Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Nasty stuff.... [Solved]


  • This topic is locked This topic is locked

#1
Fatie32

Fatie32

    Member

  • Member
  • PipPipPip
  • 122 posts
Fixing my uncles computer looking for some help mostly everything was hidden on the computer ie wouldn't open got that too work just cant seem to get it working right anyone able to help heres the otl......


Edit: i can only get on the internet or install things via safe mode with networking



OTL logfile created on: 12/3/2011 12:30:15 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator.AL.002\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.98 Mb Total Physical Memory | 697.30 Mb Available Physical Memory | 68.23% Memory free
1.65 Gb Paging File | 1.48 Gb Available in Paging File | 89.29% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.97 Gb Total Space | 55.30 Gb Free Space | 77.92% Space Free | Partition Type: NTFS
Drive F: | 14.91 Gb Total Space | 13.86 Gb Free Space | 92.98% Space Free | Partition Type: FAT32

Computer Name: AL | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/03 12:30:11 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator.AL.002\My Documents\Downloads\OTL.com
PRC - [2011/11/14 23:39:56 | 001,036,344 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/14 23:39:54 | 000,420,920 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\ppgooglenaclpluginchrome.dll
MOD - [2011/11/14 23:39:53 | 003,702,840 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\pdf.dll
MOD - [2011/11/14 23:38:16 | 000,122,952 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\avutil-51.dll
MOD - [2011/11/14 23:38:15 | 000,222,280 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\avformat-53.dll
MOD - [2011/11/14 23:38:14 | 001,746,504 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\avcodec-53.dll
MOD - [2011/11/14 20:36:18 | 008,593,056 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\gcswf32.dll
MOD - [2004/08/04 04:00:00 | 000,015,360 | -H-- | M] () -- C:\WINDOWS\system32\tsd32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/07/27 05:06:44 | 000,267,488 | ---- | M] () [Auto | Stopped] -- C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe -- (Updater Service for StartNow Toolbar)
SRV - [2010/11/19 12:29:00 | 004,916,568 | -H-- | M] (LeapFrog Enterprises, Inc.) [Auto | Stopped] -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service)
SRV - [2010/03/18 10:19:26 | 000,113,152 | -H-- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/08/05 12:49:44 | 000,284,016 | -H-- | M] (Eastman Kodak Company) [Auto | Stopped] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service)
SRV - [2008/11/09 14:48:14 | 000,602,392 | -H-- | M] (Yahoo! Inc.) [Auto | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/13 18:32:40 | 000,201,968 | -H-- | M] (SupportSoft, Inc.) [Auto | Stopped] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/02/26 12:31:16 | 000,628,584 | -H-- | M] () [Auto | Stopped] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloSystemService)
SRV - [2008/02/26 12:31:16 | 000,628,584 | -H-- | M] () [Auto | Stopped] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloFileInfoList)
SRV - [2007/07/09 12:54:08 | 000,177,416 | RH-- | M] (Authentium, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe -- (dvpapi)
SRV - [2007/03/07 14:47:46 | 000,076,848 | -H-- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2007/01/04 15:38:08 | 000,024,652 | -H-- | M] (Viewpoint Corporation) [Auto | Stopped] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)


========== Driver Services (SafeList) ==========

DRV - [2008/03/29 21:18:21 | 000,076,560 | -H-- | M] (Trend Micro Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2007/07/09 12:01:04 | 000,834,448 | -H-- | M] (Authentium, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\Css-Dvp.sys -- (CSS DVP)
DRV - [2007/03/01 09:34:36 | 000,028,352 | -H-- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 15:07:28 | 000,004,736 | -H-- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2004/10/07 19:16:04 | 000,035,840 | -H-- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2004/09/17 13:02:54 | 000,732,928 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2003/11/17 20:59:20 | 000,212,224 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 20:58:02 | 000,680,704 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 20:56:26 | 001,042,432 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/01/10 10:56:34 | 000,030,921 | -H-- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SQCaptur.sys -- (DCamUSBSQTECH) Dual-Mode DSC(2770)
DRV - [2001/08/14 00:59:36 | 000,011,387 | RH-- | M] (Agilent Technologies) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\goldrush.sys -- (GoldrushUSB)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)


[2008/03/24 19:21:00 | 002,889,088 | -H-- | M] () -- C:\Program Files\mozilla firefox\plugins\NPSWF32.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.140.8 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U14 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
CHR - plugin: Yahoo! activeX Plug-in Bridge (Enabled) = C:\Program Files\Yahoo!\Common\npyaxmpb.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2009/04/04 17:18:52 | 000,290,140 | RH-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 9993 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (StartNow Toolbar Helper) - {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files\StartNow Toolbar\Toolbar32.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (Inbox Toolbar) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKLM\..\Toolbar: (StartNow Toolbar) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files\StartNow Toolbar\Toolbar32.dll ()
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [Monitor] C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
O4 - HKCU..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.t...ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.ma...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} http://www.kodakgall..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.233.207.8 64.233.207.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23EF4B2E-3DA4-49E6-8B15-C13DA27349B2}: DhcpNameServer = 64.233.207.8 64.233.207.9
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O30 - LSA: Authentication Packages - (C:\WINDOWS\system32\ssqpo.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/03 12:25:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.AL.002\My Documents\Downloads
[2011/11/24 09:05:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.AL.002\Start Menu\Programs\Google Chrome
[2011/11/24 09:03:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Google
[2011/11/24 09:02:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.AL.002\Local Settings\Application Data\Deployment
[2011/11/24 09:01:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/11/24 09:01:42 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/11/24 09:01:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/03 12:25:33 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/12/03 12:22:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/03 12:18:30 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{FFDFEF61-E6DC-4443-9329-85AD9487FCE7}.job
[2011/12/03 12:14:00 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/12/03 12:07:02 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/03 11:49:32 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\tasks\LPAAPJJWF.job
[2011/11/26 09:09:00 | 000,000,972 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-500Core.job
[2011/11/26 08:00:00 | 000,000,250 | -H-- | M] () -- C:\WINDOWS\tasks\dfrg.job
[2011/11/25 18:00:00 | 000,000,438 | ---- | M] () -- C:\WINDOWS\tasks\SpeedMaxPc Registration3.job
[2011/11/24 09:06:22 | 000,002,397 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Desktop\Google Chrome.lnk
[2011/11/24 09:06:22 | 000,002,375 | ---- | M] () -- C:\Documents and Settings\Administrator.AL.002\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/24 09:09:23 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/11/24 09:06:22 | 000,002,397 | ---- | C] () -- C:\Documents and Settings\Administrator.AL.002\Desktop\Google Chrome.lnk
[2011/11/24 09:06:22 | 000,002,375 | ---- | C] () -- C:\Documents and Settings\Administrator.AL.002\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/11/24 09:04:01 | 000,000,972 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-500Core.job
[2011/07/24 10:56:31 | 000,000,184 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fzr
[2011/07/24 10:56:30 | 000,000,232 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fz
[2011/07/24 10:56:03 | 000,000,336 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\P1kAlMiG2Kb7Fz
[2010/06/28 16:47:52 | 000,338,944 | -H-- | C] () -- C:\WINDOWS\System32\Lffpx7.dll
[2010/06/28 16:47:52 | 000,118,784 | -H-- | C] () -- C:\WINDOWS\System32\Lfkodak.dll
[2009/08/30 14:18:24 | 000,000,021 | -H-- | C] () -- C:\WINDOWS\atid.ini
[2008/04/27 14:47:14 | 000,020,454 | -H-- | C] () -- C:\WINDOWS\hpoins01.dat
[2008/04/27 14:47:14 | 000,016,618 | -H-- | C] () -- C:\WINDOWS\hpomdl01.dat
[2008/03/29 21:18:28 | 000,002,162 | -H-- | C] () -- C:\WINDOWS\System32\tmmute.ini
[2008/03/29 14:02:05 | 000,059,392 | RH-- | C] () -- C:\WINDOWS\System32\streamhlp.dll
[2008/03/29 13:29:17 | 000,000,023 | -HS- | C] () -- C:\WINDOWS\System32\eceb3_z.dll
[2008/03/28 19:13:04 | 000,051,200 | -H-- | C] () -- C:\WINDOWS\System32\dumphive.exe
[2008/03/28 19:13:04 | 000,040,960 | -H-- | C] () -- C:\WINDOWS\System32\swsc.exe
[2008/03/28 19:13:04 | 000,025,600 | -H-- | C] () -- C:\WINDOWS\System32\WS2Fix.exe
[2008/03/28 19:07:49 | 000,018,409 | -H-- | C] () -- C:\Program Files\Common Files\ememumorug.ban
[2008/03/28 19:07:49 | 000,012,851 | -H-- | C] () -- C:\Program Files\Common Files\niqoqo.pif
[2008/03/28 19:07:49 | 000,012,512 | -H-- | C] () -- C:\WINDOWS\zylany.dat
[2008/03/28 19:07:49 | 000,011,578 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\unec.dat
[2008/03/23 10:07:25 | 000,014,621 | -H-- | C] () -- C:\WINDOWS\System32\oxanazym.bin
[2008/03/23 10:07:24 | 000,019,449 | -H-- | C] () -- C:\Program Files\Common Files\fymima._sy
[2008/03/23 10:07:24 | 000,010,178 | -H-- | C] () -- C:\Program Files\Common Files\fizoqahe.vbs
[2008/03/23 10:07:23 | 000,018,791 | -H-- | C] () -- C:\WINDOWS\mofofozu.com
[2008/03/23 10:07:23 | 000,014,524 | -H-- | C] () -- C:\WINDOWS\ahitejujo.sys
[2008/03/23 10:07:22 | 000,010,959 | -H-- | C] () -- C:\Program Files\Common Files\jicitecyp.vbs
[2008/03/23 10:07:21 | 000,014,691 | -H-- | C] () -- C:\Program Files\Common Files\wofuketyte.dat
[2008/03/18 17:21:39 | 000,008,351 | -HS- | C] () -- C:\WINDOWS\System32\kjkmp.ini
[2008/03/14 07:15:06 | 000,018,644 | -H-- | C] () -- C:\WINDOWS\oriwex.sys
[2008/03/14 07:15:06 | 000,018,488 | -H-- | C] () -- C:\WINDOWS\ucecol.bin
[2008/03/14 07:15:06 | 000,015,759 | -H-- | C] () -- C:\WINDOWS\nadoj.bin
[2008/03/14 07:15:06 | 000,015,355 | -H-- | C] () -- C:\WINDOWS\miloco.sys
[2008/03/14 07:15:06 | 000,014,595 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\aquzofap.bat
[2008/03/14 07:15:06 | 000,013,686 | -H-- | C] () -- C:\Program Files\Common Files\afyfy.lib
[2008/03/14 07:15:06 | 000,013,097 | -H-- | C] () -- C:\Program Files\Common Files\pirawy.db
[2008/03/14 07:15:06 | 000,011,484 | -H-- | C] () -- C:\Program Files\Common Files\puwu.pif
[2008/03/14 07:15:06 | 000,010,709 | -H-- | C] () -- C:\WINDOWS\ruxo.bin
[2008/03/03 17:32:05 | 000,000,021 | -H-- | C] () -- C:\WINDOWS\arcsuite.ini
[2008/03/02 17:25:15 | 000,000,078 | -H-- | C] () -- C:\WINDOWS\qwimp.ini
[2008/01/13 19:12:40 | 000,000,432 | -H-- | C] () -- C:\WINDOWS\System32\iolo.ini
[2008/01/13 19:10:20 | 000,126,976 | -H-- | C] () -- C:\WINDOWS\System32\iavlsp.dll
[2007/12/25 15:42:19 | 000,074,703 | -H-- | C] () -- C:\WINDOWS\System32\mfc45.dll
[2007/12/25 12:54:32 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\REGCLEAR.INI
[2007/07/14 11:48:47 | 000,000,135 | -H-- | C] () -- C:\WINDOWS\ALBUM.INI
[2006/07/06 19:35:08 | 000,000,021 | -H-- | C] () -- C:\WINDOWS\PI4_setup.ini
[2006/06/19 18:16:19 | 000,000,043 | -H-- | C] () -- C:\WINDOWS\BTW.INI
[2006/06/19 18:15:05 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\AUTORUN.INI
[2006/04/27 16:56:54 | 000,000,305 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006/04/16 13:59:28 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2006/04/03 16:24:08 | 000,000,085 | -H-- | C] () -- C:\WINDOWS\ImportClient.INI
[2006/04/03 16:08:06 | 000,053,248 | -H-- | C] () -- C:\WINDOWS\System32\PretzelSpellCheck.dll
[2006/04/03 16:07:30 | 000,000,751 | -H-- | C] () -- C:\WINDOWS\Bti.ini
[2006/04/03 16:07:28 | 000,116,640 | -H-- | C] () -- C:\WINDOWS\System32\Ptsaci40.dll
[2006/04/03 16:07:28 | 000,030,080 | -H-- | C] () -- C:\WINDOWS\System32\Ptabimp3.exe
[2006/02/18 14:48:24 | 000,002,937 | -H-- | C] () -- C:\WINDOWS\mozver.dat
[2005/11/21 17:31:33 | 000,003,350 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005/11/21 17:31:33 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\1F6DDC9558.sys
[2005/11/21 15:58:57 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2005/11/21 15:52:20 | 000,001,113 | -H-- | C] () -- C:\WINDOWS\QUICKEN.INI
[2005/11/15 19:19:37 | 000,000,106 | -H-- | C] () -- C:\WINDOWS\Goldrush.ini
[2005/11/06 16:25:41 | 000,019,968 | -H-- | C] () -- C:\WINDOWS\hpothb07.dat
[2005/10/31 19:27:46 | 000,000,010 | -H-- | C] () -- C:\WINDOWS\Kentucky's Awesome Bucks.dat
[2005/10/31 14:43:07 | 000,126,976 | RH-- | C] () -- C:\WINDOWS\System32\cmdinterface.dll
[2005/10/31 14:43:07 | 000,010,321 | RH-- | C] () -- C:\WINDOWS\System32\concord.dll
[2005/10/31 14:42:16 | 000,002,175 | -H-- | C] () -- C:\WINDOWS\photoimpression.ini
[2005/10/31 14:42:16 | 000,000,422 | -H-- | C] () -- C:\WINDOWS\videoimp.ini
[2005/10/31 12:40:10 | 000,010,240 | -H-- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2005/10/31 12:40:04 | 000,000,540 | -H-- | C] () -- C:\WINDOWS\videomvp.ini
[2005/10/31 12:39:28 | 000,000,021 | -H-- | C] () -- C:\WINDOWS\CS_SETUP.ini
[2005/10/30 17:32:29 | 000,561,152 | RH-- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2005/10/25 18:50:40 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2005/10/25 18:45:24 | 000,149,504 | -H-- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/10/25 18:35:06 | 000,000,916 | -H-- | C] () -- C:\WINDOWS\wininit.ini
[2005/10/25 18:31:14 | 000,000,335 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2005/10/25 18:09:10 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\setpwrcg.exe
[2005/10/25 18:09:04 | 000,012,288 | -H-- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/10/25 18:08:52 | 000,000,394 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 12:12:05 | 000,000,780 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 12:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/10 12:02:15 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 12:01:18 | 000,001,793 | -H-- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 11:57:52 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 11:57:15 | 000,392,776 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 11:51:21 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 11:51:20 | 000,443,196 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 11:51:20 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 11:51:20 | 000,072,270 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 11:51:20 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 11:51:18 | 000,004,627 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 11:51:17 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 11:51:16 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 11:51:12 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 11:51:11 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 11:51:05 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 11:50:56 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2009/08/30 14:17:44 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
[2009/08/30 14:18:06 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/01/04 18:16:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company
[2008/03/28 16:10:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\iolo
[2009/12/28 13:07:26 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\kds_kodak
[2011/03/27 18:58:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Leapfrog
[2009/08/16 10:58:16 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2009/08/16 09:24:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2011/01/04 14:09:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2011/09/15 15:45:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedMaxPc
[2007/11/21 21:06:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/08/30 14:17:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/11/26 08:00:00 | 000,000,250 | -H-- | M] () -- C:\WINDOWS\Tasks\dfrg.job
[2011/12/03 11:49:32 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\Tasks\LPAAPJJWF.job
[2011/10/10 11:00:00 | 000,000,312 | -H-- | M] () -- C:\WINDOWS\Tasks\Regwork.job
[2011/11/25 18:00:00 | 000,000,438 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedMaxPc Registration3.job
[2011/09/15 15:45:53 | 000,000,396 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedMaxPc Update3.job
[2011/12/03 12:18:30 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{FFDFEF61-E6DC-4443-9329-85AD9487FCE7}.job

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2008/03/24 17:47:57 | 000,000,000 | -H-D | M](C:\WINDOWS\System32\??crosoft.NET) -- C:\WINDOWS\System32\Міcrosoft.NET
[2008/03/18 17:17:01 | 000,000,000 | -H-D | C](C:\WINDOWS\System32\??crosoft.NET) -- C:\WINDOWS\System32\Міcrosoft.NET

< End of report >

Edited by Fatie32, 03 December 2011 - 12:34 PM.

  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you let me know if the net works in normal mode after this

Download RogueKiller to your desktop

  • Quit all running programs
  • For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
  • When prompted, type 6 and validate
  • The RKreport.txt shall be generated next to the executable.
  • If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

THEN

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    O2 - BHO: (StartNow Toolbar Helper) - {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files\StartNow Toolbar\Toolbar32.dll ()
    O3 - HKLM\..\Toolbar: (StartNow Toolbar) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files\StartNow Toolbar\Toolbar32.dll ()
    O30 - LSA: Authentication Packages - (C:\WINDOWS\system32\ssqpo.dll) - File not found
    [2011/12/03 11:49:32 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\tasks\LPAAPJJWF.job
    [2011/07/24 10:56:31 | 000,000,184 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fzr
    [2011/07/24 10:56:30 | 000,000,232 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fz
    [2011/07/24 10:56:03 | 000,000,336 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\P1kAlMiG2Kb7Fz
    [2008/03/28 19:07:49 | 000,011,578 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\unec.dat
    [2008/03/23 10:07:25 | 000,014,621 | -H-- | C] () -- C:\WINDOWS\System32\oxanazym.bin
    [2008/03/23 10:07:24 | 000,019,449 | -H-- | C] () -- C:\Program Files\Common Files\fymima._sy
    [2008/03/23 10:07:24 | 000,010,178 | -H-- | C] () -- C:\Program Files\Common Files\fizoqahe.vbs
    [2008/03/23 10:07:23 | 000,018,791 | -H-- | C] () -- C:\WINDOWS\mofofozu.com
    [2008/03/23 10:07:23 | 000,014,524 | -H-- | C] () -- C:\WINDOWS\ahitejujo.sys
    [2008/03/23 10:07:22 | 000,010,959 | -H-- | C] () -- C:\Program Files\Common Files\jicitecyp.vbs
    [2008/03/23 10:07:21 | 000,014,691 | -H-- | C] () -- C:\Program Files\Common Files\wofuketyte.dat
    [2008/03/18 17:21:39 | 000,008,351 | -HS- | C] () -- C:\WINDOWS\System32\kjkmp.ini
    [2008/03/14 07:15:06 | 000,018,644 | -H-- | C] () -- C:\WINDOWS\oriwex.sys
    [2008/03/14 07:15:06 | 000,018,488 | -H-- | C] () -- C:\WINDOWS\ucecol.bin
    [2008/03/14 07:15:06 | 000,015,759 | -H-- | C] () -- C:\WINDOWS\nadoj.bin
    [2008/03/14 07:15:06 | 000,015,355 | -H-- | C] () -- C:\WINDOWS\miloco.sys
    [2008/03/14 07:15:06 | 000,014,595 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\aquzofap.bat
    [2008/03/14 07:15:06 | 000,013,686 | -H-- | C] () -- C:\Program Files\Common Files\afyfy.lib
    [2008/03/14 07:15:06 | 000,013,097 | -H-- | C] () -- C:\Program Files\Common Files\pirawy.db
    [2008/03/14 07:15:06 | 000,011,484 | -H-- | C] () -- C:\Program Files\Common Files\puwu.pif
    [2008/03/14 07:15:06 | 000,010,709 | -H-- | C] () -- C:\WINDOWS\ruxo.bin
    [2008/03/03 17:32:05 | 000,000,021 | -H-- | C] () -- C:\WINDOWS\arcsuite.ini
    [2008/03/02 17:25:15 | 000,000,078 | -H-- | C] () -- C:\WINDOWS\qwimp.ini
    [2008/03/24 17:47:57 | 000,000,000 | -H-D | M](C:\WINDOWS\System32\??crosoft.NET) -- C:\WINDOWS\System32\Міcrosoft.NET
    [2008/03/18 17:17:01 | 000,000,000 | -H-D | C](C:\WINDOWS\System32\??crosoft.NET) -- C:\WINDOWS\System32\Міcrosoft.NET


    :Files
    ipconfig /flushdns /c
    xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
    xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
    xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
    xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C

    :Commands
    [purity]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

  • 0

#3
Fatie32

Fatie32

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 122 posts
rkreport.




RogueKiller V6.1.12 [12/02/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: john [Admin rights]
Mode: Shortcuts HJfix -- Date : 12/03/2011 15:39:35

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 13 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 96 / Fail 0
My documents: Success 110 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 293 / Fail 0
Backup: [FOUND] Success 0 / Fail 0

Drives:
[C:] \Device\HarddiskVolume2 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped
[E:] \Device\CdRom1 -- 0x5 --> Skipped

¤¤¤ Infection : Rogue.FakeHDD ¤¤¤

Finished : << RKreport[1].txt >>
RKreport[1].txt






otl



OTL logfile created on: 12/3/2011 4:27:06 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\john\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.98 Mb Total Physical Memory | 595.26 Mb Available Physical Memory | 58.25% Memory free
1.65 Gb Paging File | 1.32 Gb Available in Paging File | 79.73% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.97 Gb Total Space | 55.20 Gb Free Space | 77.79% Space Free | Partition Type: NTFS

Computer Name: AL | User Name: john | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/03 15:40:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\john\Desktop\OTL.exe
PRC - [2010/11/19 12:38:08 | 000,193,880 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
PRC - [2010/11/19 12:29:00 | 004,916,568 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
PRC - [2010/10/27 19:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/03/18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/08/03 09:33:06 | 001,626,112 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
PRC - [2009/03/05 15:07:20 | 002,260,480 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/08/13 18:32:46 | 001,017,648 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\gs_agent\dsc.exe
PRC - [2008/08/13 18:32:40 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
PRC - [2007/01/04 15:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2003/04/06 00:06:58 | 000,028,672 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe


========== Modules (No Company Name) ==========

MOD - [2011/06/29 17:06:01 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f354057a5b4fad4c399da28449ba0d92\System.Xml.ni.dll
MOD - [2011/06/29 16:45:00 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\f6a9a002526806f3a5b745cf5c407cae\System.ni.dll
MOD - [2011/06/29 16:43:44 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2010/01/31 21:52:12 | 008,347,648 | ---- | M] () -- C:\Program Files\LeapFrog\LeapFrog Connect\QtGui4.dll
MOD - [2010/01/31 21:52:12 | 002,244,608 | ---- | M] () -- C:\Program Files\LeapFrog\LeapFrog Connect\QtCore4.dll
MOD - [2009/05/26 20:06:28 | 000,913,408 | ---- | M] () -- C:\Program Files\Yahoo!\Messenger\yui.dll
MOD - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
MOD - [2008/01/09 16:46:50 | 000,105,816 | ---- | M] () -- C:\Program Files\iolo\Common\Lib\ioloHL.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2010/11/19 12:29:00 | 004,916,568 | ---- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service)
SRV - [2010/03/18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/08/05 12:49:44 | 000,284,016 | ---- | M] (Eastman Kodak Company) [Auto | Stopped] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service)
SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () [Auto | Running] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloSystemService)
SRV - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () [Auto | Running] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloFileInfoList)
SRV - [2007/07/09 12:54:08 | 000,177,416 | R--- | M] (Authentium, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe -- (dvpapi)
SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2007/01/04 15:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)


========== Driver Services (SafeList) ==========

DRV - [2008/03/29 21:18:21 | 000,076,560 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2007/07/09 12:01:04 | 000,834,448 | ---- | M] (Authentium, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Css-Dvp.sys -- (CSS DVP)
DRV - [2007/03/01 09:34:36 | 000,028,352 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2004/10/07 19:16:04 | 000,035,840 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2004/09/17 13:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2003/11/17 20:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 20:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 20:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/01/10 10:56:34 | 000,030,921 | ---- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SQCaptur.sys -- (DCamUSBSQTECH) Dual-Mode DSC(2770)
DRV - [2001/08/14 00:59:36 | 000,011,387 | R--- | M] (Agilent Technologies) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\goldrush.sys -- (GoldrushUSB)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://us.rd.yahoo.c...//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.ask.com/?...?o=20011&l=dis"
FF - prefs.js..browser.search.selectedEngine: "AIM Search"
FF - prefs.js..keyword.URL: "http://slirsredirect...ir=2706&query="

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll File not found


[2011/04/04 18:02:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\ttn7jgms.default\extensions
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
[2008/03/24 19:21:00 | 002,889,088 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NPSWF32.dll

O1 HOSTS File: ([2011/12/03 13:01:44 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (Inbox Toolbar) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [Monitor] C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\john\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: &eBay Search - Reg Error: Value error. File not found
O9 - Extra Button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.t...ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.ma...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} http://www.kodakgall..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.233.207.8 64.233.207.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23EF4B2E-3DA4-49E6-8B15-C13DA27349B2}: DhcpNameServer = 64.233.207.8 64.233.207.9
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\john\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\john\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/03 15:40:46 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\john\Desktop\OTL.exe
[2011/12/03 15:39:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\john\Desktop\RK_Quarantine
[2011/12/03 13:18:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AntiVir PersonalEdition Classic
[2011/12/03 13:10:00 | 004,326,308 | R--- | C] (Swearware) -- C:\Documents and Settings\john\Desktop\ComboFix.exe
[2011/12/03 13:01:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/12/03 12:53:57 | 000,000,000 | R-SD | C] -- C:\cmdcons
[2011/12/03 12:49:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/12/03 12:49:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/12/03 12:49:38 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/12/03 12:49:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/12/03 12:49:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/12/03 12:49:29 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/11/24 09:01:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/11/24 09:01:42 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/11/24 09:01:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/11/15 19:32:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\john\Application Data\AppGraffiti
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/03 16:26:27 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/03 16:14:00 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/12/03 15:51:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/03 15:40:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\john\Desktop\OTL.exe
[2011/12/03 15:39:06 | 000,111,872 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011/12/03 14:22:37 | 000,000,420 | ---- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{FFDFEF61-E6DC-4443-9329-85AD9487FCE7}.job
[2011/12/03 13:10:00 | 004,326,308 | R--- | M] (Swearware) -- C:\Documents and Settings\john\Desktop\ComboFix.exe
[2011/12/03 13:01:44 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/03 12:54:02 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/12/03 12:25:33 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/11/26 09:09:00 | 000,000,972 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-500Core.job
[2011/11/26 08:00:00 | 000,000,250 | ---- | M] () -- C:\WINDOWS\tasks\dfrg.job
[2011/11/25 18:00:00 | 000,000,438 | ---- | M] () -- C:\WINDOWS\tasks\SpeedMaxPc Registration3.job
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/03 15:39:06 | 000,111,872 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011/12/03 13:19:06 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
[2011/12/03 13:18:53 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2011/12/03 13:18:52 | 000,002,489 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
[2011/12/03 13:18:52 | 000,002,475 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft PowerPoint.lnk
[2011/12/03 13:18:52 | 000,002,030 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk
[2011/12/03 13:18:52 | 000,001,890 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2011/12/03 13:18:52 | 000,001,690 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\PowerDVD.lnk
[2011/12/03 13:18:52 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Acrobat_com.lnk
[2011/12/03 13:18:52 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/12/03 12:54:02 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/12/03 12:53:58 | 000,260,272 | R-S- | C] () -- C:\cmldr
[2011/12/03 12:49:38 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/12/03 12:49:38 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/12/03 12:49:38 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/12/03 12:49:38 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/12/03 12:49:38 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/11/24 09:09:23 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/11/24 09:04:01 | 000,000,972 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-500Core.job
[2011/07/24 10:56:31 | 000,000,184 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fzr
[2011/07/24 10:56:30 | 000,000,232 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fz
[2011/07/24 10:56:03 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\P1kAlMiG2Kb7Fz
[2010/06/28 16:47:52 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\Lffpx7.dll
[2010/06/28 16:47:52 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\Lfkodak.dll
[2010/03/04 17:12:13 | 000,012,286 | --S- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\04lB
[2009/08/30 14:18:24 | 000,000,021 | ---- | C] () -- C:\WINDOWS\atid.ini
[2008/04/27 14:47:14 | 000,020,454 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2008/04/27 14:47:14 | 000,016,618 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2008/03/29 21:18:28 | 000,002,162 | ---- | C] () -- C:\WINDOWS\System32\tmmute.ini
[2008/03/29 14:02:05 | 000,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll
[2008/03/29 13:29:17 | 000,000,023 | --S- | C] () -- C:\WINDOWS\System32\eceb3_z.dll
[2008/03/28 19:07:49 | 000,019,741 | ---- | C] () -- C:\Documents and Settings\john\Application Data\liqivetole._dl
[2008/03/28 19:07:49 | 000,018,409 | ---- | C] () -- C:\Program Files\Common Files\ememumorug.ban
[2008/03/28 19:07:49 | 000,017,754 | ---- | C] () -- C:\Documents and Settings\john\Application Data\gufyp.dll
[2008/03/28 19:07:49 | 000,017,099 | ---- | C] () -- C:\Documents and Settings\john\Application Data\bawysevec.dat
[2008/03/28 19:07:49 | 000,016,747 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ocomofug.pif
[2008/03/28 19:07:49 | 000,012,851 | ---- | C] () -- C:\Program Files\Common Files\niqoqo.pif
[2008/03/28 19:07:49 | 000,012,512 | ---- | C] () -- C:\WINDOWS\zylany.dat
[2008/03/28 19:07:49 | 000,011,578 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\unec.dat
[2008/03/28 19:07:49 | 000,010,705 | ---- | C] () -- C:\Documents and Settings\john\Application Data\nuqiboqes.bin
[2008/03/28 19:07:48 | 000,010,726 | ---- | C] () -- C:\Documents and Settings\john\Application Data\gyziquly.sys
[2008/03/23 10:07:27 | 000,014,446 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ybuzeci.pif
[2008/03/23 10:07:26 | 000,018,923 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\yjirehuqal.db
[2008/03/23 10:07:26 | 000,018,071 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ydid.db
[2008/03/23 10:07:26 | 000,017,134 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\imukyginyj.reg
[2008/03/23 10:07:26 | 000,012,220 | ---- | C] () -- C:\Documents and Settings\john\Application Data\iwehuboz.vbs
[2008/03/23 10:07:25 | 000,015,263 | ---- | C] () -- C:\Documents and Settings\john\Application Data\ysuhaqar.lib
[2008/03/23 10:07:25 | 000,014,621 | ---- | C] () -- C:\WINDOWS\System32\oxanazym.bin
[2008/03/23 10:07:24 | 000,019,449 | ---- | C] () -- C:\Program Files\Common Files\fymima._sy
[2008/03/23 10:07:24 | 000,010,789 | ---- | C] () -- C:\Documents and Settings\john\Application Data\tiwysybehy.bin
[2008/03/23 10:07:24 | 000,010,178 | ---- | C] () -- C:\Program Files\Common Files\fizoqahe.vbs
[2008/03/23 10:07:23 | 000,018,791 | ---- | C] () -- C:\WINDOWS\mofofozu.com
[2008/03/23 10:07:23 | 000,014,524 | ---- | C] () -- C:\WINDOWS\ahitejujo.sys
[2008/03/23 10:07:22 | 000,016,165 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ecak._sy
[2008/03/23 10:07:22 | 000,010,959 | ---- | C] () -- C:\Program Files\Common Files\jicitecyp.vbs
[2008/03/23 10:07:21 | 000,014,691 | ---- | C] () -- C:\Program Files\Common Files\wofuketyte.dat
[2008/03/23 10:07:20 | 000,016,258 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\onucuqe.inf
[2008/03/14 07:15:06 | 000,018,724 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\abepoja.dl
[2008/03/14 07:15:06 | 000,018,644 | ---- | C] () -- C:\WINDOWS\oriwex.sys
[2008/03/14 07:15:06 | 000,018,488 | ---- | C] () -- C:\WINDOWS\ucecol.bin
[2008/03/14 07:15:06 | 000,015,759 | ---- | C] () -- C:\WINDOWS\nadoj.bin
[2008/03/14 07:15:06 | 000,015,355 | ---- | C] () -- C:\WINDOWS\miloco.sys
[2008/03/14 07:15:06 | 000,014,595 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\aquzofap.bat
[2008/03/14 07:15:06 | 000,013,686 | ---- | C] () -- C:\Program Files\Common Files\afyfy.lib
[2008/03/14 07:15:06 | 000,011,484 | ---- | C] () -- C:\Program Files\Common Files\puwu.pif
[2008/03/14 07:15:06 | 000,010,709 | ---- | C] () -- C:\WINDOWS\ruxo.bin
[2008/03/14 07:15:06 | 000,010,524 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\tupigag.bat
[2008/03/03 17:32:05 | 000,000,021 | ---- | C] () -- C:\WINDOWS\arcsuite.ini
[2008/03/02 17:25:15 | 000,000,078 | ---- | C] () -- C:\WINDOWS\qwimp.ini
[2008/01/13 19:12:40 | 000,000,432 | ---- | C] () -- C:\WINDOWS\System32\iolo.ini
[2008/01/13 19:10:20 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\iavlsp.dll
[2007/12/25 15:42:19 | 000,074,703 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll
[2007/12/25 12:54:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\REGCLEAR.INI
[2007/07/14 11:48:47 | 000,000,135 | ---- | C] () -- C:\WINDOWS\ALBUM.INI
[2006/07/06 19:35:08 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI4_setup.ini
[2006/07/03 18:00:24 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/06/19 18:16:19 | 000,000,043 | ---- | C] () -- C:\WINDOWS\BTW.INI
[2006/04/27 16:56:54 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006/04/16 13:59:28 | 000,004,212 | ---- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2006/04/03 16:24:08 | 000,000,085 | ---- | C] () -- C:\WINDOWS\ImportClient.INI
[2006/04/03 16:08:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PretzelSpellCheck.dll
[2006/04/03 16:07:30 | 000,000,751 | ---- | C] () -- C:\WINDOWS\Bti.ini
[2006/04/03 16:07:28 | 000,116,640 | ---- | C] () -- C:\WINDOWS\System32\Ptsaci40.dll
[2006/04/03 16:07:28 | 000,030,080 | ---- | C] () -- C:\WINDOWS\System32\Ptabimp3.exe
[2006/02/18 14:48:24 | 000,002,937 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/11/21 17:31:33 | 000,003,350 | --S- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005/11/21 17:31:33 | 000,000,056 | R-S- | C] () -- C:\WINDOWS\System32\1F6DDC9558.sys
[2005/11/21 15:58:57 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/11/21 15:52:20 | 000,001,113 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2005/11/15 19:19:37 | 000,000,106 | ---- | C] () -- C:\WINDOWS\Goldrush.ini
[2005/11/06 16:25:41 | 000,019,968 | ---- | C] () -- C:\WINDOWS\hpothb07.dat
[2005/10/31 19:27:46 | 000,000,010 | ---- | C] () -- C:\WINDOWS\Kentucky's Awesome Bucks.dat
[2005/10/31 14:43:07 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\cmdinterface.dll
[2005/10/31 14:43:07 | 000,010,321 | R--- | C] () -- C:\WINDOWS\System32\concord.dll
[2005/10/31 14:42:16 | 000,002,175 | ---- | C] () -- C:\WINDOWS\photoimpression.ini
[2005/10/31 14:42:16 | 000,000,422 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2005/10/31 13:11:16 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\fusioncache.dat
[2005/10/31 12:40:10 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2005/10/31 12:40:04 | 000,000,540 | ---- | C] () -- C:\WINDOWS\videomvp.ini
[2005/10/31 12:39:28 | 000,000,021 | ---- | C] () -- C:\WINDOWS\CS_SETUP.ini
[2005/10/30 17:32:29 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2005/10/25 18:50:40 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/10/25 18:45:24 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/10/25 18:35:06 | 000,000,916 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/10/25 18:31:14 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/10/25 18:09:10 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2005/10/25 18:09:04 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/10/25 18:08:52 | 000,000,394 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 12:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 12:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/10 12:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 12:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 11:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 11:57:15 | 000,392,776 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 11:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 11:51:20 | 000,443,196 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 11:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 11:51:20 | 000,072,270 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 11:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 11:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 11:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 11:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 11:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 11:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 11:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 11:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2009/08/30 14:17:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
[2009/08/30 14:18:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/01/04 18:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company
[2008/03/28 16:10:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iolo
[2009/12/28 13:07:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kds_kodak
[2011/03/27 18:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Leapfrog
[2009/08/16 10:58:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2009/08/16 09:24:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2011/01/04 14:09:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2011/09/15 15:45:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedMaxPc
[2007/11/21 21:06:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/08/30 14:17:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/09/03 17:33:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\acccore
[2011/11/15 19:32:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\AppGraffiti
[2009/08/16 10:00:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Blitware
[2011/08/01 19:10:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\CompuClever
[2010/02/25 16:57:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\gtk-2.0
[2007/12/25 17:02:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\iolo
[2010/11/24 18:09:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Jenkat
[2005/10/30 08:48:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Leadertech
[2011/03/27 14:30:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\PCFix
[2006/12/16 18:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Raptisoft
[2007/12/02 21:05:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Sammsoft
[2009/07/20 13:06:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Skinux
[2010/12/26 17:25:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\SmartDraw
[2010/03/05 16:02:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Temp
[2008/03/29 20:32:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\TrojanHunter
[2005/12/12 18:56:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\WholeSecurity
[2011/11/26 08:00:00 | 000,000,250 | ---- | M] () -- C:\WINDOWS\Tasks\dfrg.job
[2011/11/25 18:00:00 | 000,000,438 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedMaxPc Registration3.job
[2011/09/15 15:45:53 | 000,000,396 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedMaxPc Update3.job
[2011/12/03 14:22:37 | 000,000,420 | ---- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{FFDFEF61-E6DC-4443-9329-85AD9487FCE7}.job

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2008/03/24 17:47:16 | 000,000,000 | ---D | M](C:\Documents and Settings\john\Application Data\??sks) -- C:\Documents and Settings\john\Application Data\Таsks
[2008/03/24 17:47:16 | 000,000,000 | ---D | M](C:\Documents and Settings\john\Application Data\??sks) -- C:\Documents and Settings\john\Application Data\Таsks
[2008/03/18 17:17:05 | 000,000,000 | ---D | M](C:\Documents and Settings\john\Application Data\??sks\??sks) -- C:\Documents and Settings\john\Application Data\Таsks\Таsks
(C:\Documents and Settings\john\Application Data\??sks) -- C:\Documents and Settings\john\Application Data\Таsks

< End of report >
  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you confirm that you now have all your icons/folders back - also could you post the combofix log please

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
    [2011/07/24 10:56:31 | 000,000,184 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fzr
    [2011/07/24 10:56:30 | 000,000,232 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fz
    [2011/07/24 10:56:03 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\P1kAlMiG2Kb7Fz
    [2008/03/28 19:07:49 | 000,019,741 | ---- | C] () -- C:\Documents and Settings\john\Application Data\liqivetole._dl
    [2008/03/28 19:07:49 | 000,018,409 | ---- | C] () -- C:\Program Files\Common Files\ememumorug.ban
    [2008/03/28 19:07:49 | 000,017,754 | ---- | C] () -- C:\Documents and Settings\john\Application Data\gufyp.dll
    [2008/03/28 19:07:49 | 000,017,099 | ---- | C] () -- C:\Documents and Settings\john\Application Data\bawysevec.dat
    [2008/03/28 19:07:49 | 000,016,747 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ocomofug.pif
    [2008/03/28 19:07:49 | 000,012,851 | ---- | C] () -- C:\Program Files\Common Files\niqoqo.pif
    [2008/03/28 19:07:49 | 000,012,512 | ---- | C] () -- C:\WINDOWS\zylany.dat
    [2008/03/28 19:07:49 | 000,011,578 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\unec.dat
    [2008/03/28 19:07:49 | 000,010,705 | ---- | C] () -- C:\Documents and Settings\john\Application Data\nuqiboqes.bin
    [2008/03/28 19:07:48 | 000,010,726 | ---- | C] () -- C:\Documents and Settings\john\Application Data\gyziquly.sys
    [2008/03/23 10:07:27 | 000,014,446 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ybuzeci.pif
    [2008/03/23 10:07:26 | 000,018,923 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\yjirehuqal.db
    [2008/03/23 10:07:26 | 000,018,071 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ydid.db
    [2008/03/23 10:07:26 | 000,017,134 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\imukyginyj.reg
    [2008/03/23 10:07:26 | 000,012,220 | ---- | C] () -- C:\Documents and Settings\john\Application Data\iwehuboz.vbs
    [2008/03/23 10:07:25 | 000,015,263 | ---- | C] () -- C:\Documents and Settings\john\Application Data\ysuhaqar.lib
    [2008/03/23 10:07:25 | 000,014,621 | ---- | C] () -- C:\WINDOWS\System32\oxanazym.bin
    [2008/03/23 10:07:24 | 000,019,449 | ---- | C] () -- C:\Program Files\Common Files\fymima._sy
    [2008/03/23 10:07:24 | 000,010,789 | ---- | C] () -- C:\Documents and Settings\john\Application Data\tiwysybehy.bin
    [2008/03/23 10:07:24 | 000,010,178 | ---- | C] () -- C:\Program Files\Common Files\fizoqahe.vbs
    [2008/03/23 10:07:23 | 000,018,791 | ---- | C] () -- C:\WINDOWS\mofofozu.com
    [2008/03/23 10:07:23 | 000,014,524 | ---- | C] () -- C:\WINDOWS\ahitejujo.sys
    [2008/03/23 10:07:22 | 000,016,165 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\ecak._sy
    [2008/03/23 10:07:22 | 000,010,959 | ---- | C] () -- C:\Program Files\Common Files\jicitecyp.vbs
    [2008/03/23 10:07:21 | 000,014,691 | ---- | C] () -- C:\Program Files\Common Files\wofuketyte.dat
    [2008/03/23 10:07:20 | 000,016,258 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\onucuqe.inf
    [2008/03/14 07:15:06 | 000,018,724 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\abepoja.dl
    [2008/03/14 07:15:06 | 000,018,644 | ---- | C] () -- C:\WINDOWS\oriwex.sys
    [2008/03/14 07:15:06 | 000,018,488 | ---- | C] () -- C:\WINDOWS\ucecol.bin
    [2008/03/14 07:15:06 | 000,015,759 | ---- | C] () -- C:\WINDOWS\nadoj.bin
    [2008/03/14 07:15:06 | 000,015,355 | ---- | C] () -- C:\WINDOWS\miloco.sys
    [2008/03/14 07:15:06 | 000,014,595 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\aquzofap.bat
    [2008/03/14 07:15:06 | 000,013,686 | ---- | C] () -- C:\Program Files\Common Files\afyfy.lib
    [2008/03/14 07:15:06 | 000,011,484 | ---- | C] () -- C:\Program Files\Common Files\puwu.pif
    [2008/03/14 07:15:06 | 000,010,709 | ---- | C] () -- C:\WINDOWS\ruxo.bin
    [2008/03/14 07:15:06 | 000,010,524 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\tupigag.bat
    [2008/03/03 17:32:05 | 000,000,021 | ---- | C] () -- C:\WINDOWS\arcsuite.ini
    [2008/03/02 17:25:15 | 000,000,078 | ---- | C] () -- C:\WINDOWS\qwimp.ini
    [2008/03/24 17:47:16 | 000,000,000 | ---D | M](C:\Documents and Settings\john\Application Data\??sks) -- C:\Documents and Settings\john\Application Data\Таsks
    [2008/03/24 17:47:16 | 000,000,000 | ---D | M](C:\Documents and Settings\john\Application Data\??sks) -- C:\Documents and Settings\john\Application Data\Таsks
    [2008/03/18 17:17:05 | 000,000,000 | ---D | M](C:\Documents and Settings\john\Application Data\??sks\??sks) -- C:\Documents and Settings\john\Application Data\Таsks\Таsks
    (C:\Documents and Settings\john\Application Data\??sks) -- C:\Documents and Settings\john\Application Data\Таsks


    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

  • 0

#5
Fatie32

Fatie32

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 122 posts
network is working icons are back etc... where is combofix log....
  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
It should be at C:\combofix.txt
  • 0

#7
Fatie32

Fatie32

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 122 posts
otl


All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fzr moved successfully.
C:\Documents and Settings\All Users\Application Data\~P1kAlMiG2Kb7Fz moved successfully.
C:\Documents and Settings\All Users\Application Data\P1kAlMiG2Kb7Fz moved successfully.
C:\Documents and Settings\john\Application Data\liqivetole._dl moved successfully.
C:\Program Files\Common Files\ememumorug.ban moved successfully.
C:\Documents and Settings\john\Application Data\gufyp.dll moved successfully.
C:\Documents and Settings\john\Application Data\bawysevec.dat moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\ocomofug.pif moved successfully.
C:\Program Files\Common Files\niqoqo.pif moved successfully.
C:\WINDOWS\zylany.dat moved successfully.
C:\Documents and Settings\All Users\Application Data\unec.dat moved successfully.
C:\Documents and Settings\john\Application Data\nuqiboqes.bin moved successfully.
C:\Documents and Settings\john\Application Data\gyziquly.sys moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\ybuzeci.pif moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\yjirehuqal.db moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\ydid.db moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\imukyginyj.reg moved successfully.
C:\Documents and Settings\john\Application Data\iwehuboz.vbs moved successfully.
C:\Documents and Settings\john\Application Data\ysuhaqar.lib moved successfully.
C:\WINDOWS\system32\oxanazym.bin moved successfully.
C:\Program Files\Common Files\fymima._sy moved successfully.
C:\Documents and Settings\john\Application Data\tiwysybehy.bin moved successfully.
C:\Program Files\Common Files\fizoqahe.vbs moved successfully.
C:\WINDOWS\mofofozu.com moved successfully.
C:\WINDOWS\ahitejujo.sys moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\ecak._sy moved successfully.
C:\Program Files\Common Files\jicitecyp.vbs moved successfully.
C:\Program Files\Common Files\wofuketyte.dat moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\onucuqe.inf moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\abepoja.dl moved successfully.
C:\WINDOWS\oriwex.sys moved successfully.
C:\WINDOWS\ucecol.bin moved successfully.
C:\WINDOWS\nadoj.bin moved successfully.
C:\WINDOWS\miloco.sys moved successfully.
C:\Documents and Settings\All Users\Application Data\aquzofap.bat moved successfully.
C:\Program Files\Common Files\afyfy.lib moved successfully.
C:\Program Files\Common Files\puwu.pif moved successfully.
C:\WINDOWS\ruxo.bin moved successfully.
C:\Documents and Settings\john\Local Settings\Application Data\tupigag.bat moved successfully.
C:\WINDOWS\arcsuite.ini moved successfully.
C:\WINDOWS\qwimp.ini moved successfully.
C:\Documents and Settings\john\Application Data\Таsks\Таsks folder moved successfully.
C:\Documents and Settings\john\Application Data\Таsks folder moved successfully.
Folder C:\Documents and Settings\john\Application Data\Таsks\Таsks\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\john\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\john\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Administrator.AL
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: Administrator.AL.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: Administrator.AL.001
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78924 bytes
->Flash cache emptied: 405 bytes

User: Administrator.AL.002
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 3807 bytes
->Google Chrome cache emptied: 31404345 bytes
->Flash cache emptied: 510 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41703 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33788371 bytes
->Flash cache emptied: 42318 bytes

User: john
->Temp folder emptied: 58528 bytes
->Temporary Internet Files folder emptied: 23731326 bytes
->Java cache emptied: 5365192 bytes
->FireFox cache emptied: 4444275 bytes
->Google Chrome cache emptied: 8863115 bytes
->Flash cache emptied: 129716 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Mony
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 299619 bytes
->Java cache emptied: 488 bytes
->Flash cache emptied: 57097 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2435163 bytes
%systemroot%\System32 .tmp files removed: 4528576 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1372 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 110.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.31.0 log created on 12032011_174107

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...



that combofix log



ComboFix 11-12-03.01 - john 12/03/2011 13:12:30.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.647 [GMT -6:00]
Running from: c:\documents and settings\john\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\Guest\Application Data\PriceGong
c:\documents and settings\john\ResErrors.log
c:\documents and settings\john\System
c:\documents and settings\john\System\win_qs8.jqx
c:\documents and settings\john\WINDOWS
C:\iexplore.exe
c:\program files\Common Files\pirawy.db
c:\program files\RadioPI_4eEI
c:\program files\StartNow Toolbar
c:\program files\StartNow Toolbar\Resources\images\engine_images.png
c:\program files\StartNow Toolbar\Resources\images\engine_maps.png
c:\program files\StartNow Toolbar\Resources\images\engine_news.png
c:\program files\StartNow Toolbar\Resources\images\engine_videos.png
c:\program files\StartNow Toolbar\Resources\images\engine_web.png
c:\program files\StartNow Toolbar\Resources\images\icon_amazon.png
c:\program files\StartNow Toolbar\Resources\images\icon_ebay.png
c:\program files\StartNow Toolbar\Resources\images\icon_facebook.png
c:\program files\StartNow Toolbar\Resources\images\icon_games.png
c:\program files\StartNow Toolbar\Resources\images\icon_msn.png
c:\program files\StartNow Toolbar\Resources\images\icon_shopping.png
c:\program files\StartNow Toolbar\Resources\images\icon_travel.png
c:\program files\StartNow Toolbar\Resources\images\icon_twitter.png
c:\program files\StartNow Toolbar\Resources\images\startnow_logo.png
c:\program files\StartNow Toolbar\Resources\installer.xml
c:\program files\StartNow Toolbar\Resources\protect\index.html
c:\program files\StartNow Toolbar\Resources\protect\NotIE6.css
c:\program files\StartNow Toolbar\Resources\protect\OnlyIE6.css
c:\program files\StartNow Toolbar\Resources\protect\SearchProtectIcon.png
c:\program files\StartNow Toolbar\Resources\protect\window.css
c:\program files\StartNow Toolbar\Resources\protect\window.js
c:\program files\StartNow Toolbar\Resources\reactivate\index.html
c:\program files\StartNow Toolbar\Resources\reactivate\LeftImage.png
c:\program files\StartNow Toolbar\Resources\reactivate\NotIE6.css
c:\program files\StartNow Toolbar\Resources\reactivate\OnlyIE6.css
c:\program files\StartNow Toolbar\Resources\reactivate\window.css
c:\program files\StartNow Toolbar\Resources\reactivate\window.js
c:\program files\StartNow Toolbar\Resources\skin\chevron_button.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_hover.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_normal.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_background.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_left.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_middle.png
c:\program files\StartNow Toolbar\Resources\skin\separator.png
c:\program files\StartNow Toolbar\Resources\skin\splitter.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png
c:\program files\StartNow Toolbar\Resources\toolbar.xml
c:\program files\StartNow Toolbar\Resources\update.xml
c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe
c:\program files\StartNow Toolbar\ToOLbar32.dll
c:\program files\StartNow Toolbar\ToolbarUpdaterService.exe
c:\program files\StartNow Toolbar\uninstall.dat
c:\windows\AutoRun.ini
c:\windows\system32\bszip.dll
c:\windows\system32\crosof~1.net
c:\windows\system32\dumphive.exe
c:\windows\system32\e5
c:\windows\system32\kjkmp.ini
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\usmt\migwiz_a.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DHLP
-------\Legacy_Updater_Service_for_StartNow_Toolbar
-------\Legacy_Updater_Service_for_StartNow_Toolbar
-------\Service_Updater Service for StartNow Toolbar
-------\Service_Updater Service for StartNow Toolbar
.
.
((((((((((((((((((((((((( Files Created from 2011-11-03 to 2011-12-03 )))))))))))))))))))))))))))))))
.
.
2011-12-03 18:03 . 2011-12-03 18:03 -------- d-----w- c:\documents and settings\Mony\Application Data\JAM Software
2011-11-24 15:03 . 2011-11-24 15:05 -------- d-----w- c:\documents and settings\Administrator.AL.002\Local Settings\Application Data\Google
2011-11-24 15:02 . 2011-11-24 15:02 -------- d-----w- c:\documents and settings\Administrator.AL.002\Local Settings\Application Data\Deployment
2011-11-24 15:01 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-24 15:01 . 2011-11-24 15:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-24 14:55 . 2008-04-14 01:11 21504 ----a-w- c:\windows\system32\hidserv.dll
2011-11-15 17:02 . 2011-11-15 17:05 525760 ----a-w- c:\windows\system32\PerfStringBackup.TMP
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-20 22:10 . 2011-10-17 23:21 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2008-03-29 01:07 . 2008-03-29 01:07 12851 -c-ha-w- c:\program files\Common Files\niqoqo.pif
2008-03-23 16:07 . 2008-03-23 16:07 10178 -c-ha-w- c:\program files\Common Files\fizoqahe.vbs
2008-03-23 16:07 . 2008-03-23 16:07 10959 -c-ha-w- c:\program files\Common Files\jicitecyp.vbs
2008-03-14 13:15 . 2008-03-14 13:15 11484 -c-ha-w- c:\program files\Common Files\puwu.pif
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-05 39408]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 148888]
"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2009-08-03 1626112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-22 98304]
"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-11-19 193880]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=c:\windows\pss\hp psc 1000 series.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinReanimator
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 17:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2008-08-14 00:32 206064 ---ha-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=
"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=
"c:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58305:TCP"= 58305:TCP:Pando Media Booster
"58305:UDP"= 58305:UDP:Pando Media Booster
"9322:TCP"= 9322:TCP:EKDiscovery
.
R2 GoldrushUSB;GoldrushUSB;c:\windows\system32\drivers\goldrush.sys [10/31/2005 2:43 PM 11387]
R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [12/25/2007 3:42 PM 628584]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [12/25/2007 3:42 PM 628584]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/30/2009 2:17 PM 24652]
S1 seriall;seriall;c:\windows\system32\drivers\seriall.sys --> c:\windows\system32\drivers\seriall.sys [?]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [8/5/2009 12:49 PM 284016]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-26 c:\windows\Tasks\dfrg.job
- c:\windows\system32\dfrg.msc [2004-08-10 10:00]
.
2011-12-03 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-16 14:55]
.
2011-11-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-500Core.job
- c:\documents and settings\Administrator.AL.002\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-11-24 15:03]
.
2011-11-26 c:\windows\Tasks\SpeedMaxPc Registration3.job
- c:\program files\Common Files\SpeedMaxPc\UUS3\UUS3.dll [2010-11-02 18:09]
.
2011-09-15 c:\windows\Tasks\SpeedMaxPc Update3.job
- c:\program files\Common Files\SpeedMaxPc\UUS3\Update3.exe [2010-11-02 18:09]
.
2011-12-03 c:\windows\Tasks\User_Feed_Synchronization-{FFDFEF61-E6DC-4443-9329-85AD9487FCE7}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &eBay Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 64.233.207.8 64.233.207.9
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Aim6 - (no file)
HKCU-Run-jrwbtXcxTKhC - c:\documents and settings\All Users\Application Data\jrwbtXcxTKhC.exe
HKCU-Run-DellSupport - c:\program files\DellSupport\DSAgnt.exe
AddRemove-StartNow Toolbar - c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-03 13:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(972)
c:\windows\system32\l3codeca.acm
.
- - - - - - - > 'explorer.exe'(2260)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-12-03 13:31:40
ComboFix-quarantined-files.txt 2011-12-03 19:31
.
Pre-Run: 59,207,843,840 bytes free
Post-Run: 59,178,790,912 bytes free
.
- - End Of File - - 827230DDA6D685645175C96836D619CB
  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
A final few to kill, then a check for orphans... How is the system behaving now ?

What antivirus are you using ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Files
    ipconfig /flushdns /c
    c:\program files\Common Files\fizoqahe.vbs
    c:\program files\Common Files\jicitecyp.vbs
    c:\program files\Common Files\puwu.pif

    :Commands
    [purity]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
  • 0

#9
Fatie32

Fatie32

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 122 posts
gonna run those 2 scans now.....im gonna put avast on here.
  • 0

#10
Fatie32

Fatie32

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 122 posts
otl



OTL logfile created on: 12/4/2011 11:54:12 AM - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\john\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.98 Mb Total Physical Memory | 698.64 Mb Available Physical Memory | 68.36% Memory free
1.65 Gb Paging File | 1.43 Gb Available in Paging File | 86.40% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.97 Gb Total Space | 54.17 Gb Free Space | 76.33% Space Free | Partition Type: NTFS
Drive F: | 14.91 Gb Total Space | 13.86 Gb Free Space | 92.98% Space Free | Partition Type: FAT32

Computer Name: AL | User Name: john | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/03 15:40:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\john\Desktop\OTL.exe
PRC - [2010/11/19 12:38:08 | 000,193,880 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
PRC - [2010/11/19 12:29:00 | 004,916,568 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
PRC - [2010/10/27 19:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/03/18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/05/26 20:06:32 | 004,351,216 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
PRC - [2009/03/05 15:07:20 | 002,260,480 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/08/13 18:32:40 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/04/13 18:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\userinit.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
PRC - [2007/11/15 09:24:00 | 000,016,384 | ---- | M] ( ) -- C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
PRC - [2007/07/09 12:54:08 | 000,177,416 | R--- | M] (Authentium, Inc.) -- C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
PRC - [2007/01/04 15:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe


========== Modules (No Company Name) ==========

MOD - [2011/12/04 03:12:37 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2010/01/31 21:52:12 | 008,347,648 | ---- | M] () -- C:\Program Files\LeapFrog\LeapFrog Connect\QtGui4.dll
MOD - [2010/01/31 21:52:12 | 002,244,608 | ---- | M] () -- C:\Program Files\LeapFrog\LeapFrog Connect\QtCore4.dll
MOD - [2009/05/26 20:06:28 | 000,913,408 | ---- | M] () -- C:\Program Files\Yahoo!\Messenger\yui.dll
MOD - [2009/05/26 20:06:20 | 000,102,400 | ---- | M] () -- C:\Program Files\Yahoo!\Messenger\clientmanager.dll
MOD - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
MOD - [2008/01/09 16:46:50 | 000,105,816 | ---- | M] () -- C:\Program Files\iolo\Common\Lib\ioloHL.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2010/11/19 12:29:00 | 004,916,568 | ---- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service)
SRV - [2010/03/18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/08/05 12:49:44 | 000,284,016 | ---- | M] (Eastman Kodak Company) [Auto | Stopped] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service)
SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () [Auto | Running] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloSystemService)
SRV - [2008/02/26 12:31:16 | 000,628,584 | ---- | M] () [Auto | Running] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloFileInfoList)
SRV - [2007/07/09 12:54:08 | 000,177,416 | R--- | M] (Authentium, Inc.) [Auto | Start_Pending] -- C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe -- (dvpapi)
SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2007/01/04 15:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)


========== Driver Services (SafeList) ==========

DRV - [2008/03/29 21:18:21 | 000,076,560 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2007/07/09 12:01:04 | 000,834,448 | ---- | M] (Authentium, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Css-Dvp.sys -- (CSS DVP)
DRV - [2007/03/01 09:34:36 | 000,028,352 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2004/10/07 19:16:04 | 000,035,840 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2004/09/17 13:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2003/11/17 20:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 20:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 20:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/01/10 10:56:34 | 000,030,921 | ---- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SQCaptur.sys -- (DCamUSBSQTECH) Dual-Mode DSC(2770)
DRV - [2001/08/14 00:59:36 | 000,011,387 | R--- | M] (Agilent Technologies) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\goldrush.sys -- (GoldrushUSB)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.c...rch/search.html
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://us.rd.yahoo.c...//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.ask.com/?...?o=20011&l=dis"
FF - prefs.js..browser.search.selectedEngine: "AIM Search"
FF - prefs.js..keyword.URL: "http://slirsredirect...ir=2706&query="

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\john\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\john\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)


[2011/04/04 18:02:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\john\Application Data\Mozilla\Firefox\Profiles\ttn7jgms.default\extensions
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
[2008/03/24 19:21:00 | 002,889,088 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NPSWF32.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\john\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.140.8 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U14 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\john\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\john\Local Settings\Application Data\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\john\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
CHR - plugin: Yahoo! activeX Plug-in Bridge (Enabled) = C:\Program Files\Yahoo!\Common\npyaxmpb.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2011/12/03 17:41:12 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O2 - BHO: (Inbox Toolbar) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [Monitor] C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\john\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: &eBay Search - Reg Error: Value error. File not found
O9 - Extra Button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.t...ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.ma...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} http://www.kodakgall..._2/axofupld.cab (Kodak Gallery Easy Upload Manager Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.233.207.8 64.233.207.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23EF4B2E-3DA4-49E6-8B15-C13DA27349B2}: DhcpNameServer = 64.233.207.8 64.233.207.9
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\john\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\john\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/04 11:59:16 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\john\Recent
[2011/12/03 17:42:27 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/12/03 17:41:07 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/12/03 17:01:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\john\Start Menu\Programs\Google Chrome
[2011/12/03 15:40:46 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\john\Desktop\OTL.exe
[2011/12/03 15:39:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\john\Desktop\RK_Quarantine
[2011/12/03 13:18:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AntiVir PersonalEdition Classic
[2011/12/03 13:10:00 | 004,326,308 | R--- | C] (Swearware) -- C:\Documents and Settings\john\Desktop\ComboFix.exe
[2011/12/03 13:01:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/12/03 12:53:57 | 000,000,000 | R-SD | C] -- C:\cmdcons
[2011/12/03 12:49:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/12/03 12:49:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/12/03 12:49:38 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/12/03 12:49:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/12/03 12:49:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/12/03 12:49:29 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/11/24 09:01:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/11/24 09:01:42 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/11/24 09:01:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/11/15 19:32:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\john\Application Data\AppGraffiti

