[Phenom23]

Hello. I went to a website yesterday to watch some NFL games, and by this morning, I discovered that I had some virus/malware on my computer. I have run Avast and it says "no threat detected." I have run AntiMalware like 7 times, and each time it finds 4-9 threats; I click on "Remove" but each time I run it, I still see more threats. I ran combo fix, thinking it might help, but since I still have the problem, I guess it didn't. Pls help; I am in Pharmacy school, and really need my computer cos school has started. Thanks in advance.

[Advertisements]

Hi,

Please note: ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert". It is NOT for unsupervised use. Please read Combofix's Disclaimer.

Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.





Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Check the box that says Scan All Users.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

[Gammo]

Hi,

Please note: ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert". It is NOT for unsupervised use. Please read Combofix's Disclaimer.

Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.





Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Check the box that says Scan All Users.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

[Phenom23]

Thanks for your urgent reply; I appreciate your help

for OTL.Txt:
nk
[2011/08/14 18:04:48 | 000,179,686 | ---- | C] () -- C:\Documents and Settings\Ikenna\My Documents\secret of the sands3.pdf
[2011/08/14 17:54:10 | 000,212,781 | ---- | C] () -- C:\Documents and Settings\Ikenna\My Documents\secret of the sand.pdf
[2011/08/14 15:17:17 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/07/23 11:08:26 | 000,640,064 | ---- | C] () -- C:\Documents and Settings\Ikenna\Desktop\Nissan 2003 MA.pdf
[2011/05/16 23:05:34 | 000,000,089 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011/02/24 21:13:04 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\PUTTY.RND
[2011/02/11 11:42:55 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/11/04 09:11:07 | 000,093,536 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/09/07 09:34:58 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\$_hpcst$.hpc
[2009/08/29 14:12:44 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Ikenna\Application Data\$_hpcst$.hpc
[2009/07/25 15:24:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2009/07/17 11:27:58 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/07/04 14:59:11 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/04 12:37:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/07/03 23:03:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4864.dll
[2009/07/03 23:02:26 | 000,356,352 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe
[2009/07/03 22:54:42 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2009/07/03 22:34:13 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\fusioncache.dat
[2009/07/03 22:22:33 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/07/03 22:13:17 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/07/03 22:08:57 | 000,295,424 | ---- | C] () -- C:\WINDOWS\System32\termsrv32.dll
[2009/07/03 18:18:28 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/07/03 18:17:10 | 000,151,584 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/05/24 18:16:22 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2005/08/05 14:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/03/22 17:38:24 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/03/22 17:38:24 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 06:00:00 | 000,442,114 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 06:00:00 | 000,071,884 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2011/05/11 21:16:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\aC28601HdOjI28601
[2011/05/11 18:05:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/09/22 13:42:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CambridgeSoft
[2010/05/17 07:12:05 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011/08/13 06:28:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco
[2009/12/21 01:35:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2010/11/03 10:09:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2011/05/11 15:53:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/05/24 22:09:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/18 10:47:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/09/22 11:54:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ikenna\Application Data\GetRightToGo
[2010/07/16 13:09:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ikenna\Application Data\LimeWire
[2010/11/03 10:14:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ikenna\Application Data\Research In Motion
[2011/08/21 07:48:00 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{69FC1740-E663-44F5-942E-CDD3EE4058F9}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >



The OTL.extras did not open; where is the best place to find it?

[Phenom23]

OTL.Txt...it didnt fully paste the first time.

OTL logfile created on: 8/21/2011 7:48:29 AM - Run 3
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\Ikenna\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.37 Mb Total Physical Memory | 496.88 Mb Available Physical Memory | 48.98% Memory free
2.38 Gb Paging File | 2.00 Gb Available in Paging File | 84.06% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 72.47 Gb Total Space | 17.87 Gb Free Space | 24.66% Space Free | Partition Type: NTFS

Computer Name: IK-522E65821607 | User Name: Ikenna | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/08/21 07:47:45 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ikenna\My Documents\Downloads\OTL.scr
PRC - [2011/08/19 19:34:13 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\system32\usrlbva32.exe
PRC - [2011/08/19 19:34:13 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\system32\msvcp6032.exe
PRC - [2011/07/04 06:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/07/04 06:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/03/09 17:49:00 | 000,524,512 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgentUI.exe
PRC - [2011/03/09 17:48:18 | 001,104,608 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe
PRC - [2009/12/17 17:32:30 | 000,497,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
PRC - [2009/11/02 11:30:00 | 002,508,104 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/25 16:32:34 | 000,294,912 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2007/05/10 10:22:32 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
PRC - [2006/05/24 18:28:28 | 000,622,653 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2006/05/24 18:27:10 | 001,372,244 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe


========== Modules (No Company Name) ==========

MOD - [2011/08/21 04:14:42 | 001,287,680 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082100\algo.dll
MOD - [2011/08/18 17:04:46 | 000,208,544 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\11082100\aswRep.dll
MOD - [2011/02/04 18:48:30 | 000,291,840 | ---- | M] () -- C:\WINDOWS\system32\sbe.dll
MOD - [2010/02/05 13:27:45 | 001,291,776 | ---- | M] () -- C:\WINDOWS\system32\quartz.dll
MOD - [2009/09/04 23:15:06 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2008/04/13 19:11:59 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 19:11:51 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2007/07/25 16:25:48 | 000,118,784 | ---- | M] () -- C:\Program Files\Intel\Wireless\Bin\iWMSProv.dll
MOD - [2006/05/24 18:29:44 | 000,053,248 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2011/08/19 19:34:13 | 000,705,024 | ---- | M] (People Can Fly) [Auto | Running] -- C:\WINDOWS\system32\usrlbva32.exe -- (W32Time32)
SRV - [2011/07/04 06:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/03/09 17:48:18 | 001,104,608 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco\Cisco NAC Agent\NACAgent.exe -- (NACAgent)
SRV - [2009/12/17 17:32:30 | 000,497,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/07/25 16:32:34 | 000,294,912 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel®


========== Driver Services (SafeList) ==========

DRV - [2011/07/04 06:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/07/04 06:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/07/04 06:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/07/04 06:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/07/04 06:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/07/04 06:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/07/04 06:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009/12/17 17:18:50 | 000,020,152 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vpnva.sys -- (vpnva)
DRV - [2007/08/08 08:17:54 | 002,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel®
DRV - [2007/05/29 15:29:30 | 000,012,416 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2007/05/10 10:24:34 | 001,222,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2006/11/21 04:25:44 | 000,045,568 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/11/15 00:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/14 19:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/05/24 18:07:18 | 000,328,237 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006/05/24 18:05:26 | 000,023,271 | ---- | M] (Broadcom Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\btserial.sys -- (BTSERIAL)
DRV - [2006/05/24 18:04:04 | 000,851,434 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2006/05/24 18:01:34 | 000,030,427 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2006/05/24 18:01:22 | 000,030,285 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2006/05/24 18:00:50 | 000,066,488 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2006/05/24 17:58:18 | 000,148,900 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2006/05/24 17:57:00 | 000,045,683 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityrespo...er/fix_homepage


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D4 D4 29 01 A6 80 60 4B B0 C7 A0 07 31 A5 C2 BC [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D4 D4 29 01 A6 80 60 4B B0 C7 A0 07 31 A5 C2 BC [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityrespo...er/fix_homepage
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D4 D4 29 01 A6 80 60 4B B0 C7 A0 07 31 A5 C2 BC [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityrespo...er/fix_homepage
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D4 D4 29 01 A6 80 60 4B B0 C7 A0 07 31 A5 C2 BC [binary data]

IE - HKU\S-1-5-21-527237240-1563985344-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-527237240-1563985344-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = D4 D4 29 01 A6 80 60 4B B0 C7 A0 07 31 A5 C2 BC [binary data]
IE - HKU\S-1-5-21-527237240-1563985344-839522115-1003\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-527237240-1563985344-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-527237240-1563985344-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:7
FF - prefs.js..extensions.enabledItems: vshareus@toolbar:1.0.0
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Ikenna\Application Data\Move Networks\plugins\npqmp071705000014.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.17: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.17: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Ikenna\Application Data\Facebook\npfbplugin_1_0_3.dll File not found
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Ikenna\Application Data\Move Networks\plugins\npqmp071705000014.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Ikenna\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Ikenna\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/07/08 19:44:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/20 12:51:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/08/14 19:40:03 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Documents and Settings\Ikenna\Application Data\Move Networks [2010/01/28 12:45:56 | 000,000,000 | ---D | M]

[2009/11/10 15:39:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Extensions
[2009/11/10 15:39:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Extensions\[email protected]
[2011/08/20 21:12:40 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions
[2010/10/24 11:46:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/15 09:37:21 | 000,000,000 | ---D | M] (Uptodown EN Community Toolbar) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{40f5f417-32bb-4296-9446-c1e0094e7d82}
[2011/08/20 22:06:11 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}
[2010/10/31 12:35:43 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\vshareus@toolbar
[2009/08/19 11:55:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Sunbird\Profiles\5zelk060.default\extensions
[2011/05/06 11:34:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2009/08/28 01:59:19 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/08/20 12:51:47 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/11/04 23:46:09 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\mozilla firefox\plugins\NPTURNMED.dll
[2011/05/07 04:32:53 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/08/20 21:13:19 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {0129D4D4-80A6-4B60-B0C7-A00731A5C2Bc} - C:\WINDOWS\system32\audiosrv32.dll (People Can Fly)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {40f5f417-32bb-4296-9446-c1e0094e7d82} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-527237240-1563985344-839522115-1003\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-527237240-1563985344-839522115-1003\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NACAgentUI] C:\Program Files\Cisco\Cisco NAC Agent\NACAgentUI.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - HKU\S-1-5-21-527237240-1563985344-839522115-1003..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - HKU\S-1-5-21-527237240-1563985344-839522115-1003..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Driver performer.lnk = File not found
O4 - Startup: C:\Documents and Settings\HelpAssistant\Start Menu\Programs\Startup\LimeWire On Startup.lnk = File not found
O4 - Startup: C:\Documents and Settings\HelpAssistant\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = File not found
O4 - Startup: C:\Documents and Settings\HelpAssistant\Start Menu\Programs\Startup\Registration .LNK = File not found
O4 - Startup: C:\Documents and Settings\Ikenna\Start Menu\Programs\Startup\AutorunsDisabled [2010/09/06 16:55:48 | 000,000,000 | -H-D | M]
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-527237240-1563985344-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-527237240-1563985344-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-527237240-1563985344-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-527237240-1563985344-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} https://secure3.olem...-xp/webinst.cab (WebBasedClientInstall Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - AppInit_DLLs: (C:\WINDOWS\system32\mscpx32r32.dll) - C:\WINDOWS\system32\mscpx32r32.dll (People Can Fly)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Ikenna\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ikenna\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/03 22:17:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/21 07:44:54 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Ikenna\Recent
[2011/08/21 07:44:54 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/08/20 19:36:25 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/08/20 19:36:25 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/08/20 19:36:25 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/08/20 19:36:25 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/08/20 19:35:44 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/08/20 19:29:07 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/08/19 19:35:03 | 000,705,024 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\msvcp6032.exe
[2011/08/19 19:34:57 | 000,155,648 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\mscpx32r32.dll
[2011/08/19 19:34:53 | 000,705,024 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\usrlbva32.exe
[2011/08/19 19:34:26 | 000,326,656 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\audiosrv32.dll
[2011/08/14 19:39:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011/08/14 19:38:40 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/08/14 19:33:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2011/08/13 07:22:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ikenna\My Documents\PY 3 fall semester
[2011/08/13 06:29:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\Cisco
[2011/08/04 22:22:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2011/08/04 22:22:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2011/07/23 10:26:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\Solid State Networks
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Ikenna\*.tmp files -> C:\Documents and Settings\Ikenna\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/21 07:48:00 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{69FC1740-E663-44F5-942E-CDD3EE4058F9}.job
[2011/08/21 07:39:44 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/21 07:39:43 | 1063,714,816 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/21 06:28:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1563985344-839522115-1003UA.job
[2011/08/20 23:28:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1563985344-839522115-1003Core.job
[2011/08/20 22:29:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/20 21:28:39 | 000,000,019 | ---- | M] () -- C:\WINDOWS\System32\4c24d425
[2011/08/20 21:13:19 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/08/19 19:35:03 | 000,000,100 | ---- | M] () -- C:\WINDOWS\System32\1711981653
[2011/08/19 19:34:57 | 000,155,648 | ---- | M] (People Can Fly) -- C:\WINDOWS\System32\mscpx32r32.dll
[2011/08/19 19:34:26 | 000,326,656 | ---- | M] (People Can Fly) -- C:\WINDOWS\System32\audiosrv32.dll
[2011/08/19 19:34:13 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\System32\usrlbva32.exe
[2011/08/19 19:34:13 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\System32\msvcp6032.exe
[2011/08/14 19:40:04 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/08/14 18:04:48 | 000,179,686 | ---- | M] () -- C:\Documents and Settings\Ikenna\My Documents\secret of the sands3.pdf
[2011/08/14 17:54:12 | 000,212,781 | ---- | M] () -- C:\Documents and Settings\Ikenna\My Documents\secret of the sand.pdf
[2011/08/12 21:13:21 | 000,442,114 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/08/12 21:13:21 | 000,071,884 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/08/11 18:00:36 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/08/10 01:09:47 | 000,002,293 | ---- | M] () -- C:\Documents and Settings\Ikenna\Desktop\Google Chrome.lnk
[2011/08/10 01:09:47 | 000,002,271 | ---- | M] () -- C:\Documents and Settings\Ikenna\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/23 11:08:26 | 000,640,064 | ---- | M] () -- C:\Documents and Settings\Ikenna\Desktop\Nissan 2003 MA.pdf
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Ikenna\*.tmp files -> C:\Documents and Settings\Ikenna\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/20 21:27:32 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\4c24d425
[2011/08/20 19:36:25 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/08/20 19:36:25 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/08/20 19:36:25 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/08/20 19:36:25 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/08/20 19:36:25 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/08/19 19:34:53 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\1711981653
[2011/08/14 19:40:04 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/08/14 19:40:04 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/08/14 18:04:48 | 000,179,686 | ---- | C] () -- C:\Documents and Settings\Ikenna\My Documents\secret of the sands3.pdf
[2011/08/14 17:54:10 | 000,212,781 | ---- | C] () -- C:\Documents and Settings\Ikenna\My Documents\secret of the sand.pdf
[2011/08/14 15:17:17 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/07/23 11:08:26 | 000,640,064 | ---- | C] () -- C:\Documents and Settings\Ikenna\Desktop\Nissan 2003 MA.pdf
[2011/05/16 23:05:34 | 000,000,089 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011/02/24 21:13:04 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\PUTTY.RND
[2011/02/11 11:42:55 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/11/04 09:11:07 | 000,093,536 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/09/07 09:34:58 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\$_hpcst$.hpc
[2009/08/29 14:12:44 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Ikenna\Application Data\$_hpcst$.hpc
[2009/07/25 15:24:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2009/07/17 11:27:58 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/07/04 14:59:11 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/04 12:37:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/07/03 23:03:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4864.dll
[2009/07/03 23:02:26 | 000,356,352 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe
[2009/07/03 22:54:42 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2009/07/03 22:34:13 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\Ikenna\Local Settings\Application Data\fusioncache.dat
[2009/07/03 22:22:33 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/07/03 22:13:17 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/07/03 22:08:57 | 000,295,424 | ---- | C] () -- C:\WINDOWS\System32\termsrv32.dll
[2009/07/03 18:18:28 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/07/03 18:17:10 | 000,151,584 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/05/24 18:16:22 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2005/08/05 14:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/03/22 17:38:24 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/03/22 17:38:24 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 06:00:00 | 000,442,114 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 06:00:00 | 000,071,884 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2011/05/11 21:16:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\aC28601HdOjI28601
[2011/05/11 18:05:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/09/22 13:42:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CambridgeSoft
[2010/05/17 07:12:05 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011/08/13 06:28:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco
[2009/12/21 01:35:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2010/11/03 10:09:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2011/05/11 15:53:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/05/24 22:09:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/18 10:47:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/09/22 11:54:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ikenna\Application Data\GetRightToGo
[2010/07/16 13:09:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ikenna\Application Data\LimeWire
[2010/11/03 10:14:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ikenna\Application Data\Research In Motion
[2011/08/21 07:48:00 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{69FC1740-E663-44F5-942E-CDD3EE4058F9}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

[Gammo]

Hi,

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  SRV - [2011/08/19 19:34:13 | 000,705,024 | ---- | M] (People Can Fly) [Auto | Running] -- C:\WINDOWS\system32\usrlbva32.exe -- (W32Time32)
  FF - prefs.js..extensions.enabledItems: vshareus@toolbar:1.0.0
  [2011/08/15 09:37:21 | 000,000,000 | ---D | M] (Uptodown EN Community Toolbar) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{40f5f417-32bb-4296-9446-c1e0094e7d82}
  [2011/08/20 22:06:11 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}
  [2010/10/31 12:35:43 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\vshareus@toolbar
  O2 - BHO: (no name) - {0129D4D4-80A6-4B60-B0C7-A00731A5C2Bc} - C:\WINDOWS\system32\audiosrv32.dll (People Can Fly)
  O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
  O2 - BHO: (no name) - {40f5f417-32bb-4296-9446-c1e0094e7d82} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
  O3 - HKU\S-1-5-21-527237240-1563985344-839522115-1003\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Driver performer.lnk = File not found
  O4 - Startup: C:\Documents and Settings\HelpAssistant\Start Menu\Programs\Startup\Registration .LNK = File not found
  O20 - AppInit_DLLs: (C:\WINDOWS\system32\mscpx32r32.dll) - C:\WINDOWS\system32\mscpx32r32.dll (People Can Fly)
  [2011/08/19 19:35:03 | 000,705,024 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\msvcp6032.exe
  [2011/08/19 19:34:57 | 000,155,648 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\mscpx32r32.dll
  [2011/08/19 19:34:53 | 000,705,024 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\usrlbva32.exe
  [2011/08/19 19:34:26 | 000,326,656 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\audiosrv32.dll
  [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  [13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  [1 C:\Documents and Settings\Ikenna\*.tmp files -> C:\Documents and Settings\Ikenna\*.tmp -> ]
  [1 C:\*.tmp files -> C:\*.tmp -> ]
  [2011/08/20 21:28:39 | 000,000,019 | ---- | M] () -- C:\WINDOWS\System32\4c24d425
  [2011/08/19 19:35:03 | 000,000,100 | ---- | M] () -- C:\WINDOWS\System32\1711981653
  [2011/05/11 21:16:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\aC28601HdOjI28601
  
  :Services
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  C:\Program Files\ConduitEngine
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [emptyflash]
  [createrestorepoint]
  [reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Delete your copy of ComboFix.exe from your Desktop.

Then download the latest version of ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

[Phenom23]

This is the combofix log. I was unable to save combofix on the desktop as u said; my computer seemed to automatically save it under my "download." files....I guess I am not too computer savvy. What is the best way to get rid of my old combofix...it is in the same folder, but under a different name; I figured that right-clicking and delete would not uninstall it from my system...??

ComboFix 11-08-21.01 - Ikenna 08/21/2011 8:58.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.535 [GMT -5:00]
Running from: c:\documents and settings\Ikenna\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Microsoft Security Essentials *Enabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome.manifest
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome\xulcache.jar
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\defaults\preferences\xulcache.js
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\install.rdf
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome.manifest
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome\xulcache.jar
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\defaults\preferences\xulcache.js
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\install.rdf
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome.manifest
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome\xulcache.jar
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\defaults\preferences\xulcache.js
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\install.rdf
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome.manifest
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome\xulcache.jar
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\defaults\preferences\xulcache.js
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\install.rdf
c:\documents and settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}
c:\documents and settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome.manifest
c:\documents and settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome\xulcache.jar
c:\documents and settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\defaults\preferences\xulcache.js
c:\documents and settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\install.rdf
c:\documents and settings\LocalService\Application Data\02000000e3bc35791406C.manifest
c:\documents and settings\LocalService\Application Data\02000000e3bc35791406O.manifest
c:\documents and settings\LocalService\Application Data\02000000e3bc35791406P.manifest
c:\documents and settings\LocalService\Application Data\02000000e3bc35791406S.manifest
.
.
((((((((((((((((((((((((( Files Created from 2011-07-21 to 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 00:29 . 2011-08-21 00:29 -------- d-----w- C:\_OTL
2011-08-15 00:39 . 2011-08-15 00:40 -------- d-----w- c:\program files\Common Files\Adobe
2011-08-15 00:33 . 2011-08-15 00:33 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2011-08-13 11:29 . 2011-08-13 11:29 -------- d-----w- c:\documents and settings\Ikenna\Local Settings\Application Data\Cisco
2011-08-12 02:28 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-12 02:20 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-05 03:22 . 2011-08-05 03:22 -------- d-----w- c:\program files\Microsoft Silverlight
2011-07-23 15:26 . 2011-08-15 00:41 -------- d-----w- c:\documents and settings\Ikenna\Local Settings\Application Data\Solid State Networks
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-20 17:54 . 2011-06-02 07:17 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2004-08-10 11:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-10 11:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-07 00:52 . 2009-08-21 18:03 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-07 00:52 . 2009-08-21 18:03 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-04 11:43 . 2011-05-11 23:06 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2011-05-11 23:06 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-05-11 23:06 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2011-05-11 23:06 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2011-05-11 23:06 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2011-05-11 23:06 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2011-05-11 23:06 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2011-05-11 23:06 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2011-05-11 23:06 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2011-05-11 23:06 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-24 14:10 . 2009-07-04 03:08 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2004-08-10 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2004-08-10 11:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2004-08-10 11:00 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-10 11:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02 . 2004-08-10 11:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-08-20 17:51 . 2011-05-07 09:32 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_00.52.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-21 13:46 . 2011-08-21 13:46 16384 c:\windows\Temp\Perflib_Perfdata_7b4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-02 2508104]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-07 1047656]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
"NACAgentUI"="c:\program files\Cisco\Cisco NAC Agent\NACAgentUI.exe" [2011-03-09 524512]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Ikenna\Start Menu\Programs\Startup\AutorunsDisabled
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
Registration .LNK - c:\program files\Ubisoft\Telltale Games\CSI-3 Dimensions of Murder\Registration\RegistrationReminder.exe [2006-4-3 864256]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-24 622653]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Microsoft Office\\Office12\\EXCEL.EXE"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2994:TCP"= 2994:TCP:Services
"4488:TCP"= 4488:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [5/11/2011 6:06 PM 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5/11/2011 6:06 PM 309848]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/11/2011 6:06 PM 19544]
R2 NACAgent;Cisco NAC Agent;c:\program files\Cisco\Cisco NAC Agent\NACAgent.exe [3/9/2011 5:48 PM 1104608]
R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [12/17/2009 5:32 PM 497856]
S1 MpKsl1dc9512a;MpKsl1dc9512a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EE861BC0-635C-4318-90A9-703737CCD86E}\MpKsl1dc9512a.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EE861BC0-635C-4318-90A9-703737CCD86E}\MpKsl1dc9512a.sys [?]
S1 MpKsl5c139926;MpKsl5c139926;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A73BA2BA-4C54-43F4-9489-F340D04A7441}\MpKsl5c139926.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A73BA2BA-4C54-43F4-9489-F340D04A7441}\MpKsl5c139926.sys [?]
S1 MpKsl66d18427;MpKsl66d18427;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FE53D27A-5EAA-45BA-9B67-304E72E36C5B}\MpKsl66d18427.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FE53D27A-5EAA-45BA-9B67-304E72E36C5B}\MpKsl66d18427.sys [?]
S1 MpKslaf680f3f;MpKslaf680f3f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8CEDEAEE-40DA-45FB-A266-FBAA13A21478}\MpKslaf680f3f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8CEDEAEE-40DA-45FB-A266-FBAA13A21478}\MpKslaf680f3f.sys [?]
S1 MpKslce36a851;MpKslce36a851;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A4995162-98A6-4CD6-8732-E146859BD903}\MpKslce36a851.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A4995162-98A6-4CD6-8732-E146859BD903}\MpKslce36a851.sys [?]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/23/2010 9:21 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
2010-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 02:21]
.
2010-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 02:21]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1563985344-839522115-1003Core.job
- c:\documents and settings\Ikenna\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-09-06 06:37]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1563985344-839522115-1003UA.job
- c:\documents and settings\Ikenna\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-09-06 06:37]
.
2011-08-21 c:\windows\Tasks\User_Feed_Synchronization-{69FC1740-E663-44F5-942E-CDD3EE4058F9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: DhcpNameServer = 192.168.1.1
DPF: {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} - hxxps://secure3.olemiss.edu/AntiVirusStudents/sav9/sav-xp/webinst.cab
FF - ProfilePath - c:\documents and settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{0129D4D4-80A6-4B60-B0C7-A00731A5C2Bc} - (no file)
BHO-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
AddRemove-conduitEngine - c:\progra~1\CONDUI~1\ConduitEngineUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-21 09:16
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-08-21 09:21:27
ComboFix-quarantined-files.txt 2011-08-21 14:21
ComboFix2.txt 2011-08-21 02:16
ComboFix3.txt 2011-08-21 00:56
.
Pre-Run: 19,228,844,032 bytes free
Post-Run: 19,201,617,920 bytes free
.
- - End Of File - - 9367F037101887CCD8C14EC47E916F2C

[Gammo]

Hi,

What is the best way to get rid of my old combofix...it is in the same folder, but under a different name; I figured that right-clicking and delete would not uninstall it from my system...??

I wanted you to delete the old ComboFix file and download/use the latest file. Uninstalling ComboFix requires a different procedure, which I'll hand over to you when we're done. For now you can leave ComboFix alone.





Please download HelpAsst_mebroot_fix.exe and save it to your desktop.
Close out all other open programs and windows.
Double click the file to run it and follow any prompts.
If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer.
Upon restarting, please wait about 5 minutes, click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !
When it completes, a log will open.
Please post the contents of that log.


*In the event the tool does not detect an mbr infection and completes, click Start>Run and type the following bolded command, then hit Enter.

mbr -f

Now, please do the Start>Run>mbr -f command a second time.
Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.
Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !
When it completes, a log will open.
Please post the contents of that log.

**Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).





Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, click the "Update" tab and click the "Check For updates" button.
• Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.





ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

[Phenom23]

Hello. I ran the Helpasst and MBAM. Their logs are attached. A major improvement is that no threat was found, which is very different from 2 days ago when I would run MBAM and see 8-9 threats each time. I didnt run the ESET online scanner; its seems frozen up on "initialization" and reads "cannot get updated. Is proxy configured?" I am running a FULL scan on my MBAM to verify that all threats are gone.

The HelpAsst log is

C:\Documents and Settings\Ikenna\My Documents\Downloads\HelpAsst_mebroot_fix.exe
Mon 08/22/2011 at 14:14:59.95

HelpAssistant account Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking firewall ports ~~

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Mon 08/22/2011 at 14:32:19.81

Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x0950E4C1
malicious code @ sector 0x0950E4C4 !
PE file found in sector at 0x0950E4DA !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

HelpAssistant

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~





The MBAM log is

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7538

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/22/2011 2:51:39 PM
mbam-log-2011-08-22 (14-51-38).txt

Scan type: Quick scan
Objects scanned: 214064
Time elapsed: 9 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Gammo]

Hi,

Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. ^_^

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  
• Please follow the prompts to uninstall Combofix.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

• Download OTC to your desktop and run it
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep a backup of your important files
Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Make proper use of your anti-virus and firewall
You should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so.

Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep all your software updated
It is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.

It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Use a safer web browser
Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.

If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Some other security programs

It is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.

• A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.
• SpywareBlaster to help prevent spyware from installing in the first place.
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Be careful
Having security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.

Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.

Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Slow computer?
If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!

Cheers,
Gammo

[Phenom23]

I finally ran the eset scanner; it too 4 hrs, and found 95 threats and remove them..lol. crazy!!. I did a full scan with MBAM and AVAST and no threats were found, so hopefully, the computer should be cleaned. I will do a MBAM scan again tomorrow to verify all is still good. Thanks for your help once again.
Quick question: I used to have microsoft essentials on my computer. I deleted it but I guess that didnt uninstall it, cos combofix indicated that it was still running. How do I get rid of it?

This is the log

C:\Documents and Settings\Ikenna\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\eligchokcjebjmlganjonliiofjbfpca\contentscript.js Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Documents and Settings\Ikenna\My Documents\Downloads\AntiPuper.exe Win32/PrcView application deleted - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\HelpAsst_backup\C\DOCUME~1\HELPAS~1.IK-\Application Data\Mozilla\Firefox\Profiles\eyroggyc.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sef9k9v3.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\oo55pj61.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{1fd93f65-f477-4724-9b73-42144693cab8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{208c6167-ec6f-4680-bf95-93756fafd74d}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{5ab5ac53-8bdf-4ba8-acae-d874fea9cf3d}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{5f62c4d1-7b7e-4444-8bd7-6657c19626b8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{994b3603-8d70-4897-a335-eb253df6c897}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{b3428b75-a4ed-4921-861e-9c623418b01f}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0031927.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0031928.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0031929.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0031930.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032127.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032128.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032129.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032130.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032131.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032132.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032133.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032134.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032135.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032136.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032137.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP77\A0032138.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP79\A0032529.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP79\A0032530.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP79\A0032531.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP79\A0032532.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP79\A0032533.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0032834.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0032835.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0032836.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0032837.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0032839.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0032840.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0032841.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0033084.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0033085.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0033086.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0033087.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0033088.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0033089.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{75A8ABE9-9364-4F53-BEDF-B6128FC93B29}\RP80\A0033090.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\08212011_082829\C_Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\08212011_082829\C_Documents and Settings\Ikenna\Application Data\Mozilla\Firefox\Profiles\17l7bu8v.default\extensions\{e993f414-1ba1-4c7a-9a06-e5eb71870c62}\chrome\xulcache.jar JS/Agent.NDJ trojan deleted - quarantined
C:\_OTL\MovedFiles\08212011_082829\C_WINDOWS\system32\audiosrv32.dll a variant of Win32/Kryptik.RSL trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\08212011_082829\C_WINDOWS\system32\mscpx32r32.dll a variant of Win32/Kryptik.RSL trojan cleaned by deleting - quarantined

[Phenom23]

I have uninstalled the combofix that I downloaded thru your link. I had previously downloaded combofix, and want to uninstall it. I had renamed it to "adware" thinking that might help deal with the virus, but I just changed it back and tried removing it by Combofix /Uninstall, but it says "windows cant find combofix".....................do u have any suggestions?

[Gammo]

Quick question: I used to have microsoft essentials on my computer. I deleted it but I guess that didnt uninstall it, cos combofix indicated that it was still running. How do I get rid of it?

Please run this tool: http://go.microsoft....?linkid=9748340 . That should uninstall it completely.

I have uninstalled the combofix that I downloaded thru your link. I had previously downloaded combofix, and want to uninstall it. I had renamed it to "adware" thinking that might help deal with the virus, but I just changed it back and tried removing it by Combofix /Uninstall, but it says "windows cant find combofix".....................do u have any suggestions?

Rename the Combofix file on your desktop back to adware
Then try this command: adware /uninstall
Does that help?

[Phenom23]

Nah, it still says the file cannot be found.

[Gammo]

I have uninstalled the combofix that I downloaded thru your link.

Then I think the other one is uninstalled as well. I wouldn't worry about it too much.