Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

All exe apps not found (another one)

Started by Keman , Jul 28 2011 11:39 AM

This topic is locked

#1
Keman

Posted 28 July 2011 - 11:39 AM

Member

Member
36 posts

I was on "stumbleupon" and IE suddenly shut down then all programs and even system restore even ask what program you want to use to open the app with.

I saw about 10 threads down (I always look for simular problems) that someone had the same problem, and they were told to run OTL with custom scan box text. I will do that and post those logs here unless someone wants me to try somthing different.

*edited with logs*

(ran OTL with the following in the custom scan box)

netsvcs
%SYSTEMDRIVE%\*.exe
%USERPROFILE%\..|smtmp;true;true;true /FP
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT

Here are the Logs

OTL logfile created on: 7/28/2011 10:43:16 AM - Run 2
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Documents and Settings\Dustin\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
894.48 Mb Total Physical Memory | 441.46 Mb Available Physical Memory | 49.35% Memory free
2.12 Gb Paging File | 1.73 Gb Available in Paging File | 81.63% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.1 | %ProgramFiles% = C:\Program Files
Drive C: | 144.74 Gb Total Space | 108.45 Gb Free Space | 74.93% Space Free | Partition Type: NTFS
Drive D: | 4.30 Gb Total Space | 1.49 Gb Free Space | 34.77% Space Free | Partition Type: FAT32
Drive Z: | 74.52 Gb Total Space | 49.73 Gb Free Space | 66.74% Space Free | Partition Type: NTFS
 
Computer Name: DUSTINS | User Name: Dustin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2011/07/28 10:04:59 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dustin\Desktop\OTL.scr
PRC - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011/04/14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/03/28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2011/03/16 16:05:20 | 001,025,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.1\explorer.exe
 
 
[color=#E56717]========== Modules (SafeList) ==========[/color]
 
MOD - [2011/07/28 10:04:59 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dustin\Desktop\OTL.scr
MOD - [2009/08/12 13:30:32 | 000,042,408 | RHS- | M] () -- C:\WINDOWS.1\system32\flasha132.dll
MOD - [2009/08/12 11:07:43 | 000,040,960 | RHS- | M] () -- C:\WINDOWS.1\system32\flasha32.dll
MOD - [2006/08/25 08:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.1\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2006/05/19 05:59:41 | 000,094,720 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.1\system32\iphlpapi.dll
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - File not found [Auto | Stopped] --  -- (RoxLiveShare9)
SRV - File not found [Disabled | Stopped] --  -- (HidServ)
SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - [2011/04/14 21:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS.1\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS.1\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS.1\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS.1\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS.1\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS.1\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS.1\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS.1\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2008/01/14 03:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\WINDOWS.1\system32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2005/12/19 11:37:42 | 004,127,232 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS.1\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/10/29 05:12:32 | 001,391,104 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS.1\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2004/04/13 16:14:12 | 000,070,144 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS.1\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS.1\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1482476501-117609710-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS.1\system32\blank.htm
IE - HKU\S-1-5-21-1482476501-117609710-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-1482476501-117609710-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1482476501-117609710-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
IE - HKU\S-1-5-21-1482476501-117609710-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS.1\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS.1\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS.1\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@virtools.com/3DviaPlayer: C:\Program Files\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes)
FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Documents and Settings\Dustin\Application Data\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll (Octoshape ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/07/12 09:11:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{592CB981-8E35-4F0B-95E9-E56C2677B42F}: C:\Documents and Settings\Dustin\Local Settings\Application Data\{592CB981-8E35-4F0B-95E9-E56C2677B42F} [2011/05/03 14:35:01 | 000,000,000 | ---D | M]
 
[2009/04/09 09:24:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dustin\Application Data\Mozilla\Extensions
[2009/04/09 09:24:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Dustin\Application Data\Mozilla\Extensions\[email protected]
 
Hosts file not found
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\..\Toolbar\WebBrowser: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No CLSID value found.
O3 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS.1\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKU\S-1-5-21-1482476501-117609710-839522115-1003..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\S-1-5-21-1482476501-117609710-839522115-1003..\Run: [Wisdom-soft AutoScreenRecorder 3.1 Pro]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableProfileQuota = 1
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 192.168.1.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS.1\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (hvlth.exe) -  File not found
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS.1\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Dustin\My Documents\My Pictures\Background\BG.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Dustin\My Documents\My Pictures\Background\BG.bmp
O28 - HKLM ShellExecuteHooks: {58101905-D80F-4788-96F6-98618686178A} - C:\WINDOWS.1\system32\flasha32.dll ()
O28 - HKLM ShellExecuteHooks: {68101905-D80F-4788-96F6-98618686178A} - C:\WINDOWS.1\system32\flasha132.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/05/31 20:32:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/09/13 12:15:24 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS.1\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
O33 - MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\Shell - "" = AutoRun
O33 - MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-1482476501-117609710-839522115-1003..exefile [open] -- "C:\Documents and Settings\Dustin\Local Settings\Application Data\yjh.exe" -a "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\...exe [@ = exefile] -- "C:\Documents and Settings\Dustin\Local Settings\Application Data\yjh.exe" -a "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2011/07/28 10:04:59 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Dustin\Desktop\OTL.scr
[2011/06/30 10:41:16 | 000,000,000 | ---D | C] -- C:\Scans
[2011/06/30 10:18:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dustin\Application Data\Xerox
[2011/06/30 10:18:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\Xerox
[2011/06/30 10:16:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dustin\My Documents\WC7545-7556_5.196.7.0_PCL6_32
[2009/04/15 12:26:30 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS.1\System32\Implode.dll
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2011/07/28 11:57:01 | 000,001,292 | -HS- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:57:01 | 000,001,292 | -HS- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:56:51 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\yxtc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\ysoq.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\trxu.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\oxre.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\isxc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\dpwd.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\cdsr.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\catv.exe
[2011/07/28 10:38:10 | 125,895,620 | ---- | M] () -- C:\WINDOWS.1\System32\drivers\AVG\incavi.avm
[2011/07/28 10:04:59 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dustin\Desktop\OTL.scr
[2011/07/28 10:01:00 | 000,000,236 | ---- | M] () -- C:\WINDOWS.1\tasks\Scheduled Update for Ask Toolbar.job
[2011/07/28 09:53:37 | 000,002,206 | ---- | M] () -- C:\WINDOWS.1\System32\wpa.dbl
[2011/07/28 09:53:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS.1\bootstat.dat
[2011/07/15 16:09:21 | 002,880,670 | ---- | M] () -- C:\Documents and Settings\Dustin\My Documents\MGP.bmp
[2011/07/12 09:11:42 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Desktop\AVG 2011.lnk
[2011/07/07 17:19:45 | 000,005,846 | ---- | M] () -- C:\Documents and Settings\Dustin\My Documents\order numbers.rtf
[2011/06/30 12:12:35 | 000,004,310 | ---- | M] () -- C:\Documents and Settings\Dustin\My Documents\default.xpb
[2011/06/30 10:16:30 | 016,880,216 | ---- | M] () -- C:\Documents and Settings\Dustin\My Documents\WC7545-7556_5.196.7.0_PCL6_32.zip
[2011/06/29 12:46:07 | 000,000,120 | ---- | M] () -- C:\WINDOWS.1\Adimuqerof.dat
[2011/06/29 08:44:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS.1\Nyusamepoz.bin
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2011/07/28 11:56:53 | 000,001,292 | -HS- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:56:53 | 000,001,292 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:56:51 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\yxtc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\ysoq.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\trxu.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\oxre.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\isxc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\dpwd.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\cdsr.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\catv.exe
[2011/07/15 16:04:07 | 002,880,670 | ---- | C] () -- C:\Documents and Settings\Dustin\My Documents\MGP.bmp
[2011/06/30 12:12:35 | 000,004,310 | ---- | C] () -- C:\Documents and Settings\Dustin\My Documents\default.xpb
[2011/06/30 10:16:30 | 016,880,216 | ---- | C] () -- C:\Documents and Settings\Dustin\My Documents\WC7545-7556_5.196.7.0_PCL6_32.zip
[2011/06/17 17:26:17 | 000,003,416 | ---- | C] () -- C:\Documents and Settings\Dustin\Application Data\StuntCrazy_thePodge_so_tgi.sol
[2011/06/17 17:26:17 | 000,000,040 | ---- | C] () -- C:\Documents and Settings\Dustin\Application Data\swfstats.sol
[2011/05/03 14:35:02 | 000,000,120 | ---- | C] () -- C:\WINDOWS.1\Adimuqerof.dat
[2011/05/03 14:35:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS.1\Nyusamepoz.bin
[2011/02/04 16:51:36 | 000,000,664 | ---- | C] () -- C:\WINDOWS.1\System32\d3d9caps.dat
[2011/01/21 12:20:42 | 000,000,056 | -H-- | C] () -- C:\WINDOWS.1\System32\ezsidmv.dat
[2010/01/13 12:02:26 | 000,000,277 | ---- | C] () -- C:\WINDOWS.1\System32\MRT.INI
[2009/11/24 09:31:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS.1\USERSWAP.INI
[2009/11/24 09:16:05 | 000,032,768 | ---- | C] () -- C:\WINDOWS.1\System32\Hlinkprx.dll
[2009/08/12 13:30:32 | 000,042,408 | RHS- | C] () -- C:\WINDOWS.1\System32\flasha132.dll
[2009/08/12 11:07:43 | 000,040,960 | RHS- | C] () -- C:\WINDOWS.1\System32\flasha32.dll
[2009/07/19 13:49:10 | 000,000,256 | ---- | C] () -- C:\WINDOWS.1\System32\pool.bin
[2009/07/05 15:28:27 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\0101120101465749.dat
[2009/07/05 15:28:25 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\0101120101465752.dat
[2009/07/05 14:28:23 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\0101120101464849.dat
[2009/07/05 14:28:22 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\010112010146118114.dat
[2009/04/15 12:27:54 | 000,011,776 | ---- | C] () -- C:\WINDOWS.1\System32\Proph32.dll
[2009/04/15 12:27:45 | 000,077,824 | ---- | C] () -- C:\WINDOWS.1\System32\ProphSMTP.dll
[2009/04/15 12:27:11 | 000,001,292 | ---- | C] () -- C:\WINDOWS.1\ODBC.INI
[2009/04/15 12:26:32 | 000,000,661 | ---- | C] () -- C:\WINDOWS.1\Proph2.ini
[2009/04/15 12:26:29 | 000,748,160 | ---- | C] () -- C:\WINDOWS.1\System32\co2c40en.dll
[2009/04/15 12:26:29 | 000,153,761 | ---- | C] () -- C:\WINDOWS.1\System32\u2frtf.dll
[2009/04/15 12:26:29 | 000,124,256 | ---- | C] () -- C:\WINDOWS.1\System32\u2dmapi.dll
[2009/04/15 12:26:29 | 000,109,568 | ---- | C] () -- C:\WINDOWS.1\System32\u2fhtml.dll
[2009/04/15 12:26:29 | 000,097,489 | ---- | C] () -- C:\WINDOWS.1\System32\u2fcr.dll
[2009/04/15 12:26:29 | 000,069,632 | ---- | C] () -- C:\WINDOWS.1\System32\u2fxls.dll
[2009/04/15 12:26:29 | 000,069,632 | ---- | C] () -- C:\WINDOWS.1\System32\u2fwordw.dll
[2009/04/15 12:26:29 | 000,054,272 | ---- | C] () -- C:\WINDOWS.1\System32\p2irdao.dll
[2009/04/15 12:26:29 | 000,053,248 | ---- | C] () -- C:\WINDOWS.1\System32\u2fwks.dll
[2009/04/15 12:26:29 | 000,053,248 | ---- | C] () -- C:\WINDOWS.1\System32\u2ftext.dll
[2009/04/15 12:26:29 | 000,053,248 | ---- | C] () -- C:\WINDOWS.1\System32\u2fsepv.dll
[2009/04/15 12:26:29 | 000,050,176 | ---- | C] () -- C:\WINDOWS.1\System32\p2ctdao.dll
[2009/04/15 12:26:29 | 000,049,152 | ---- | C] () -- C:\WINDOWS.1\System32\u2frec.dll
[2009/04/15 12:26:29 | 000,049,152 | ---- | C] () -- C:\WINDOWS.1\System32\u2fdif.dll
[2009/04/15 12:26:29 | 000,045,056 | ---- | C] () -- C:\WINDOWS.1\System32\u2ddisk.dll
[2009/04/15 12:26:29 | 000,036,352 | ---- | C] () -- C:\WINDOWS.1\System32\p2bbnd.dll
[2009/04/08 16:46:08 | 000,110,293 | R--- | C] () -- C:\WINDOWS.1\System32\atiicdxx.dat
[2009/04/08 16:45:20 | 000,135,168 | R--- | C] () -- C:\WINDOWS.1\System32\RtlCPAPI.dll
[2009/04/08 16:45:20 | 000,040,960 | ---- | C] () -- C:\WINDOWS.1\System32\ChCfg.exe
[2009/04/07 18:06:48 | 000,056,832 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/03 16:04:18 | 000,000,335 | ---- | C] () -- C:\WINDOWS.1\TRPMAKER.INI
[2009/04/01 15:29:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS.1\bootstat.dat
[2009/04/01 15:22:58 | 000,021,640 | ---- | C] () -- C:\WINDOWS.1\System32\emptyregdb.dat
[2009/04/01 07:16:44 | 000,004,249 | ---- | C] () -- C:\WINDOWS.1\ODBCINST.INI
[2009/04/01 06:45:12 | 000,200,936 | ---- | C] () -- C:\WINDOWS.1\System32\FNTCACHE.DAT
[2004/08/03 22:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS.1\System32\mlang.dat
[2004/08/03 22:00:00 | 000,432,686 | ---- | C] () -- C:\WINDOWS.1\System32\perfh009.dat
[2004/08/03 22:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS.1\System32\perfi009.dat
[2004/08/03 22:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS.1\System32\dssec.dat
[2004/08/03 22:00:00 | 000,067,516 | ---- | C] () -- C:\WINDOWS.1\System32\perfc009.dat
[2004/08/03 22:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS.1\System32\mib.bin
[2004/08/03 22:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS.1\System32\perfd009.dat
[2004/08/03 22:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS.1\System32\secupd.dat
[2004/08/03 22:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS.1\System32\Dcache.bin
[2004/08/03 22:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS.1\System32\noise.dat
[2004/07/29 15:49:10 | 013,107,200 | ---- | C] () -- C:\WINDOWS.1\System32\oembios.bin
[2004/07/29 15:48:26 | 000,005,151 | ---- | C] () -- C:\WINDOWS.1\System32\oembios.dat
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS.1\System32\OUTLPERF.INI
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2007/01/12 02:22:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SampleView
[2008/09/09 14:32:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Screaming Bee
[2008/04/30 06:59:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SecondLife
[2007/02/22 15:01:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\uTorrent
[2009/03/11 10:16:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2007/12/11 13:44:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Prophesy
[2008/09/09 11:16:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Screaming Bee
[2009/06/17 14:09:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\3DVIA
[2011/05/05 09:12:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\AVG10
[2010/10/18 10:03:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\avg9
[2010/10/18 10:08:48 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\Common Files
[2011/06/08 16:08:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\kP28321PiDaL28321
[2011/04/15 09:45:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\MFAData
[2009/04/15 12:26:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\Prophesy
[2011/06/30 10:18:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\Xerox
[2007/01/12 02:22:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\SampleView
[2010/11/04 15:38:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dustin\Application Data\.minecraft
[2010/05/07 12:15:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dustin\Application Data\AnvSoft
[2010/10/18 10:09:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dustin\Application Data\AVG10
[2010/03/04 13:56:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dustin\Application Data\ManyCam
[2010/06/07 09:33:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dustin\Application Data\Octoshape
[2011/06/14 12:41:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dustin\Application Data\SecondLife
[2011/06/30 10:18:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dustin\Application Data\Xerox
[2011/07/28 10:01:00 | 000,000,236 | ---- | M] () -- C:\WINDOWS.1\Tasks\Scheduled Update for Ask Toolbar.job
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Custom Scans ==========[/color]
 
 
[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
 
[color=#A23BEC]< %USERPROFILE%\..|smtmp;true;true;true /FP >[/color]
 
 
[color=#A23BEC]< MD5 for: EXPLORER.EXE  >[/color]
[2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS.1\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS.1\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\explorer.exe
[2007/06/13 04:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS.1\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 04:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS.1\explorer.exe
[2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS.1\system32\dllcache\explorer.exe
[2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/03 22:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS.1\$NtUninstallKB938828$\explorer.exe
[2004/08/04 19:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
 
[color=#A23BEC]< MD5 for: SVCHOST.EXE  >[/color]
[2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS.1\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS.1\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2004/08/03 22:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS.1\system32\dllcache\svchost.exe
[2004/08/03 22:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS.1\system32\svchost.exe
[2004/08/04 19:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
 
[color=#A23BEC]< MD5 for: USERINIT.EXE  >[/color]
[2004/08/03 22:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS.1\system32\dllcache\userinit.exe
[2004/08/03 22:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS.1\system32\userinit.exe
[2004/08/04 19:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS.1\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS.1\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
 
[color=#A23BEC]< MD5 for: WINLOGON.EXE  >[/color]
[2004/08/03 22:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS.1\system32\dllcache\winlogon.exe
[2004/08/03 22:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS.1\system32\winlogon.exe
[2004/08/04 19:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS.1\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS.1\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
 
[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]
 
[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS.1\system32\ie4uinit.exe" -reinstall [2010/05/05 06:30:57 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS.1\system32\ie4uinit.exe" -hide [2010/05/05 06:30:57 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS.1\system32\ie4uinit.exe" -show [2010/05/05 06:30:57 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Documents and Settings\Dustin\Local Settings\Application Data\yjh.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"
 
[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS.1\system32\ie4uinit.exe" -reinstall [2010/05/05 06:30:57 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS.1\system32\ie4uinit.exe" -hide [2010/05/05 06:30:57 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS.1\system32\ie4uinit.exe" -show [2010/05/05 06:30:57 | 000,173,056 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Documents and Settings\Dustin\Local Settings\Application Data\yjh.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"

< End of report >

Edited by Keman, 28 July 2011 - 12:00 PM.

#2
SweetTech

Posted 28 July 2011 - 12:14 PM

Sir SpamAlot

Retired Staff
7,671 posts

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. :unsure:

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

OTL Fix

We need to run an OTL Fix

Please reopen on your desktop.

Copy and Paste the following code into the Posted Image

textbox.

:Services
:Processes
KILLALLPROCESSES
:OTL
MOD - [2009/08/12 13:30:32 | 000,042,408 | RHS- | M] () -- C:\WINDOWS.1\system32\flasha132.dll
MOD - [2009/08/12 11:07:43 | 000,040,960 | RHS- | M] () -- C:\WINDOWS.1\system32\flasha32.dll
SRV - File not found [Auto | Stopped] --  -- (RoxLiveShare9)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\..\Toolbar\WebBrowser: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No CLSID value found.
O4 - HKU\S-1-5-21-1482476501-117609710-839522115-1003..\Run: [Wisdom-soft AutoScreenRecorder 3.1 Pro]  File not found
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O28 - HKLM ShellExecuteHooks: {58101905-D80F-4788-96F6-98618686178A} - C:\WINDOWS.1\system32\flasha32.dll ()
O28 - HKLM ShellExecuteHooks: {68101905-D80F-4788-96F6-98618686178A} - C:\WINDOWS.1\system32\flasha132.dll ()
O33 - MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS.1\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
O33 - MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\Shell - "" = AutoRun
O33 - MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O35 - HKU\S-1-5-21-1482476501-117609710-839522115-1003..exefile [open] -- "C:\Documents and Settings\Dustin\Local Settings\Application Data\yjh.exe" -a "%1" %*
O37 - HKU\S-1-5-21-1482476501-117609710-839522115-1003\...exe [@ = exefile] -- "C:\Documents and Settings\Dustin\Local Settings\Application Data\yjh.exe" -a "%1" %*
[2011/07/28 11:57:01 | 000,001,292 | -HS- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:57:01 | 000,001,292 | -HS- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:56:51 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\yxtc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\ysoq.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\trxu.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\oxre.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\isxc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\dpwd.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\cdsr.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\catv.exe
[2011/06/29 12:46:07 | 000,000,120 | ---- | M] () -- C:\WINDOWS.1\Adimuqerof.dat
[2011/06/29 08:44:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS.1\Nyusamepoz.bin
[2011/07/28 11:56:53 | 000,001,292 | -HS- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:56:53 | 000,001,292 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t
[2011/07/28 11:56:51 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\yxtc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\ysoq.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\trxu.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\oxre.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\isxc.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\dpwd.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\cdsr.exe
[2011/07/28 11:56:50 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dustin\Local Settings\Application Data\catv.exe
[2011/05/03 14:35:02 | 000,000,120 | ---- | C] () -- C:\WINDOWS.1\Adimuqerof.dat
[2011/05/03 14:35:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS.1\Nyusamepoz.bin
[2009/08/12 13:30:32 | 000,042,408 | RHS- | C] () -- C:\WINDOWS.1\System32\flasha132.dll
[2009/08/12 11:07:43 | 000,040,960 | RHS- | C] () -- C:\WINDOWS.1\System32\flasha32.dll
[2009/07/05 15:28:27 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\0101120101465749.dat
[2009/07/05 15:28:25 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\0101120101465752.dat
[2009/07/05 14:28:23 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\0101120101464849.dat
[2009/07/05 14:28:22 | 000,000,002 | ---- | C] () -- C:\WINDOWS.1\010112010146118114.dat
[2011/06/08 16:08:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.1\Application Data\kP28321PiDaL28321

:Reg
:Files
C:\Documents and Settings\All Users.WINDOWS.1\Application Data\kP28321PiDaL28321
echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[CreateRestorePoint]
[emptytemp]
[EMPTYFLASH]

Push
OTL may ask to reboot the machine. Please do so if asked.
Click the OK button.
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Scanning with GMER

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

Notes:
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

NEXT:

What issues are you currently experiencing with your computer

#3
Keman

Posted 28 July 2011 - 01:14 PM

Member

Topic Starter
Member
36 posts

Thank you for your time and all the help ST

Here is the GMER log

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-07-28 12:09:00
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7 ST3160812AS rev.3.AAE
Running: gmer.exe; Driver: C:\DOCUME~1\Dustin\LOCALS~1\Temp\pxldapow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwOpenProcess [0xF7851738]
SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateProcess [0xF78517DC]
SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateThread [0xF7851878]
SSDT            \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwWriteVirtualMemory [0xF7851914]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!CreateWindowExW                                            7E41FC25 5 Bytes  JMP 3E2EDB1C C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!DialogBoxParamW                                            7E42555F 5 Bytes  JMP 3E2154C5 C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!DialogBoxIndirectParamW                                    7E432032 5 Bytes  JMP 3E3E480F C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!MessageBoxIndirectA                                        7E43A04A 5 Bytes  JMP 3E3E4741 C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!DialogBoxParamA                                            7E43B10C 5 Bytes  JMP 3E3E47AC C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!MessageBoxExW                                              7E4505D8 5 Bytes  JMP 3E3E4612 C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!MessageBoxExA                                              7E4505FC 5 Bytes  JMP 3E3E4674 C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!DialogBoxIndirectParamA                                    7E456B50 5 Bytes  JMP 3E3E4872 C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] USER32.dll!MessageBoxIndirectW                                        7E4662AB 5 Bytes  JMP 3E3E46D6 C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\IEXPLORE.EXE[3156] ole32.dll!OleLoadFromStream                                           7752A257 5 Bytes  JMP 3E3E4B77 C:\WINDOWS.1\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                      AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                    avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                   avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                   avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                 avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                    fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                    AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

---- Disk sectors - GMER 1.0.15 ----

Disk            \Device\Harddisk0\DR0                                                                                                       malicious Win32:MBRoot code @ sector 61
Disk            \Device\Harddisk0\DR0                                                                                                       PE file @ sector 312560640

---- EOF - GMER 1.0.15 ----

#4
SweetTech

Posted 28 July 2011 - 01:24 PM

Sir SpamAlot

Retired Staff
7,671 posts

Hi!

No problem!

Do you have the OTL fix log for me to review?

#5
Keman

Posted 28 July 2011 - 01:54 PM

Member

Topic Starter
Member
36 posts

OTL fix log

All processes killed
========== SERVICES/DRIVERS ==========
========== PROCESSES ==========
========== OTL ==========
Service RoxLiveShare9 stopped successfully!
Service RoxLiveShare9 deleted successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1482476501-117609710-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B}\ not found.
Registry value HKEY_USERS\S-1-5-21-1482476501-117609710-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Wisdom-soft AutoScreenRecorder 3.1 Pro deleted successfully.
Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}
C:\WINDOWS.1\Downloaded Program Files\wvc1dmo.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31435657-9980-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS.1\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS.1\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{58101905-D80F-4788-96F6-98618686178A} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58101905-D80F-4788-96F6-98618686178A}\ deleted successfully.
C:\WINDOWS.1\system32\flasha32.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{68101905-D80F-4788-96F6-98618686178A} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68101905-D80F-4788-96F6-98618686178A}\ deleted successfully.
C:\WINDOWS.1\system32\flasha132.dll moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006881d3-1ec2-11de-ae2c-806d6172696f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006881d3-1ec2-11de-ae2c-806d6172696f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{006881d3-1ec2-11de-ae2c-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006881d3-1ec2-11de-ae2c-806d6172696f}\ not found.
File C:\WINDOWS.1\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d26c9c40-14df-11df-9711-0019db3013c4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d26c9c40-14df-11df-9711-0019db3013c4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d26c9c40-14df-11df-9711-0019db3013c4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d26c9c40-14df-11df-9711-0019db3013c4}\ not found.
File F:\LaunchU3.exe not found.
Registry value HKEY_USERS\S-1-5-21-1482476501-117609710-839522115-1003_Classes\exefile\shell\open\command\\'' updated successfully.
File "C:\Documents and Settings\Dustin\Local Settings\Application Data\yjh.exe" -a "%1" %* not found.
Registry key HKEY_USERS\S-1-5-21-1482476501-117609710-839522115-1003_Classes\.exe\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1482476501-117609710-839522115-1003_Classes\exefile\ deleted successfully.
HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!
C:\Documents and Settings\Dustin\Local Settings\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t moved successfully.
C:\Documents and Settings\All Users.WINDOWS.1\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t moved successfully.
C:\Documents and Settings\All Users.WINDOWS.1\Application Data\yxtc.exe moved successfully.
C:\Documents and Settings\Dustin\Local Settings\Application Data\ysoq.exe moved successfully.
C:\Documents and Settings\All Users.WINDOWS.1\Application Data\trxu.exe moved successfully.
C:\Documents and Settings\All Users.WINDOWS.1\Application Data\oxre.exe moved successfully.
C:\Documents and Settings\Dustin\Local Settings\Application Data\isxc.exe moved successfully.
C:\Documents and Settings\Dustin\Local Settings\Application Data\dpwd.exe moved successfully.
C:\Documents and Settings\All Users.WINDOWS.1\Application Data\cdsr.exe moved successfully.
C:\Documents and Settings\Dustin\Local Settings\Application Data\catv.exe moved successfully.
C:\WINDOWS.1\Adimuqerof.dat moved successfully.
C:\WINDOWS.1\Nyusamepoz.bin moved successfully.
File C:\Documents and Settings\Dustin\Local Settings\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t not found.
File C:\Documents and Settings\All Users.WINDOWS.1\Application Data\w2x5rulex117s1qlc43ckh03v72uh46412182t not found.
File C:\Documents and Settings\All Users.WINDOWS.1\Application Data\yxtc.exe not found.
File C:\Documents and Settings\Dustin\Local Settings\Application Data\ysoq.exe not found.
File C:\Documents and Settings\All Users.WINDOWS.1\Application Data\trxu.exe not found.
File C:\Documents and Settings\All Users.WINDOWS.1\Application Data\oxre.exe not found.
File C:\Documents and Settings\Dustin\Local Settings\Application Data\isxc.exe not found.
File C:\Documents and Settings\Dustin\Local Settings\Application Data\dpwd.exe not found.
File C:\Documents and Settings\All Users.WINDOWS.1\Application Data\cdsr.exe not found.
File C:\Documents and Settings\Dustin\Local Settings\Application Data\catv.exe not found.
File C:\WINDOWS.1\Adimuqerof.dat not found.
File C:\WINDOWS.1\Nyusamepoz.bin not found.
File C:\WINDOWS.1\System32\flasha132.dll not found.
File C:\WINDOWS.1\System32\flasha32.dll not found.
C:\WINDOWS.1\0101120101465749.dat moved successfully.
C:\WINDOWS.1\0101120101465752.dat moved successfully.
C:\WINDOWS.1\0101120101464849.dat moved successfully.
C:\WINDOWS.1\010112010146118114.dat moved successfully.
Folder C:\Documents and Settings\All Users.WINDOWS.1\Application Data\kP28321PiDaL28321\ not found.
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\All Users.WINDOWS.1\Application Data\kP28321PiDaL28321 folder moved successfully.
[color=#A23BEC]< echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c  >[/color]
Are you sure (Y/N)?
C:\Documents and Settings\Dustin\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Dustin\Desktop\cmd.txt deleted successfully.
[color=#A23BEC]< ipconfig /flushdns /c  >[/color]
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Dustin\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Dustin\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
HOSTS file reset successfully
Restore point Set: OTL Restore Point (0)
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: All Users.WINDOWS.1
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User.WINDOWS.1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: Dustin
->Temp folder emptied: 91702300 bytes
->Temporary Internet Files folder emptied: 297016820 bytes
->Java cache emptied: 524643 bytes
->Flash cache emptied: 509 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 36262 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1467748 bytes
->Flash cache emptied: 0 bytes
 
User: Owner
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 338881 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 66020088 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 86738 bytes
 
Total Files Cleaned = 436.00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: All Users.WINDOWS.1
 
User: Default User
 
User: Default User.WINDOWS.1
->Flash cache emptied: 0 bytes
 
User: Dustin
->Flash cache emptied: 0 bytes
 
User: LocalService
 
User: LocalService.NT AUTHORITY
->Flash cache emptied: 0 bytes
 
User: NetworkService
 
User: NetworkService.NT AUTHORITY
->Flash cache emptied: 0 bytes
 
User: Owner
 
Total Flash Files Cleaned = 0.00 mb
 
 
OTL by OldTimer - Version 3.2.26.1 log created on 07282011_114647

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

#6
SweetTech

Posted 28 July 2011 - 01:58 PM

Sir SpamAlot

Retired Staff
7,671 posts

Hi!

It'd be helpful if you could just post the logs regularly, and not in any [code=auto:0] or [quote] tags.

Please run this scan and let me know what issues you're experiencing in your next reply.

Running TDSSKiller

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

#7
Keman

Posted 28 July 2011 - 02:12 PM

Member

Topic Starter
Member
36 posts

The problem is that when ever you try to open a progam it comes up asking you what you want to use to open it. That goes for IE, System restore, paint, and all programs.

TDS Log

2011/07/28 13:07:50.0359 1020 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/28 13:07:50.0796 1020 ================================================================================
2011/07/28 13:07:50.0796 1020 SystemInfo:
2011/07/28 13:07:50.0796 1020
2011/07/28 13:07:50.0796 1020 OS Version: 5.1.2600 ServicePack: 2.0
2011/07/28 13:07:50.0796 1020 Product type: Workstation
2011/07/28 13:07:50.0796 1020 ComputerName: DUSTINS
2011/07/28 13:07:50.0796 1020 UserName: Dustin
2011/07/28 13:07:50.0796 1020 Windows directory: C:\WINDOWS.1
2011/07/28 13:07:50.0796 1020 System windows directory: C:\WINDOWS.1
2011/07/28 13:07:50.0796 1020 Processor architecture: Intel x86
2011/07/28 13:07:50.0796 1020 Number of processors: 2
2011/07/28 13:07:50.0796 1020 Page size: 0x1000
2011/07/28 13:07:50.0796 1020 Boot type: Normal boot
2011/07/28 13:07:50.0796 1020 ================================================================================
2011/07/28 13:07:51.0296 1020 Initialize success
2011/07/28 13:08:08.0578 2532 ================================================================================
2011/07/28 13:08:08.0578 2532 Scan started
2011/07/28 13:08:08.0578 2532 Mode: Manual;
2011/07/28 13:08:08.0578 2532 ================================================================================
2011/07/28 13:08:08.0875 2532 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS.1\system32\DRIVERS\ACPI.sys
2011/07/28 13:08:08.0921 2532 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS.1\system32\drivers\ACPIEC.sys
2011/07/28 13:08:09.0015 2532 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS.1\system32\drivers\aec.sys
2011/07/28 13:08:09.0078 2532 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS.1\System32\drivers\afd.sys
2011/07/28 13:08:09.0281 2532 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS.1\system32\DRIVERS\asyncmac.sys
2011/07/28 13:08:09.0312 2532 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS.1\system32\DRIVERS\atapi.sys
2011/07/28 13:08:09.0390 2532 ati2mtag (cd35697cb6c7e081effa98f46023e10b) C:\WINDOWS.1\system32\DRIVERS\ati2mtag.sys
2011/07/28 13:08:09.0437 2532 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS.1\system32\DRIVERS\atmarpc.sys
2011/07/28 13:08:09.0484 2532 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS.1\system32\DRIVERS\audstub.sys
2011/07/28 13:08:09.0531 2532 AVGIDSDriver (c403e7f715bb0a851a9dfae16ec4ae42) C:\WINDOWS.1\system32\DRIVERS\AVGIDSDriver.Sys
2011/07/28 13:08:09.0578 2532 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS.1\system32\DRIVERS\AVGIDSEH.Sys
2011/07/28 13:08:09.0593 2532 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS.1\system32\DRIVERS\AVGIDSFilter.Sys
2011/07/28 13:08:09.0625 2532 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS.1\system32\DRIVERS\AVGIDSShim.Sys
2011/07/28 13:08:09.0656 2532 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS.1\system32\DRIVERS\avgldx86.sys
2011/07/28 13:08:09.0687 2532 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS.1\system32\DRIVERS\avgmfx86.sys
2011/07/28 13:08:09.0703 2532 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS.1\system32\DRIVERS\avgrkx86.sys
2011/07/28 13:08:09.0734 2532 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS.1\system32\DRIVERS\avgtdix.sys
2011/07/28 13:08:09.0781 2532 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS.1\system32\drivers\Beep.sys
2011/07/28 13:08:09.0828 2532 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS.1\system32\drivers\cbidf2k.sys
2011/07/28 13:08:09.0859 2532 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS.1\system32\DRIVERS\CCDECODE.sys
2011/07/28 13:08:09.0921 2532 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS.1\system32\drivers\Cdaudio.sys
2011/07/28 13:08:09.0953 2532 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS.1\system32\drivers\Cdfs.sys
2011/07/28 13:08:09.0984 2532 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS.1\system32\DRIVERS\cdrom.sys
2011/07/28 13:08:10.0109 2532 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS.1\system32\DRIVERS\disk.sys
2011/07/28 13:08:10.0156 2532 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS.1\system32\drivers\dmboot.sys
2011/07/28 13:08:10.0203 2532 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS.1\system32\drivers\dmio.sys
2011/07/28 13:08:10.0250 2532 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS.1\system32\drivers\dmload.sys
2011/07/28 13:08:10.0296 2532 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS.1\system32\drivers\DMusic.sys
2011/07/28 13:08:10.0390 2532 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS.1\system32\drivers\drmkaud.sys
2011/07/28 13:08:10.0437 2532 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS.1\system32\drivers\Fastfat.sys
2011/07/28 13:08:10.0468 2532 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS.1\system32\DRIVERS\fdc.sys
2011/07/28 13:08:10.0500 2532 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS.1\system32\drivers\Fips.sys
2011/07/28 13:08:10.0531 2532 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS.1\system32\drivers\Flpydisk.sys
2011/07/28 13:08:10.0562 2532 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS.1\system32\DRIVERS\fltMgr.sys
2011/07/28 13:08:10.0609 2532 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS.1\system32\drivers\Fs_Rec.sys
2011/07/28 13:08:10.0656 2532 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS.1\system32\DRIVERS\ftdisk.sys
2011/07/28 13:08:10.0687 2532 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS.1\system32\DRIVERS\msgpc.sys
2011/07/28 13:08:10.0718 2532 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS.1\system32\DRIVERS\HDAudBus.sys
2011/07/28 13:08:10.0765 2532 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS.1\system32\DRIVERS\hidusb.sys
2011/07/28 13:08:10.0812 2532 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS.1\system32\Drivers\HTTP.sys
2011/07/28 13:08:10.0890 2532 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS.1\system32\DRIVERS\i8042prt.sys
2011/07/28 13:08:10.0937 2532 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS.1\system32\DRIVERS\imapi.sys
2011/07/28 13:08:11.0109 2532 IntcAzAudAddService (0782317ca4b1c229a0854c998c4595fe) C:\WINDOWS.1\system32\drivers\RtkHDAud.sys
2011/07/28 13:08:11.0203 2532 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS.1\system32\DRIVERS\intelppm.sys
2011/07/28 13:08:11.0265 2532 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS.1\system32\DRIVERS\Ip6Fw.sys
2011/07/28 13:08:11.0296 2532 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS.1\system32\DRIVERS\ipfltdrv.sys
2011/07/28 13:08:11.0312 2532 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS.1\system32\DRIVERS\ipinip.sys
2011/07/28 13:08:11.0343 2532 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS.1\system32\DRIVERS\ipnat.sys
2011/07/28 13:08:11.0390 2532 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS.1\system32\DRIVERS\ipsec.sys
2011/07/28 13:08:11.0421 2532 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS.1\system32\DRIVERS\irenum.sys
2011/07/28 13:08:11.0453 2532 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS.1\system32\DRIVERS\isapnp.sys
2011/07/28 13:08:11.0484 2532 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS.1\system32\DRIVERS\kbdclass.sys
2011/07/28 13:08:11.0531 2532 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS.1\system32\drivers\kmixer.sys
2011/07/28 13:08:11.0562 2532 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS.1\system32\drivers\KSecDD.sys
2011/07/28 13:08:11.0640 2532 ManyCam (c6d085c7045200143528136a43a65fde) C:\WINDOWS.1\system32\DRIVERS\ManyCam.sys
2011/07/28 13:08:11.0671 2532 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS.1\system32\drivers\mnmdd.sys
2011/07/28 13:08:11.0703 2532 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS.1\system32\drivers\Modem.sys
2011/07/28 13:08:11.0750 2532 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS.1\system32\DRIVERS\mouclass.sys
2011/07/28 13:08:11.0765 2532 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS.1\system32\DRIVERS\mouhid.sys
2011/07/28 13:08:11.0796 2532 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS.1\system32\drivers\MountMgr.sys
2011/07/28 13:08:11.0843 2532 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS.1\system32\DRIVERS\mrxdav.sys
2011/07/28 13:08:11.0875 2532 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS.1\system32\DRIVERS\mrxsmb.sys
2011/07/28 13:08:11.0906 2532 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS.1\system32\drivers\Msfs.sys
2011/07/28 13:08:11.0953 2532 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS.1\system32\drivers\MSKSSRV.sys
2011/07/28 13:08:11.0968 2532 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS.1\system32\drivers\MSPCLOCK.sys
2011/07/28 13:08:11.0984 2532 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS.1\system32\drivers\MSPQM.sys
2011/07/28 13:08:12.0031 2532 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS.1\system32\DRIVERS\mssmbios.sys
2011/07/28 13:08:12.0046 2532 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS.1\system32\drivers\MSTEE.sys
2011/07/28 13:08:12.0078 2532 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS.1\system32\drivers\Mup.sys
2011/07/28 13:08:12.0109 2532 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS.1\system32\DRIVERS\NABTSFEC.sys
2011/07/28 13:08:12.0140 2532 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS.1\system32\drivers\NDIS.sys
2011/07/28 13:08:12.0156 2532 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS.1\system32\DRIVERS\NdisIP.sys
2011/07/28 13:08:12.0187 2532 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS.1\system32\DRIVERS\ndistapi.sys
2011/07/28 13:08:12.0234 2532 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS.1\system32\DRIVERS\ndisuio.sys
2011/07/28 13:08:12.0250 2532 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS.1\system32\DRIVERS\ndiswan.sys
2011/07/28 13:08:12.0343 2532 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS.1\system32\drivers\NDProxy.sys
2011/07/28 13:08:12.0375 2532 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS.1\system32\DRIVERS\netbios.sys
2011/07/28 13:08:12.0406 2532 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS.1\system32\DRIVERS\netbt.sys
2011/07/28 13:08:12.0437 2532 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS.1\system32\drivers\Npfs.sys
2011/07/28 13:08:12.0468 2532 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS.1\system32\drivers\Ntfs.sys
2011/07/28 13:08:12.0515 2532 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS.1\system32\drivers\Null.sys
2011/07/28 13:08:12.0546 2532 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS.1\system32\DRIVERS\nwlnkflt.sys
2011/07/28 13:08:12.0578 2532 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS.1\system32\DRIVERS\nwlnkfwd.sys
2011/07/28 13:08:12.0625 2532 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS.1\system32\DRIVERS\parport.sys
2011/07/28 13:08:12.0656 2532 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS.1\system32\drivers\PartMgr.sys
2011/07/28 13:08:12.0703 2532 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS.1\system32\drivers\ParVdm.sys
2011/07/28 13:08:12.0734 2532 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS.1\system32\DRIVERS\pci.sys
2011/07/28 13:08:12.0765 2532 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS.1\system32\DRIVERS\pciide.sys
2011/07/28 13:08:12.0812 2532 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS.1\system32\drivers\Pcmcia.sys
2011/07/28 13:08:12.0953 2532 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS.1\system32\DRIVERS\raspptp.sys
2011/07/28 13:08:12.0968 2532 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS.1\system32\DRIVERS\psched.sys
2011/07/28 13:08:13.0000 2532 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS.1\system32\DRIVERS\ptilink.sys
2011/07/28 13:08:13.0046 2532 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS.1\system32\Drivers\PxHelp20.sys
2011/07/28 13:08:13.0156 2532 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS.1\system32\DRIVERS\rasacd.sys
2011/07/28 13:08:13.0187 2532 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS.1\system32\DRIVERS\rasl2tp.sys
2011/07/28 13:08:13.0218 2532 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS.1\system32\DRIVERS\raspppoe.sys
2011/07/28 13:08:13.0234 2532 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS.1\system32\DRIVERS\raspti.sys
2011/07/28 13:08:13.0265 2532 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS.1\system32\DRIVERS\rdbss.sys
2011/07/28 13:08:13.0296 2532 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS.1\system32\DRIVERS\RDPCDD.sys
2011/07/28 13:08:13.0343 2532 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS.1\system32\DRIVERS\rdpdr.sys
2011/07/28 13:08:13.0390 2532 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS.1\system32\drivers\RDPWD.sys
2011/07/28 13:08:13.0437 2532 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS.1\system32\DRIVERS\redbook.sys
2011/07/28 13:08:13.0484 2532 RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d) C:\WINDOWS.1\system32\DRIVERS\RimSerial.sys
2011/07/28 13:08:13.0531 2532 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS.1\system32\Drivers\RootMdm.sys
2011/07/28 13:08:13.0593 2532 RTL8023xp (e9877aa069dc11b03dbd1d33b8b2a3ca) C:\WINDOWS.1\system32\DRIVERS\Rtlnicxp.sys
2011/07/28 13:08:13.0640 2532 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS.1\system32\DRIVERS\secdrv.sys
2011/07/28 13:08:13.0671 2532 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS.1\system32\DRIVERS\serenum.sys
2011/07/28 13:08:13.0687 2532 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS.1\system32\DRIVERS\serial.sys
2011/07/28 13:08:13.0718 2532 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS.1\system32\drivers\Sfloppy.sys
2011/07/28 13:08:13.0781 2532 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS.1\system32\DRIVERS\SLIP.sys
2011/07/28 13:08:13.0843 2532 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS.1\system32\drivers\splitter.sys
2011/07/28 13:08:13.0875 2532 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS.1\system32\DRIVERS\sr.sys
2011/07/28 13:08:13.0906 2532 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS.1\system32\DRIVERS\srv.sys
2011/07/28 13:08:13.0937 2532 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS.1\system32\DRIVERS\StreamIP.sys
2011/07/28 13:08:13.0968 2532 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS.1\system32\DRIVERS\swenum.sys
2011/07/28 13:08:14.0015 2532 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS.1\system32\drivers\swmidi.sys
2011/07/28 13:08:14.0093 2532 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS.1\system32\drivers\sysaudio.sys
2011/07/28 13:08:14.0156 2532 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS.1\system32\DRIVERS\tcpip.sys
2011/07/28 13:08:14.0187 2532 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS.1\system32\drivers\TDPIPE.sys
2011/07/28 13:08:14.0218 2532 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS.1\system32\drivers\TDTCP.sys
2011/07/28 13:08:14.0250 2532 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS.1\system32\DRIVERS\termdd.sys
2011/07/28 13:08:14.0328 2532 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS.1\system32\drivers\Udfs.sys
2011/07/28 13:08:14.0390 2532 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS.1\system32\DRIVERS\update.sys
2011/07/28 13:08:14.0437 2532 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS.1\system32\DRIVERS\usbccgp.sys
2011/07/28 13:08:14.0453 2532 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS.1\system32\DRIVERS\usbehci.sys
2011/07/28 13:08:14.0500 2532 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS.1\system32\DRIVERS\usbhub.sys
2011/07/28 13:08:14.0515 2532 usbohci (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS.1\system32\DRIVERS\usbohci.sys
2011/07/28 13:08:14.0546 2532 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS.1\system32\DRIVERS\usbscan.sys
2011/07/28 13:08:14.0578 2532 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS.1\system32\DRIVERS\USBSTOR.SYS
2011/07/28 13:08:14.0625 2532 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS.1\System32\drivers\vga.sys
2011/07/28 13:08:14.0671 2532 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS.1\system32\drivers\VolSnap.sys
2011/07/28 13:08:14.0703 2532 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS.1\system32\DRIVERS\wanarp.sys
2011/07/28 13:08:14.0750 2532 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS.1\system32\drivers\wdmaud.sys
2011/07/28 13:08:14.0812 2532 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS.1\system32\DRIVERS\WSTCODEC.SYS
2011/07/28 13:08:14.0859 2532 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/07/28 13:08:14.0984 2532 Boot (0x1200) (cfd2f606f1f13e8612bee55a8ed08938) \Device\Harddisk0\DR0\Partition0
2011/07/28 13:08:15.0000 2532 Boot (0x1200) (3034b219128998b90e501cc22e82c5ff) \Device\Harddisk0\DR0\Partition1
2011/07/28 13:08:15.0000 2532 ================================================================================
2011/07/28 13:08:15.0000 2532 Scan finished
2011/07/28 13:08:15.0000 2532 ================================================================================
2011/07/28 13:08:15.0015 3708 Detected object count: 0
2011/07/28 13:08:15.0015 3708 Actual detected object count: 0

Edited by Keman, 28 July 2011 - 02:15 PM.

#8
SweetTech

Posted 28 July 2011 - 02:24 PM

Sir SpamAlot

Retired Staff
7,671 posts

The problem is that when ever you try to open a progam it comes up asking you what you want to use to open it. That goes for IE, System restore, paint, and all programs.

So you're still experiencing this even after running the OTL fix?

Lets try a more powerful tool.

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

#9
Keman

Posted 28 July 2011 - 03:47 PM

Member

Topic Starter
Member
36 posts

just to add its a computer at work and I had to go home for the day, I will do the combo fix first thing tomorrow.

#10
Keman

Posted 29 July 2011 - 07:44 AM

Member

Topic Starter
Member
36 posts

Combo Fix, fixed my problem ^-^

Here is the log

ComboFix 11-07-29.01 - Dustin 07/29/2011 9:04.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.329 [GMT -7:00]
Running from: c:\documents and settings\Dustin\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\Help\xerks.exe
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Dustin\Local Settings\Application Data\{592CB981-8E35-4F0B-95E9-E56C2677B42F}
c:\documents and settings\Dustin\Local Settings\Application Data\{592CB981-8E35-4F0B-95E9-E56C2677B42F}\chrome.manifest
c:\documents and settings\Dustin\Local Settings\Application Data\{592CB981-8E35-4F0B-95E9-E56C2677B42F}\chrome\content\_cfg.js
c:\documents and settings\Dustin\Local Settings\Application Data\{592CB981-8E35-4F0B-95E9-E56C2677B42F}\chrome\content\overlay.xul
c:\documents and settings\Dustin\Local Settings\Application Data\{592CB981-8E35-4F0B-95E9-E56C2677B42F}\install.rdf
c:\documents and settings\Dustin\Templates\w2x5rulex117s1qlc43ckh03v72uh46412182t
c:\windows.1\934fdfg34fgjf23
D:\Autorun.inf
.
c:\windows.1\system32\proquota.exe . . . is missing!!
.
.
((((((((((((((((((((((((( Files Created from 2011-06-28 to 2011-07-29 )))))))))))))))))))))))))))))))
.
.
2011-07-28 18:46 . 2011-07-28 18:46 -------- d-----w- C:\_OTL
2011-06-30 17:41 . 2011-06-30 17:41 -------- d-----w- C:\Scans
2011-06-30 17:18 . 2011-06-30 17:18 -------- d-----w- c:\documents and settings\Dustin\Application Data\Xerox
2011-06-30 17:18 . 2011-06-30 17:18 -------- d-----w- c:\documents and settings\All Users.WINDOWS.1\Application Data\Xerox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-30 17:16 . 2010-12-03 14:16 32256 ----a-w- c:\windows.1\system32\Spool\prtprocs\w32x86\x5pp.dll
2011-06-30 17:16 . 2010-12-03 14:16 10752 ----a-w- c:\windows.1\system32\Spool\prtprocs\w32x86\x5print.dll
2011-06-23 16:41 . 2011-05-19 16:11 404640 ----a-w- c:\windows.1\system32\FlashPlayerCPLApp.cpl
2011-06-16 17:34 . 2011-06-16 17:34 73728 ----a-w- c:\windows.1\system32\javacpl.cpl
2011-06-16 17:34 . 2011-06-16 17:34 472808 ----a-w- c:\windows.1\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-05 00:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-06-01 5252408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-19 15797248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-19 2334560]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Game Vindicator\\Game Vindicator\\GameVindicator.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Documents and Settings\\Dustin\\Application Data\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
"c:\\Program Files\\Prophesy\\Client\\Disp\\prodsp2.exe"=
"\\\\Rons\\Prophecy Host Folder\\Program Files\\Prophesy\\Disp\\DispShip.exe"=
"\\\\Rons\\Prophecy Host Folder\\Program Files\\Prophesy\\ProphFTP.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\SecondLifeViewer2\\SLVoice.exe"=
"c:\\Program Files\\SecondLifeViewer2\\slplugin.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows.1\system32\drivers\AVGIDSEH.sys [9/13/2010 4:27 PM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows.1\system32\drivers\avgrkx86.sys [9/7/2010 3:48 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows.1\system32\drivers\avgldx86.sys [9/7/2010 3:48 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows.1\system32\drivers\avgtdix.sys [9/7/2010 3:49 AM 297168]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows.1\system32\drivers\AVGIDSDriver.sys [8/19/2010 9:42 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows.1\system32\drivers\AVGIDSFilter.sys [8/19/2010 9:42 PM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows.1\system32\drivers\AVGIDSShim.sys [8/19/2010 9:42 PM 27216]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows.1\system32\drivers\ManyCam.sys [1/14/2008 3:06 AM 21632]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WUAUSERV
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-29 c:\windows.1\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-05 00:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.cnn.com/
TCP: DhcpNameServer = 192.168.1.254 192.168.1.254
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-29 09:12
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(812)
c:\windows.1\system32\Ati2evxx.dll
.
Completion time: 2011-07-29 09:14:43
ComboFix-quarantined-files.txt 2011-07-29 16:14
.
Pre-Run: 116,789,518,336 bytes free
Post-Run: 116,740,657,152 bytes free
.
- - End Of File - - 1E3204F9532BC6CAF999EE2380C27942

Thank you and all the tech people here on this site (though mainly just you since you fixed my problem this time =P) you all are freaking awsome! ~_^

#11
SweetTech

Posted 29 July 2011 - 03:47 PM

Sir SpamAlot

Retired Staff
7,671 posts

Hi!

Great glad to hear things are running better!

We still have some work to do.

ComboFix Script

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::
MIA::
c:\windows.1\system32\proquota.exe

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

Posted Image

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. If ComboFix prompts you to update to the newest version, please allow it to do so. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT:

Scanning with MalwareBytes' Anti-Malware

Please download Malwarebytes' Anti-Malware (v1.51.0.1200) and save it to your desktop.
Download Link 1
Download Link 2Malwarebytes' may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Make sure you are connected to the Internet and double-click on mbam-setup.exe to install the application.
For instructions with screenshots, please refer to this Guide.
When the installation begins, follow the prompts and do not make any changes to default settings.
Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
If an update is found, the program will automatically update itself. Press the OK button and continue.
If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
Click on the Scan button.
When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
Make sure that everything is checked and then click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
Exit Malwarebytes' when done.

Note: If Malwarebytes' encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes' from removing all the malware.

NEXT:

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
Check
Click the button.
Accept any security warnings from your browser.
Check
Make sure that the option "Remove found threats" is Unchecked
When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
- Enable Anti-Stealth technology
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push
Push , and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the button.
Push

NEXT:

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

#12
SweetTech

Posted 09 August 2011 - 07:23 AM

Sir SpamAlot

Retired Staff
7,671 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.