========== Files - Modified Within 30 Days ==========

[2011/12/04 11:56:25 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/04 11:54:00 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/12/04 11:53:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/04 11:04:00 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-1006UA.job
[2011/12/04 09:09:00 | 000,000,972 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-500Core.job
[2011/12/04 03:33:31 | 000,392,776 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/04 03:32:00 | 000,000,396 | ---- | M] () -- C:\WINDOWS\tasks\SpeedMaxPc Update3.job
[2011/12/04 03:16:36 | 000,443,196 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/12/04 03:16:36 | 000,072,270 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/12/04 03:04:42 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2011/12/04 03:04:41 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2011/12/03 18:00:00 | 000,000,438 | ---- | M] () -- C:\WINDOWS\tasks\SpeedMaxPc Registration3.job
[2011/12/03 17:41:12 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/12/03 17:04:01 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-1006Core.job
[2011/12/03 17:01:49 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\john\Desktop\Google Chrome.lnk
[2011/12/03 17:01:49 | 000,002,255 | ---- | M] () -- C:\Documents and Settings\john\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/03 15:40:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\john\Desktop\OTL.exe
[2011/12/03 15:39:06 | 000,111,872 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011/12/03 14:22:37 | 000,000,420 | ---- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{FFDFEF61-E6DC-4443-9329-85AD9487FCE7}.job
[2011/12/03 13:10:00 | 004,326,308 | R--- | M] (Swearware) -- C:\Documents and Settings\john\Desktop\ComboFix.exe
[2011/12/03 12:54:02 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/12/03 12:25:33 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/11/26 08:00:00 | 000,000,250 | ---- | M] () -- C:\WINDOWS\tasks\dfrg.job

========== Files Created - No Company Name ==========

[2011/12/04 03:04:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2011/12/04 03:04:41 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2011/12/03 17:01:49 | 000,002,277 | ---- | C] () -- C:\Documents and Settings\john\Desktop\Google Chrome.lnk
[2011/12/03 17:01:49 | 000,002,255 | ---- | C] () -- C:\Documents and Settings\john\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/03 16:59:44 | 000,000,974 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-1006UA.job
[2011/12/03 16:59:43 | 000,000,922 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-1006Core.job
[2011/12/03 15:39:06 | 000,111,872 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011/12/03 13:19:06 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
[2011/12/03 13:18:53 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2011/12/03 13:18:52 | 000,002,489 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
[2011/12/03 13:18:52 | 000,002,475 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft PowerPoint.lnk
[2011/12/03 13:18:52 | 000,002,030 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk
[2011/12/03 13:18:52 | 000,001,890 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2011/12/03 13:18:52 | 000,001,690 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\PowerDVD.lnk
[2011/12/03 13:18:52 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Acrobat_com.lnk
[2011/12/03 13:18:52 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/12/03 12:54:02 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/12/03 12:53:58 | 000,260,272 | R-S- | C] () -- C:\cmldr
[2011/12/03 12:49:38 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/12/03 12:49:38 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/12/03 12:49:38 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/12/03 12:49:38 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/12/03 12:49:38 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/11/24 09:09:23 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/11/24 09:04:01 | 000,000,972 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-574691411-1573866777-150471311-500Core.job
[2010/06/28 16:47:52 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\Lffpx7.dll
[2010/06/28 16:47:52 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\Lfkodak.dll
[2010/03/04 17:12:13 | 000,012,286 | --S- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\04lB
[2009/08/30 14:18:24 | 000,000,021 | ---- | C] () -- C:\WINDOWS\atid.ini
[2008/04/27 14:47:14 | 000,020,454 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2008/04/27 14:47:14 | 000,016,618 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2008/03/29 21:18:28 | 000,002,162 | ---- | C] () -- C:\WINDOWS\System32\tmmute.ini
[2008/03/29 14:02:05 | 000,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll
[2008/03/29 13:29:17 | 000,000,023 | --S- | C] () -- C:\WINDOWS\System32\eceb3_z.dll
[2008/01/13 19:12:40 | 000,000,432 | ---- | C] () -- C:\WINDOWS\System32\iolo.ini
[2008/01/13 19:10:20 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\iavlsp.dll
[2007/12/25 15:42:19 | 000,074,703 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll
[2007/12/25 12:54:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\REGCLEAR.INI
[2007/07/14 11:48:47 | 000,000,135 | ---- | C] () -- C:\WINDOWS\ALBUM.INI
[2006/07/06 19:35:08 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI4_setup.ini
[2006/07/03 18:00:24 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/06/19 18:16:19 | 000,000,043 | ---- | C] () -- C:\WINDOWS\BTW.INI
[2006/04/27 16:56:54 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2006/04/16 13:59:28 | 000,004,212 | ---- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2006/04/03 16:24:08 | 000,000,085 | ---- | C] () -- C:\WINDOWS\ImportClient.INI
[2006/04/03 16:08:06 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PretzelSpellCheck.dll
[2006/04/03 16:07:30 | 000,000,751 | ---- | C] () -- C:\WINDOWS\Bti.ini
[2006/04/03 16:07:28 | 000,116,640 | ---- | C] () -- C:\WINDOWS\System32\Ptsaci40.dll
[2006/04/03 16:07:28 | 000,030,080 | ---- | C] () -- C:\WINDOWS\System32\Ptabimp3.exe
[2006/02/18 14:48:24 | 000,002,937 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/11/21 17:31:33 | 000,003,350 | --S- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005/11/21 17:31:33 | 000,000,056 | R-S- | C] () -- C:\WINDOWS\System32\1F6DDC9558.sys
[2005/11/21 15:58:57 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/11/21 15:52:20 | 000,001,113 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2005/11/15 19:19:37 | 000,000,106 | ---- | C] () -- C:\WINDOWS\Goldrush.ini
[2005/11/06 16:25:41 | 000,019,968 | ---- | C] () -- C:\WINDOWS\hpothb07.dat
[2005/10/31 19:27:46 | 000,000,010 | ---- | C] () -- C:\WINDOWS\Kentucky's Awesome Bucks.dat
[2005/10/31 14:43:07 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\cmdinterface.dll
[2005/10/31 14:43:07 | 000,010,321 | R--- | C] () -- C:\WINDOWS\System32\concord.dll
[2005/10/31 14:42:16 | 000,002,175 | ---- | C] () -- C:\WINDOWS\photoimpression.ini
[2005/10/31 14:42:16 | 000,000,422 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2005/10/31 13:11:16 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\john\Local Settings\Application Data\fusioncache.dat
[2005/10/31 12:40:10 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2005/10/31 12:40:04 | 000,000,540 | ---- | C] () -- C:\WINDOWS\videomvp.ini
[2005/10/31 12:39:28 | 000,000,021 | ---- | C] () -- C:\WINDOWS\CS_SETUP.ini
[2005/10/30 17:32:29 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2005/10/25 18:50:40 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/10/25 18:45:24 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/10/25 18:35:06 | 000,000,916 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/10/25 18:31:14 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/10/25 18:09:10 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2005/10/25 18:09:04 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/10/25 18:08:52 | 000,000,394 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 12:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 12:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/10 12:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 12:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 11:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 11:57:15 | 000,392,776 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 11:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 11:51:20 | 000,443,196 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 11:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 11:51:20 | 000,072,270 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 11:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 11:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 11:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 11:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 11:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 11:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 11:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 11:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2009/08/30 14:17:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
[2009/08/30 14:18:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/01/04 18:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company
[2008/03/28 16:10:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iolo
[2009/12/28 13:07:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kds_kodak
[2011/03/27 18:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Leapfrog
[2009/08/16 10:58:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2009/08/16 09:24:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2011/01/04 14:09:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2011/09/15 15:45:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedMaxPc
[2007/11/21 21:06:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/08/30 14:17:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/09/03 17:33:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\acccore
[2011/11/15 19:32:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\AppGraffiti
[2009/08/16 10:00:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Blitware
[2011/08/01 19:10:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\CompuClever
[2010/02/25 16:57:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\gtk-2.0
[2007/12/25 17:02:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\iolo
[2010/11/24 18:09:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Jenkat
[2005/10/30 08:48:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Leadertech
[2011/03/27 14:30:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\PCFix
[2006/12/16 18:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Raptisoft
[2007/12/02 21:05:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Sammsoft
[2009/07/20 13:06:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Skinux
[2010/12/26 17:25:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\SmartDraw
[2010/03/05 16:02:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\Temp
[2008/03/29 20:32:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\TrojanHunter
[2005/12/12 18:56:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\john\Application Data\WholeSecurity
[2011/11/26 08:00:00 | 000,000,250 | ---- | M] () -- C:\WINDOWS\Tasks\dfrg.job
[2011/12/03 18:00:00 | 000,000,438 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedMaxPc Registration3.job
[2011/12/04 03:32:00 | 000,000,396 | ---- | M] () -- C:\WINDOWS\Tasks\SpeedMaxPc Update3.job
[2011/12/03 14:22:37 | 000,000,420 | ---- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{FFDFEF61-E6DC-4443-9329-85AD9487FCE7}.job

========== Purity Check ==========



< End of report >



mbam

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8309

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/4/2011 12:09:30 PM
mbam-log-2011-12-04 (12-09-30).txt

Scan type: Quick scan
Objects scanned: 276662
Time elapsed: 7 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • 0

#11
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
How is it running now ? Any outstanding problems ?
  • 0

#12
Fatie32

Fatie32

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 122 posts
Not that I can see seems good but its an older machine
  • 0

#13
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
A defragment of the drive on completion of this may perk the system up a bit


Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Commands
    [resethosts]
    [emptytemp]
    [CLEARALLRESTOREPOINTS]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done

Remove ComboFix
  • Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
  • In the Run box, type in ComboFix /Uninstall
    (Notice the space between the "x" and "/")
    then click OK

    Posted Image
  • Follow the prompts on the screen
  • A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

Posted Image Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:
  • Go to this site and click Do I have Java
  • It will check your current version and then offer to update to the latest version


Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe :wave:
  • 0

#14
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP