18 22:31:05 | 000,345,654 | ---- | C] () -- C:\Documents and Settings\Regina Penney\My Documents\wedding invitation samples.pdf
[2011/04/18 10:32:03 | 000,459,841 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Desktop\Drew001.jpg
[2011/04/13 22:01:35 | 098,983,677 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Desktop\Drew's 1st Tee Ball Game.wmv
[2010/12/03 12:13:30 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/12/02 11:50:44 | 000,081,152 | ---- | C] () -- C:\WINDOWS\System32\drivers\bioprime.bin
[2010/12/02 11:50:44 | 000,049,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\atirtcap.sys
[2010/12/02 11:50:44 | 000,046,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\atibt829.sys
[2010/12/02 11:50:44 | 000,026,880 | ---- | C] () -- C:\WINDOWS\System32\drivers\atirtsnd.sys
[2010/12/02 11:50:44 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativxbar.sys
[2010/12/02 11:50:44 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\atixbar.sys
[2010/12/02 11:50:44 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativttxx.sys
[2010/12/02 11:50:44 | 000,018,852 | ---- | C] () -- C:\WINDOWS\System32\drivers\avmc20.dll
[2010/12/02 11:50:44 | 000,018,372 | ---- | C] () -- C:\WINDOWS\System32\drivers\avmcapi.dll
[2010/12/02 11:50:44 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\drivers\atitvsnd.sys
[2010/12/02 11:50:44 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\drivers\atitunep.sys
[2010/12/02 11:50:44 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\drivers\atipcxxx.sys
[2010/12/02 11:50:44 | 000,009,472 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmdcd.sys
[2010/12/02 11:50:44 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\drivers\brmsi02.bin
[2010/12/02 11:50:44 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\drivers\brmsi01.bin
[2010/12/02 11:50:44 | 000,000,136 | ---- | C] () -- C:\WINDOWS\System32\drivers\brclr00.ini
[2010/12/02 11:50:44 | 000,000,134 | ---- | C] () -- C:\WINDOWS\System32\drivers\brclr0.ini
[2010/12/02 11:50:44 | 000,000,130 | ---- | C] () -- C:\WINDOWS\System32\drivers\brclr.ini
[2010/12/02 11:50:44 | 000,000,075 | ---- | C] () -- C:\WINDOWS\System32\drivers\31x5us04.ini
[2010/12/02 11:50:44 | 000,000,075 | ---- | C] () -- C:\WINDOWS\System32\drivers\31x5uc04.ini
[2010/12/02 11:50:44 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\drivers\brmfbidi.ini
[2010/12/02 11:50:44 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\drivers\alpsres.ini
[2010/12/02 11:50:20 | 000,000,075 | ---- | C] () -- C:\WINDOWS\31x5us04.ini
[2010/12/02 11:50:20 | 000,000,075 | ---- | C] () -- C:\WINDOWS\31x5uc04.ini
[2010/06/06 18:33:48 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/04/07 14:00:01 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/03/09 17:57:26 | 000,000,071 | ---- | C] () -- C:\WINDOWS\EPSONCD.INI
[2009/07/28 18:01:01 | 000,001,636 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Application Data\wklnhst.dat
[2009/03/30 21:49:17 | 000,003,072 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Application Data\dvd.bmk
[2008/08/04 09:57:26 | 000,018,881 | ---- | C] () -- C:\WINDOWS\System32\megav.sys
[2008/08/04 09:57:25 | 000,016,929 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\iwyc.bin
[2008/08/04 09:57:25 | 000,012,898 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\volabyxa.pif
[2008/08/04 09:57:25 | 000,011,948 | ---- | C] () -- C:\WINDOWS\System32\dyloby.dll
[2008/07/29 21:00:19 | 000,000,007 | ---- | C] () -- C:\WINDOWS\System32\ngxt.bin
[2008/04/14 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008/04/14 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 07:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008/04/14 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2007/12/08 13:31:15 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2007/10/25 11:34:44 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ESGAppInfo.dll
[2007/08/14 11:59:28 | 000,003,408 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/05/26 15:09:47 | 000,073,220 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2007/05/26 15:09:47 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2007/05/26 15:09:47 | 000,029,114 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2007/05/26 15:09:47 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2007/05/26 15:09:47 | 000,021,021 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2007/05/26 15:09:47 | 000,015,670 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2007/05/26 15:09:47 | 000,013,280 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2007/05/26 15:09:47 | 000,010,673 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2007/05/26 15:09:47 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2007/05/26 15:09:47 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2007/05/26 15:09:47 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2007/05/26 15:09:47 | 000,001,137 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2007/05/26 15:09:47 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2007/05/26 15:09:47 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2007/05/26 15:09:47 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2007/05/26 15:09:47 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2007/05/26 15:08:52 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI
[2007/05/26 15:07:54 | 000,000,084 | ---- | C] () -- C:\WINDOWS\EPSPRX580.ini
[2007/03/05 13:34:28 | 000,676,224 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2007/03/04 22:17:53 | 000,081,984 | ---- | C] () -- C:\WINDOWS\System32\bdod.bin
[2007/01/22 15:12:07 | 000,000,010 | ---- | C] () -- C:\WINDOWS\popcinfo.dat
[2007/01/06 12:39:45 | 000,042,594 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2006/11/15 23:03:12 | 000,024,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2006/11/15 23:00:56 | 001,678,368 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys
[2006/10/02 19:19:29 | 000,004,142 | ---- | C] () -- C:\WINDOWS\SportballChallenge.ini
[2006/09/30 20:52:20 | 000,000,022 | ---- | C] () -- C:\WINDOWS\kodakpcd.Regina Penney.ini
[2006/09/20 14:11:08 | 000,034,304 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/13 14:18:27 | 000,003,558 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/09/13 13:51:03 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\fusioncache.dat
[2006/09/07 01:28:15 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/09/07 01:22:00 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/09/07 01:16:25 | 000,000,292 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/09/07 01:12:38 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2006/09/07 01:10:20 | 000,712,704 | ---- | C] () -- C:\WINDOWS\System32\DellSystemRestore.dll
[2006/09/07 00:41:34 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006/09/07 00:40:06 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 13:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 13:02:15 | 000,023,444 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 13:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 12:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 12:57:15 | 001,703,008 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 12:51:20 | 000,468,278 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 12:51:20 | 000,083,396 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 12:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== Custom Scans ==========


< :OTL >

< [2008/08/04 09:57:25 | 000,016,929 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\iwyc.bin >
Invalid Switch: 04 09:57:25 | 000,016,929 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\iwyc.bin


< [2008/08/04 09:57:25 | 000,012,898 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\volabyxa.pif >
Invalid Switch: 04 09:57:25 | 000,012,898 | ---- | C] () -- C:\Documents and Settings\Regina Penney\Local Settings\Application Data\volabyxa.pif


< [2008/08/04 09:57:25 | 000,011,948 | ---- | C] () -- C:\WINDOWS\System32\dyloby.dll >
Invalid Switch: 04 09:57:25 | 000,011,948 | ---- | C] () -- C:\WINDOWS\System32\dyloby.dll


< >

< :Files >

< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.

< >

< :Commands >

< [purity] >

< [emptytemp] >

< [emptyflash] >

< [Reboot] >

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A31FAD21

< End of report >
  • 0

Advertisements

#2
Essexboy
Posted 14 July 2011 - 11:49 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there lots to do I feel - so lets get at it. Please download fresh copies of all programmes

Download Unhide.exe to your desktop and run



Download RogueKiller to your desktop

  • Quit all running programs
  • For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
  • When prompted, type 6 and validate
  • The RKreport.txt shall be generated next to the executable.
  • If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

THEN

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    DRV - File not found [File_System | Unknown | Running] -- -- (setup_9.0.0.722_12.05.2011_22-04drv)
    DRV - File not found [Kernel | Unknown | Running] -- -- (42491252)
    DRV - File not found [Kernel | Disabled | Running] -- -- (42491251)
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

FINALLY

Download aswMBR.exe ( 1.8mb ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply
Posted Image
  • 0

#3
Essexboy
Posted 18 July 2011 - 01:40 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP