Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

alureon k detection [Solved]

Started by dixaloo , Apr 26 2012 02:20 PM

This topic is locked

#1
dixaloo

Posted 26 April 2012 - 02:20 PM

New Member

Member
7 posts

Hello please help! Today my pc crashed twice and rebooted itself. I scanned my system w avast and it found MBR Alureon-k rtk. I was not able to fix it and since then it has been redirecting me and @ have lost all icons on desktop and start menu. I tried to download and run aswmbr, but it does nothing. What can i do?

#2
Essexboy

Posted 26 April 2012 - 02:30 PM

GeekU Moderator

Retired Staff
69,964 posts

Hi there lets try the following

Download RogueKiller and save it on your desktop.
Quit all programs
Start RogueKiller.exe.
Wait until Prescan has finished ...
Click on Scan

Wait for the end of the scan.
The report has been created on the desktop.
Click on the Delete button.

The report has been created on the desktop.

Next click on the ShortcutsFix
The report has been created on the desktop.

Please post: All RKreport.txt text files located on your desktop.

THEN

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
erase c:\commands.txt /hide /c
/wait
erase c:\diskreport.txt /hide /c
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

FINALLY

Download aswMBR.exe ( 4.1mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan

Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply

Posted Image

#3
dixaloo

Posted 26 April 2012 - 03:55 PM

New Member

Topic Starter
Member
7 posts

Ok, I guess it takes a long time for these to work on my pc. It's old. Initially my desktop went black and I couldn't find any programs at all, but I was able to make some headway by searching through task mananger. Little by little things came back. I finally got my icons back this afternoon and I found the reports.

RogueKiller V7.3.3 [04/22/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: rogerrabbit [Admin rights]
Mode: Scan -- Date: 04/26/2012 16:49:12

¤¤¤ Bad processes: 1 ¤¤¤
[SUSP PATH] FEpvdGsYapE.exe -- C:\Documents and Settings\All Users\Application Data\FEpvdGsYapE.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 19 ¤¤¤
[SUSP PATH] HKLM\[...]\Run : FEpvdGsYapE.exe (C:\Documents and Settings\All Users\Application Data\FEpvdGsYapE.exe) -> FOUND
[HJPOL] HKCU\[...]\Policies\Explorer\Explorer : NoDesktop (1) -> FOUND
[WallPP] HKCU\[...]\Desktop : Wallpaper () -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyComputer (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowSearch (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyDocs (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowRun (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST340014A +++++
--- User ---
[MBR] a33fe500b0c139c77af03bb2e0ffe7a0
[BSP] 5cf487a9f96c639529273edcde4778a7 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38161 Mo
User = LL1 ... OK!
User != LL2 ... KO!
--- LL2 ---
[MBR] 89099817a61acf29a073ba0d1cb33c61
[BSP] 5cf487a9f96c639529273edcde4778a7 : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38161 Mo
1 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 78155280 | Size: 4 Mo

Finished : << RKreport[1].txt >>
RKreport[1].txt

RogueKiller V7.3.3 [04/22/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: rogerrabbit [Admin rights]
Mode: Scan -- Date: 04/26/2012 18:32:21

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 19 ¤¤¤
[SUSP PATH] HKLM\[...]\Run : FEpvdGsYapE.exe (C:\Documents and Settings\All Users\Application Data\FEpvdGsYapE.exe) -> FOUND
[HJPOL] HKCU\[...]\Policies\Explorer\Explorer : NoDesktop (1) -> FOUND
[WallPP] HKCU\[...]\Desktop : Wallpaper () -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyComputer (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowSearch (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyDocs (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowRun (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST340014A +++++
--- User ---
[MBR] a33fe500b0c139c77af03bb2e0ffe7a0
[BSP] 5cf487a9f96c639529273edcde4778a7 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38161 Mo
User = LL1 ... OK!
User != LL2 ... KO!
--- LL2 ---
[MBR] 89099817a61acf29a073ba0d1cb33c61
[BSP] 5cf487a9f96c639529273edcde4778a7 : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38161 Mo
1 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 78155280 | Size: 4 Mo

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

RogueKiller V7.3.3 [04/22/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: rogerrabbit [Admin rights]
Mode: Remove -- Date: 04/26/2012 18:34:43

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 19 ¤¤¤
[SUSP PATH] HKLM\[...]\Run : FEpvdGsYapE.exe (C:\Documents and Settings\All Users\Application Data\FEpvdGsYapE.exe) -> DELETED
[HJPOL] HKCU\[...]\Policies\Explorer\Explorer : NoDesktop (1) -> DELETED
[WallPP] HKCU\[...]\Desktop : Wallpaper () -> REPLACED (C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp)
[HJ] HKCU\[...]\Advanced : Start_ShowMyComputer (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowSearch (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowMyDocs (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowUser (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowHelp (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowRun (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST340014A +++++
--- User ---
[MBR] a33fe500b0c139c77af03bb2e0ffe7a0
[BSP] 5cf487a9f96c639529273edcde4778a7 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38161 Mo
User = LL1 ... OK!
User != LL2 ... KO!
--- LL2 ---
[MBR] 89099817a61acf29a073ba0d1cb33c61
[BSP] 5cf487a9f96c639529273edcde4778a7 : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38161 Mo
1 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 78155280 | Size: 4 Mo

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

RogueKiller V7.3.3 [04/22/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: rogerrabbit [Admin rights]
Mode: Shortcuts HJfix -- Date: 04/26/2012 18:39:01

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 32 / Fail 0
Quick launch: Success 6 / Fail 0
Programs: Success 13245 / Fail 0
Start menu: Success 228 / Fail 0
User folder: Success 9588 / Fail 0
My documents: Success 601 / Fail 0
My favorites: Success 14 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 26504 / Fail 0
Backup: [FOUND] Success 164 / Fail 0

Drives:
[A:] \Device\Floppy0 -- 0x2 --> Skipped
[C:] \Device\HarddiskVolume1 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped

¤¤¤ Infection : Rogue.FakeHDD ¤¤¤

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

OTL.txt

OTL logfile created on: 4/26/2012 10:37:01 PM - Run 1
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Documents and Settings\rogerrabbit\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 146.09 Mb Available Physical Memory | 29.02% Memory free
980.24 Mb Paging File | 424.59 Mb Available in Paging File | 43.31% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.52 Gb Free Space | 49.69% Space Free | Partition Type: NTFS
Drive D: | 377.21 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: D530AUCTION | User Name: rogerrabbit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
PRC - [2012/03/06 18:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/11/03 12:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\WINDOWS\PixArt\Pac207\Monitor.exe

========== Modules (No Company Name) ==========

MOD - [2012/04/26 13:15:53 | 001,771,520 | ---- | M] () -- C:\Program Files\Alwil Software\Avast5\defs\12042601\algo.dll
MOD - [2010/09/11 13:33:07 | 000,108,320 | ---- | M] () -- C:\Program Files\Java\jre6\bin\jp2iexp.dll
MOD - [2010/09/11 13:33:07 | 000,008,192 | ---- | M] () -- C:\Program Files\Java\jre6\bin\jp2native.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/04/25 12:47:16 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\XPTWOPORT.SYS -- (XPTWOPORTMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RTL8192cu.sys -- (RTL8192cu)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012/04/26 12:48:42 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2012/03/06 18:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 18:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 18:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012/03/06 18:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 18:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/03/06 18:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/03/06 17:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/07/25 01:18:32 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2008/06/06 09:15:40 | 000,098,816 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp)
DRV - [2006/11/20 09:48:40 | 000,506,112 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PFC027.SYS -- (PAC207)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\..\SearchScopes,DefaultScope = {a5b9c0f5-5616-47cd-a95f-e43b488faccf}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebs...r={searchTerms}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://inboxtoolbar....tb_id&%language
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsea...CFSaFQAodNjC41w
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\SearchScopes,DefaultScope = {1872A8D0-31BA-45B5-BD0D-7EED47567AD6}
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\SearchScopes\{1872A8D0-31BA-45B5-BD0D-7EED47567AD6}: "URL" = http://www.google.co...1I7ADFA_enUS471
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebs...r={searchTerms}
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://inboxtoolbar....id=80105&lng=en
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "YAHOO.COM"
FF - prefs.js..extensions.enabledItems: {b01bf10c-302a-11da-b67b-000d60ca027b}:2.6.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Components: C:\Program Files\Flock\components [2011/06/03 16:09:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Plugins: C:\Program Files\Flock\plugins [2011/06/03 16:08:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/19 22:42:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions
[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions\{a463f10c-3994-11da-9945-000d60ca027b}
[2012/04/18 12:07:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions
[2012/04/18 12:07:19 | 000,000,000 | ---D | M] (ALOT Appbar) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions\[email protected]
[2012/03/19 22:42:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/12 23:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/12 23:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/12 23:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2008/04/14 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O3 - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKU\S-1-5-21-2000478354-790525478-1177238915-1003..\Run: [Facebook Update] C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\rogerrabbit\Start Menu\Programs\Startup\PowerReg Scheduler.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - http://tbedits.telev...9E&n=2012021421 File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 97.64.168.12 97.64.183.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B1DE63E-E21B-45EF-AC37-46F86E198E30}: DhcpNameServer = 97.64.168.12 97.64.183.165
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/11 12:48:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/10/17 20:52:16 | 000,064,000 | R--- | M] (Watchtower Bible and Tract Society of New York, Inc.) - D:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2011/11/09 10:35:54 | 000,000,068 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{012b2ea7-82e5-11e0-a565-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{012b2ea7-82e5-11e0-a565-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{012b2ea7-82e5-11e0-a565-806d6172696f}\Shell\AutoRun\command - "" = D:\start.exe -- [2011/11/09 10:48:08 | 000,104,222 | R--- | M] (Watch Tower Bible and Tract Society of Pennsylvania.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1056

========== Files/Folders - Created Within 30 Days ==========

[2012/04/26 22:25:44 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 20:03:41 | 000,246,784 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\rogerrabbit\Application Data\926492609.exe
[2012/04/26 16:47:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Desktop\RK_Quarantine
[2012/04/26 16:45:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\rogerrabbit\Recent
[2012/04/26 14:25:55 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/26 12:48:42 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/25 20:33:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Watchtower Library 2011
[2012/04/25 12:29:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity
[2012/04/21 18:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\eFile Express 2011
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 22:20:20 | 000,001,022 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job
[2012/04/26 22:02:06 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/26 21:53:05 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/26 19:20:13 | 000,001,000 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/26 17:02:05 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/26 16:47:19 | 001,280,512 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/26 16:34:53 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/26 16:34:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/26 14:25:54 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/26 14:09:15 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/04/26 12:58:37 | 000,222,208 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\0FsMgSukmjW5QU.exe
[2012/04/26 12:48:42 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/26 12:09:04 | 000,301,056 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\FEpvdGsYapE.exe
[2012/04/25 20:33:48 | 000,000,967 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/19 13:29:14 | 000,130,684 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:23:35 | 000,012,663 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/17 13:31:43 | 000,083,464 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011_Federal_1040[1].pdf
[2012/04/17 11:26:46 | 000,149,977 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/16 14:06:40 | 031,879,867 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/11 03:22:16 | 000,505,056 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/11 03:22:16 | 000,088,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/04/11 03:01:34 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:11 | 000,027,844 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 13:40:14 | 000,023,272 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/26 18:35:36 | 000,000,901 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2012/04/26 18:35:36 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/26 18:35:36 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/04/26 18:35:36 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2012/04/26 18:35:36 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/26 18:35:36 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2012/04/26 18:35:36 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/26 18:35:35 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/04/26 18:35:35 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/04/26 18:35:30 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2012/04/26 16:15:19 | 001,280,512 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/26 12:58:36 | 000,222,208 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\0FsMgSukmjW5QU.exe
[2012/04/26 12:12:16 | 000,301,056 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\FEpvdGsYapE.exe
[2012/04/25 20:33:48 | 000,000,967 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/25 12:47:20 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/19 14:52:55 | 000,130,684 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:25:30 | 000,012,663 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/16 14:06:24 | 031,879,867 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/16 12:19:25 | 000,149,977 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/11 03:01:31 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:32 | 000,027,844 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 16:26:15 | 000,023,272 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[2012/03/21 16:22:04 | 000,045,568 | ---- | C] () -- C:\WINDOWS\UniFish3.exe
[2012/03/05 19:56:33 | 000,000,738 | -H-- | C] () -- C:\WINDOWS\tsac.ini
[2012/03/05 19:43:40 | 000,095,232 | ---- | C] () -- C:\WINDOWS\UNTSAC.EXE
[2012/03/05 19:43:40 | 000,002,552 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2012/03/05 19:43:37 | 000,000,225 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2012/03/03 15:49:21 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2012/03/03 15:47:10 | 000,000,496 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2012/02/24 01:08:52 | 000,161,736 | ---- | C] () -- C:\Program Files\64res.dll
[2012/02/15 18:38:45 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/08/13 18:54:57 | 000,000,026 | -H-- | C] () -- C:\WINDOWS\msbdemos.ini
[2011/08/08 10:31:39 | 000,000,041 | ---- | C] () -- C:\WINDOWS\MAGAUT.INI
[2011/08/06 22:48:32 | 000,000,227 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2011/08/06 22:47:51 | 000,000,298 | -H-- | C] () -- C:\WINDOWS\Chutes.ini
[2011/07/12 22:40:13 | 001,352,000 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/07/12 15:58:24 | 000,017,920 | -H-- | C] () -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/07 12:02:12 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe
[2011/06/03 16:07:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/09/11 13:28:58 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/11 12:51:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/09/11 12:44:54 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/09/11 07:31:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/09/11 07:29:50 | 000,267,008 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2011/06/03 15:38:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/07/12 15:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2012/03/06 01:04:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Amazon
[2011/06/03 16:09:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Flock
[2011/06/10 13:02:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Foxit Software
[2011/07/12 15:55:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Research In Motion
[2012/04/25 12:30:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Spotify
[2011/06/16 22:38:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Watchtower
[2012/04/26 19:20:13 | 000,001,000 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/26 22:20:20 | 000,001,022 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

< MD5 for: EXPLORER.EXE >
[2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/14 05:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/14 05:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2012/01/13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 05:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/14 05:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/01/13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 05:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 05:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\1\*.* >
[2010/09/11 12:48:39 | 000,000,294 | -HS- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\1\desktop.ini
[2010/09/11 12:48:39 | 000,001,607 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\1\Set Program Access and Defaults.lnk
[2010/09/11 12:48:39 | 000,000,398 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\1\Windows Catalog.lnk
[2010/09/13 06:54:32 | 000,001,507 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\1\Windows Update.lnk

< %Temp%\smtmp\2\*.* >
[2010/09/11 12:54:28 | 000,000,119 | -HS- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\2\desktop.ini
[2011/06/03 16:12:48 | 000,000,901 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\2\Foxit Reader.lnk
[2012/02/16 02:02:29 | 000,000,815 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\2\Launch Internet Explorer Browser.lnk
[2012/03/19 22:42:52 | 000,000,742 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\2\Mozilla Firefox.lnk
[2010/09/11 12:54:27 | 000,000,079 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\2\Show Desktop.scf
[2012/03/03 15:49:31 | 000,000,800 | ---- | M] () -- C:\DOCUME~1\ROGERR~1\LOCALS~1\Temp\smtmp\2\Windows Media Player.lnk

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< type c:\diskreport.txt /c >
Microsoft DiskPart version 5.1.3565
Copyright © 1999-2003 Microsoft Corporation.
On computer: D530AUCTION
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 D WTLIB11S CDFS CD-ROM 377 MB
Volume 1 C NTFS Partition 37 GB Healthy Boot

< >

< End of report >

Extras.txt

OTL Extras logfile created on: 4/26/2012 10:37:02 PM - Run 1
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Documents and Settings\rogerrabbit\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 146.09 Mb Available Physical Memory | 29.02% Memory free
980.24 Mb Paging File | 424.59 Mb Available in Paging File | 43.31% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.52 Gb Free Space | 49.69% Space Free | Partition Type: NTFS
Drive D: | 377.21 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: D530AUCTION | User Name: rogerrabbit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)
"1542:TCP" = 1542:TCP:*:Enabled:Realtek WPS TCP Prot
"1542:UDP" = 1542:UDP:*:Enabled:Realtek WPS UDP Prot
"53:UDP" = 53:UDP:*:Enabled:Realtek AP UDP Prot
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"4481:TCP" = 4481:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4481:UDP" = 4481:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
"4482:TCP" = 4482:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4482:UDP" = 4482:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe" = C:\Program Files\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe:*:Enabled:RtWlan
"C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe" = C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe:*:Enabled:BlackBerry Desktop Software -- (Research In Motion)
"C:\Documents and Settings\rogerrabbit\Application Data\Spotify\spotify.exe" = C:\Documents and Settings\rogerrabbit\Application Data\Spotify\spotify.exe:*:Enabled:Spotify -- (Spotify Ltd)
"C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin -- (Skype Limited)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0F956834-2785-4E63-A2AB-C1CB6359191B}" = MyLearnExpress
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1A3DAE38-68E4-427B-ADEF-3FF146EE0DA5}" = Basic Webcam
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21
"{27D29B49-8F31-485B-83DC-7236BB70EBC3}" = MyLearnExpress
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4ABB4D92-0682-4887-A0BC-CE5F920DDD23}" = Watchtower Library 2009 - English
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{75157F34-02C6-4831-BD66-3BC49E7A8394}" = BlackBerry Desktop Software 6.1
"{7690D65E-EDAC-43FC-BF0A-6263BBB5016E}" = Watchtower Library 2011 - español
"{7BB045C3-D5E4-4620-B536-DC11AACD5942}" = Broadcom Management Programs
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8E57D2C6-C0A7-11D6-93E6-0050224003EF}" = Nickelodeon™ Party Blast
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" =
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{BC5F5E3F-6B24-4A9F-9052-0A3EDFC5FF67}" = Watchtower Library 2010 - español
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DF157E38-A290-4265-844B-687E5707899E}" = WebCam Suite 2.0
"{F870B987-18BC-45FC-9BE8-35C02DCDA10F}" = Broadcom NetXtreme Ethernet Controller
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3D Marble Flip" = 3D Marble Flip
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.15
"avast" = avast! Free Antivirus
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Flock (2.6.1)" = Flock (2.6.1)
"Foxit Reader" = Foxit Reader
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"IETChutesDKey" = Chutes and Ladders
"InstallShield_{1A3DAE38-68E4-427B-ADEF-3FF146EE0DA5}" = Basic Webcam
"LEGO Racers" = LEGO Racers
"Luxor Mahjong" = Luxor Mahjong (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Product_Name" = Millennium Gamepak Gold
"RollerCoaster Tycoon Setup" = Roll
"Scholastic's The Magic School Bus ® Explores Bugs" = Scholastic's The Magic School Bus ® Explores Bugs
"Speccy" = Speccy
"Tetris Worlds" = Tetris Worlds
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Wheel Of Fortune" = Wheel Of Fortune
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2000478354-790525478-1177238915-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Spotify" = Spotify
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/9/2012 1:25:06 PM | Computer Name = D530AUCTION | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/11/2012 4:49:46 AM | Computer Name = D530AUCTION | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown

Error - 4/12/2012 11:41:45 PM | Computer Name = D530AUCTION | Source = Application Hang | ID = 1002
Description = Hanging application taskmgr.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/12/2012 11:42:15 PM | Computer Name = D530AUCTION | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/16/2012 8:42:16 AM | Computer Name = D530AUCTION | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module mshtml.dll, version 8.0.6001.19222, fault address 0x003b956c.

Error - 4/16/2012 7:19:17 PM | Computer Name = D530AUCTION | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/17/2012 5:23:56 AM | Computer Name = D530AUCTION | Source = Google Update | ID = 20
Description =

Error - 4/19/2012 2:10:46 PM | Computer Name = D530AUCTION | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/24/2012 5:57:42 PM | Computer Name = D530AUCTION | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/26/2012 4:56:31 PM | Computer Name = D530AUCTION | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 4/16/2012 1:24:03 PM | Computer Name = D530AUCTION | Source = Print | ID = 6161
Description = The document C:\Documents and Settings\rogerrabbit\Local Settings\Temporary
Internet Files\Content.IE5\XM8WJJU9\wp_E_20120401[1].pdf owned by rogerrabbit failed
to print on printer HP OfficeJet G55. Data type: NT EMF 1.008. Size of the spool
file in bytes: 166871028. Number of bytes printed: 4592260. Total number of pages
in the document: 32. Number of pages printed: 1. Client machine: \\D530AUCTION.
Win32 error code returned by the print processor: 0 (0x0).

Error - 4/16/2012 1:25:23 PM | Computer Name = D530AUCTION | Source = Print | ID = 6161
Description = The document C:\Documents and Settings\rogerrabbit\Local Settings\Temporary
Internet Files\Content.IE5\XM8WJJU9\wp_E_20120401[1].pdf owned by rogerrabbit failed
to print on printer HP OfficeJet G55. Data type: NT EMF 1.008. Size of the spool
file in bytes: 166871028. Number of bytes printed: 0. Total number of pages in
the document: 32. Number of pages printed: 0. Client machine: \\D530AUCTION. Win32
error code returned by the print processor: 259 (0x103).

Error - 4/16/2012 1:34:49 PM | Computer Name = D530AUCTION | Source = Print | ID = 6161
Description = The document C:\Documents and Settings\rogerrabbit\My Documents\2011
ia.PDF owned by rogerrabbit failed to print on printer HP OfficeJet G55. Data type:
NT EMF 1.008. Size of the spool file in bytes: 7733248. Number of bytes printed:
0. Total number of pages in the document: 2. Number of pages printed: 0. Client
machine: \\D530AUCTION. Win32 error code returned by the print processor: 259 (0x103).

Error - 4/26/2012 1:45:55 PM | Computer Name = D530AUCTION | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2767'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 4/26/2012 1:45:55 PM | Computer Name = D530AUCTION | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2767'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 4/26/2012 1:57:33 PM | Computer Name = D530AUCTION | Source = Service Control Manager | ID = 7031
Description = The avast! Antivirus service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.

Error - 4/26/2012 1:59:59 PM | Computer Name = D530AUCTION | Source = Service Control Manager | ID = 7031
Description = The avast! Antivirus service terminated unexpectedly. It has done
this 2 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.

Error - 4/26/2012 5:34:21 PM | Computer Name = D530AUCTION | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2767'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 4/26/2012 5:34:22 PM | Computer Name = D530AUCTION | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2767'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 4/26/2012 5:43:56 PM | Computer Name = D530AUCTION | Source = Service Control Manager | ID = 7031
Description = The avast! Antivirus service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.

< End of report >

I still am not able to run aswMBR.exe I see it on my desktop , but I cannot open it at all, nor can I run it. I tried downloading again and same problem

Edited by dixaloo, 27 April 2012 - 12:18 PM.

#4
Essexboy

Posted 27 April 2012 - 11:55 AM

GeekU Moderator

Retired Staff
69,964 posts

On completion of these runs can you let me know what the problems are that are left

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL
Posted Image

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebs...r={searchTerms}
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsea...CFSaFQAodNjC41w
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebs...r={searchTerms}
IE - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
O3 - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-2000478354-790525478-1177238915-1003\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
[2012/04/26 20:03:41 | 000,246,784 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\rogerrabbit\Application Data\926492609.exe
[2012/04/26 12:58:37 | 000,222,208 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\0FsMgSukmjW5QU.exe
[2012/04/26 12:58:36 | 000,222,208 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\0FsMgSukmjW5QU.exe
[2012/04/26 12:12:16 | 000,301,056 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\FEpvdGsYapE.exe

:Files
ipconfig /flushdns /c
xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C

:Commands
[resethosts]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
Click the Start Scan button.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

#5
dixaloo

Posted 27 April 2012 - 11:55 PM

New Member

Topic Starter
Member
7 posts

All right, aswMBR still will not run and TDSSKiller won't either. I don't know if that is a problem.... Avast antivirus continues to tell me that its blocking a malicious site and that it has been sent to the sand box. Is that causing the problem with these fixes running? I also noticed that on my desktop is a folder named RK_Quarantine. What should I do with that?
My 2nd otl report:

OTL logfile created on: 4/27/2012 3:52:24 PM - Run 2
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Documents and Settings\rogerrabbit\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 81.10 Mb Available Physical Memory | 16.11% Memory free
846.24 Mb Paging File | 499.72 Mb Available in Paging File | 59.05% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.90 Gb Free Space | 50.72% Space Free | Partition Type: NTFS
Drive D: | 377.21 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: D530AUCTION | User Name: rogerrabbit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
PRC - [2012/03/06 18:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/11/03 12:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\WINDOWS\PixArt\Pac207\Monitor.exe

========== Modules (No Company Name) ==========

MOD - [2012/04/27 12:43:45 | 001,771,008 | ---- | M] () -- C:\Program Files\Alwil Software\Avast5\defs\12042701\algo.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/04/25 12:47:16 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\XPTWOPORT.SYS -- (XPTWOPORTMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RTL8192cu.sys -- (RTL8192cu)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012/03/06 18:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 18:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 18:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012/03/06 18:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 18:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/03/06 18:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/03/06 17:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/07/25 01:18:32 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2008/06/06 09:15:40 | 000,098,816 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp)
DRV - [2006/11/20 09:48:40 | 000,506,112 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PFC027.SYS -- (PAC207)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\..\SearchScopes,DefaultScope = {a5b9c0f5-5616-47cd-a95f-e43b488faccf}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://inboxtoolbar....tb_id&%language
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\SearchScopes,DefaultScope = {1872A8D0-31BA-45B5-BD0D-7EED47567AD6}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{1872A8D0-31BA-45B5-BD0D-7EED47567AD6}: "URL" = http://www.google.co...1I7ADFA_enUS471
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://inboxtoolbar....id=80105&lng=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "YAHOO.COM"
FF - prefs.js..extensions.enabledItems: {b01bf10c-302a-11da-b67b-000d60ca027b}:2.6.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Components: C:\Program Files\Flock\components [2011/06/03 16:09:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Plugins: C:\Program Files\Flock\plugins [2011/06/03 16:08:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/19 22:42:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions
[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions\{a463f10c-3994-11da-9945-000d60ca027b}
[2012/04/18 12:07:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions
[2012/04/18 12:07:19 | 000,000,000 | ---D | M] (ALOT Appbar) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions\[email protected]
[2012/03/19 22:42:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/12 23:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/12 23:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/12 23:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/04/27 15:41:28 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\rogerrabbit\Start Menu\Programs\Startup\PowerReg Scheduler.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - http://tbedits.telev...9E&n=2012021421 File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 97.64.168.12 97.64.183.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B1DE63E-E21B-45EF-AC37-46F86E198E30}: DhcpNameServer = 97.64.168.12 97.64.183.165
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/11 12:48:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/10/17 20:52:16 | 000,064,000 | R--- | M] (Watchtower Bible and Tract Society of New York, Inc.) - D:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2011/11/09 10:35:54 | 000,000,068 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/04/27 15:39:53 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/04/26 22:25:44 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 16:47:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Desktop\RK_Quarantine
[2012/04/26 16:45:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\rogerrabbit\Recent
[2012/04/26 14:25:55 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/25 20:33:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Watchtower Library 2011
[2012/04/25 12:29:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity
[2012/04/21 18:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\eFile Express 2011
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/27 16:02:06 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/27 15:53:17 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/27 15:44:09 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/27 15:44:05 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/27 15:43:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/27 15:41:28 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2012/04/27 13:20:31 | 000,001,022 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job
[2012/04/27 13:13:34 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/26 23:27:59 | 000,000,293 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\Shortcut to Display.lnk
[2012/04/26 23:20:59 | 000,000,920 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\LEGO Racers.lnk
[2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 19:20:13 | 000,001,000 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/26 16:47:19 | 001,280,512 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/26 14:09:15 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/04/25 20:33:48 | 000,000,967 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/19 13:29:14 | 000,130,684 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:23:35 | 000,012,663 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/17 13:31:43 | 000,083,464 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011_Federal_1040[1].pdf
[2012/04/17 11:26:46 | 000,149,977 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/16 14:06:40 | 031,879,867 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/11 03:22:16 | 000,505,056 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/11 03:22:16 | 000,088,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/04/11 03:01:34 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:11 | 000,027,844 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 13:40:14 | 000,023,272 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/26 23:27:59 | 000,000,293 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\Shortcut to Display.lnk
[2012/04/26 23:20:59 | 000,000,920 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\LEGO Racers.lnk
[2012/04/26 18:35:36 | 000,000,901 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2012/04/26 18:35:36 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/26 18:35:36 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/04/26 18:35:36 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2012/04/26 18:35:36 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/26 18:35:36 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2012/04/26 18:35:36 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/26 18:35:35 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/04/26 18:35:35 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/04/26 18:35:30 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2012/04/26 16:15:19 | 001,280,512 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/25 20:33:48 | 000,000,967 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/25 12:47:20 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/19 14:52:55 | 000,130,684 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:25:30 | 000,012,663 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/16 14:06:24 | 031,879,867 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/16 12:19:25 | 000,149,977 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/11 03:01:31 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:32 | 000,027,844 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 16:26:15 | 000,023,272 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[2012/03/21 16:22:04 | 000,045,568 | ---- | C] () -- C:\WINDOWS\UniFish3.exe
[2012/03/05 19:56:33 | 000,000,738 | -H-- | C] () -- C:\WINDOWS\tsac.ini
[2012/03/05 19:43:40 | 000,095,232 | ---- | C] () -- C:\WINDOWS\UNTSAC.EXE
[2012/03/05 19:43:40 | 000,002,552 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2012/03/05 19:43:37 | 000,000,225 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2012/03/03 15:49:21 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2012/03/03 15:47:10 | 000,000,496 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2012/02/24 01:08:52 | 000,161,736 | ---- | C] () -- C:\Program Files\64res.dll
[2012/02/15 18:38:45 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/08/13 18:54:57 | 000,000,026 | -H-- | C] () -- C:\WINDOWS\msbdemos.ini
[2011/08/08 10:31:39 | 000,000,041 | ---- | C] () -- C:\WINDOWS\MAGAUT.INI
[2011/08/06 22:48:32 | 000,000,227 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2011/08/06 22:47:51 | 000,000,298 | -H-- | C] () -- C:\WINDOWS\Chutes.ini
[2011/07/12 22:40:13 | 001,352,000 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/07/12 15:58:24 | 000,017,920 | -H-- | C] () -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/07 12:02:12 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe
[2011/06/03 16:07:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/09/11 13:28:58 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/11 12:51:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/09/11 12:44:54 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/09/11 07:31:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/09/11 07:29:50 | 000,267,008 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2011/06/03 15:38:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/07/12 15:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2012/03/06 01:04:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Amazon
[2011/06/03 16:09:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Flock
[2011/06/10 13:02:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Foxit Software
[2011/07/12 15:55:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Research In Motion
[2012/04/25 12:30:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Spotify
[2011/06/16 22:38:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Watchtower
[2012/04/26 19:20:13 | 000,001,000 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/27 13:20:31 | 000,001,022 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job

========== Purity Check ==========

< End of report >

Edited by dixaloo, 28 April 2012 - 12:11 AM.

#6
Essexboy

Posted 28 April 2012 - 04:32 AM

GeekU Moderator

Retired Staff
69,964 posts

That has confirmed the malware type - next we will need to kill it. On completion of this could you do one further OTL quick scan

I need you to download:
gparted-live-0.10.0-3.iso (115.1 MB)

Create a bootable CD, for Gparted from the ISO image.

You can use ImgBurn do this.

Now boot off of the newly created Gparted CD.

Posted Image

You should be here... Press ENTER

Posted Image

By default, "do not touch keymap" is highlighted.
Leave this setting alone and just press ENTER.

Posted Image

Choose your language and press ENTER. English is default [33]

Posted Image

Once again, at this prompt, press ENTER
You will now be taken to the main GUI screen below

Posted Image

According to your logs, the partition that you want to delete is 4 MB

Click the trash can icon to delete and then click Apply.

You should now be here confirming your actions:

Posted Image

Now you should be here:

Posted Image

Is "boot" next to your OS drive?
If "boot" is not next to your OS drive under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:

Posted Image

Now double-click the Posted Image

button.

You should receive a small pop up like this:
Posted Image

Choose reboot and then press OK.

#7
dixaloo

Posted 28 April 2012 - 09:37 PM

New Member

Topic Starter
Member
7 posts

wow, thank you for your attention to my computer problems btw. Apparantly I do not have a writer on this pc, but I do have one on an old computer, providing it's compatible, will it affect anything in regards to killing this malware if I install it?

#8
Essexboy

Posted 29 April 2012 - 04:30 AM

GeekU Moderator

Retired Staff
69,964 posts

Nope you can burn the disc on any computer

#9
dixaloo

Posted 30 April 2012 - 10:50 PM

New Member

Topic Starter
Member
7 posts

I replaced my cdrom w/ the writer so I was finally able to write the cd and I did all that you instructed, well except the 2 programs that wouldnt run, but anyway here is my most recent otl scan:

OTL logfile created on: 4/30/2012 11:24:15 PM - Run 3
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Documents and Settings\rogerrabbit\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 236.29 Mb Available Physical Memory | 46.93% Memory free
846.24 Mb Paging File | 633.23 Mb Available in Paging File | 74.83% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.44 Gb Free Space | 49.48% Space Free | Partition Type: NTFS

Computer Name: D530AUCTION | User Name: rogerrabbit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
PRC - [2012/03/06 18:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/11/03 12:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\WINDOWS\PixArt\Pac207\Monitor.exe

========== Modules (No Company Name) ==========

MOD - [2012/04/30 13:00:32 | 001,771,520 | ---- | M] () -- C:\Program Files\Alwil Software\Avast5\defs\12043001\algo.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/04/25 12:47:16 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\XPTWOPORT.SYS -- (XPTWOPORTMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RTL8192cu.sys -- (RTL8192cu)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012/03/06 18:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 18:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 18:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012/03/06 18:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 18:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/03/06 18:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/03/06 17:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/07/25 01:18:32 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2008/06/06 09:15:40 | 000,098,816 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp)
DRV - [2006/11/20 09:48:40 | 000,506,112 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PFC027.SYS -- (PAC207)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\..\SearchScopes,DefaultScope = {a5b9c0f5-5616-47cd-a95f-e43b488faccf}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://inboxtoolbar....tb_id&%language
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 2F 57 14 03 25 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {1872A8D0-31BA-45B5-BD0D-7EED47567AD6}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{1872A8D0-31BA-45B5-BD0D-7EED47567AD6}: "URL" = http://www.google.co...1I7ADFA_enUS471
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://inboxtoolbar....id=80105&lng=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "YAHOO.COM"
FF - prefs.js..extensions.enabledItems: {b01bf10c-302a-11da-b67b-000d60ca027b}:2.6.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Components: C:\Program Files\Flock\components [2011/06/03 16:09:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Plugins: C:\Program Files\Flock\plugins [2011/06/03 16:08:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/19 22:42:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions
[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions\{a463f10c-3994-11da-9945-000d60ca027b}
[2012/04/30 01:22:56 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions
[2012/04/18 12:07:19 | 000,000,000 | ---D | M] (ALOT Appbar) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions\[email protected]
[2012/03/19 22:42:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/12 23:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/12 23:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/12 23:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/04/27 15:41:28 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKCU..\Run: [ApplicationHistory] C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Downloaded Installations\ApplicationHistory\weiplhyp.dll (Microsoft® Corporation)
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\rogerrabbit\Start Menu\Programs\Startup\PowerReg Scheduler.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - http://tbedits.telev...9E&n=2012021421 File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 97.64.168.12 97.64.183.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B1DE63E-E21B-45EF-AC37-46F86E198E30}: DhcpNameServer = 97.64.168.12 97.64.183.165
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/11 12:48:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/04/28 22:28:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Application Data\ImgBurn
[2012/04/28 21:55:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ImgBurn
[2012/04/28 21:55:51 | 000,000,000 | ---D | C] -- C:\Program Files\ImgBurn
[2012/04/28 00:57:59 | 002,074,160 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\rogerrabbit\Desktop\tdsskiller.exe
[2012/04/27 15:39:53 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/04/26 22:25:44 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 16:47:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Desktop\RK_Quarantine
[2012/04/26 16:45:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\rogerrabbit\Recent
[2012/04/26 14:25:55 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/25 20:33:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Watchtower Library 2011
[2012/04/25 12:29:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity
[2012/04/21 18:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\eFile Express 2011
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/30 23:19:57 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/30 23:19:44 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/30 23:19:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/30 23:02:02 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/30 22:53:04 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/30 22:20:27 | 000,001,022 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job
[2012/04/30 19:20:09 | 000,001,000 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/28 21:55:58 | 000,001,546 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2012/04/28 21:55:58 | 000,001,528 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
[2012/04/28 21:49:59 | 126,146,560 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\gparted-live-0.12.1-1.iso
[2012/04/28 00:57:52 | 002,074,160 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\rogerrabbit\Desktop\tdsskiller.exe
[2012/04/27 15:41:28 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2012/04/27 13:13:34 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/26 23:27:59 | 000,000,293 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\Shortcut to Display.lnk
[2012/04/26 23:20:59 | 000,000,920 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\LEGO Racers.lnk
[2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 16:47:19 | 001,280,512 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/26 14:09:15 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/04/25 20:33:48 | 000,000,967 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/19 13:29:14 | 000,130,684 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:23:35 | 000,012,663 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/17 13:31:43 | 000,083,464 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011_Federal_1040[1].pdf
[2012/04/17 11:26:46 | 000,149,977 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/16 14:06:40 | 031,879,867 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/11 03:22:16 | 000,505,056 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/11 03:22:16 | 000,088,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/04/11 03:01:34 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:11 | 000,027,844 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 13:40:14 | 000,023,272 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/28 21:55:58 | 000,001,546 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2012/04/28 21:55:58 | 000,001,528 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
[2012/04/28 21:50:00 | 126,146,560 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\gparted-live-0.12.1-1.iso
[2012/04/26 23:27:59 | 000,000,293 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\Shortcut to Display.lnk
[2012/04/26 23:20:59 | 000,000,920 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\LEGO Racers.lnk
[2012/04/26 18:35:36 | 000,000,901 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2012/04/26 18:35:36 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/26 18:35:36 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/04/26 18:35:36 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2012/04/26 18:35:36 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/26 18:35:36 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2012/04/26 18:35:36 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/26 18:35:35 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/04/26 18:35:35 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/04/26 18:35:30 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2012/04/26 16:15:19 | 001,280,512 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/25 20:33:48 | 000,000,967 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/25 12:47:20 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/19 14:52:55 | 000,130,684 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:25:30 | 000,012,663 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/16 14:06:24 | 031,879,867 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/16 12:19:25 | 000,149,977 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/11 03:01:31 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:32 | 000,027,844 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 16:26:15 | 000,023,272 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[2012/03/21 16:22:04 | 000,045,568 | ---- | C] () -- C:\WINDOWS\UniFish3.exe
[2012/03/05 19:56:33 | 000,000,738 | -H-- | C] () -- C:\WINDOWS\tsac.ini
[2012/03/05 19:43:40 | 000,095,232 | ---- | C] () -- C:\WINDOWS\UNTSAC.EXE
[2012/03/05 19:43:40 | 000,002,552 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2012/03/05 19:43:37 | 000,000,225 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2012/03/03 15:49:21 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2012/03/03 15:47:10 | 000,000,496 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2012/02/24 01:08:52 | 000,161,736 | ---- | C] () -- C:\Program Files\64res.dll
[2012/02/15 18:38:45 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/08/13 18:54:57 | 000,000,026 | -H-- | C] () -- C:\WINDOWS\msbdemos.ini
[2011/08/08 10:31:39 | 000,000,041 | ---- | C] () -- C:\WINDOWS\MAGAUT.INI
[2011/08/06 22:48:32 | 000,000,227 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2011/08/06 22:47:51 | 000,000,298 | -H-- | C] () -- C:\WINDOWS\Chutes.ini
[2011/07/12 22:40:13 | 001,352,000 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/07/12 15:58:24 | 000,017,920 | -H-- | C] () -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/07 12:02:12 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe
[2011/06/03 16:07:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/09/11 13:28:58 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/11 12:51:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/09/11 12:44:54 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/09/11 07:31:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/09/11 07:29:50 | 000,267,008 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2011/06/03 15:38:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/07/12 15:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2012/03/06 01:04:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Amazon
[2011/06/03 16:09:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Flock
[2011/06/10 13:02:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Foxit Software
[2012/04/30 16:32:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\ImgBurn
[2011/07/12 15:55:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Research In Motion
[2012/04/25 12:30:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Spotify
[2011/06/16 22:38:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Watchtower
[2012/04/30 19:20:09 | 000,001,000 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/30 22:20:27 | 000,001,022 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job

========== Purity Check ==========

< End of report

This was a second report I ran after I noticed avast detected 3 other threats (not alureon though) and my searches are still being redirected.I noticed some changes....

OTL logfile created on: 5/1/2012 12:59:18 AM - Run 4
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Documents and Settings\rogerrabbit\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.48 Mb Total Physical Memory | 215.56 Mb Available Physical Memory | 42.81% Memory free
846.24 Mb Paging File | 607.45 Mb Available in Paging File | 71.78% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.43 Gb Free Space | 49.46% Space Free | Partition Type: NTFS

Computer Name: D530AUCTION | User Name: rogerrabbit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
PRC - [2012/03/06 18:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011/02/18 11:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/04/14 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/11/03 12:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\WINDOWS\PixArt\Pac207\Monitor.exe

========== Modules (No Company Name) ==========

MOD - [2012/04/30 13:00:32 | 001,771,520 | ---- | M] () -- C:\Program Files\Alwil Software\Avast5\defs\12043001\algo.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/04/25 12:47:16 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/03/06 18:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\XPTWOPORT.SYS -- (XPTWOPORTMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RTL8192cu.sys -- (RTL8192cu)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012/03/06 18:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 18:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 18:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012/03/06 18:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 18:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/03/06 18:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/03/06 17:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/07/25 01:18:32 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2008/06/06 09:15:40 | 000,098,816 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp)
DRV - [2006/11/20 09:48:40 | 000,506,112 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PFC027.SYS -- (PAC207)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar....aspx?tbid=80105
IE - HKLM\..\SearchScopes,DefaultScope = {a5b9c0f5-5616-47cd-a95f-e43b488faccf}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://inboxtoolbar....tb_id&%language
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 2F 57 14 03 25 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {1872A8D0-31BA-45B5-BD0D-7EED47567AD6}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{1872A8D0-31BA-45B5-BD0D-7EED47567AD6}: "URL" = http://www.google.co...1I7ADFA_enUS471
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://inboxtoolbar....id=80105&lng=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "YAHOO.COM"
FF - prefs.js..extensions.enabledItems: {b01bf10c-302a-11da-b67b-000d60ca027b}:2.6.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Components: C:\Program Files\Flock\components [2011/06/03 16:09:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Flock 2.6.1\extensions\\Plugins: C:\Program Files\Flock\plugins [2011/06/03 16:08:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/19 22:42:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions
[2011/06/03 16:09:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Extensions\{a463f10c-3994-11da-9945-000d60ca027b}
[2012/04/30 01:22:56 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions
[2012/04/18 12:07:19 | 000,000,000 | ---D | M] (ALOT Appbar) -- C:\Documents and Settings\rogerrabbit\Application Data\Mozilla\Firefox\Profiles\qyrd564c.default\extensions\[email protected]
[2012/03/19 22:42:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/12 23:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/12 23:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/12 23:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/04/27 15:41:28 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O4 - HKLM..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe" File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKCU..\Run: [ApplicationHistory] C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Downloaded Installations\ApplicationHistory\weiplhyp.dll (Microsoft® Corporation)
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\rogerrabbit\Start Menu\Programs\Startup\PowerReg Scheduler.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Search - http://tbedits.telev...9E&n=2012021421 File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 97.64.168.12 97.64.183.165
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B1DE63E-E21B-45EF-AC37-46F86E198E30}: DhcpNameServer = 97.64.168.12 97.64.183.165
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/11 12:48:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/04/28 22:28:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Application Data\ImgBurn
[2012/04/28 21:55:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ImgBurn
[2012/04/28 21:55:51 | 000,000,000 | ---D | C] -- C:\Program Files\ImgBurn
[2012/04/28 00:57:59 | 002,074,160 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\rogerrabbit\Desktop\tdsskiller.exe
[2012/04/27 15:39:53 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/04/26 22:25:44 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 16:47:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Desktop\RK_Quarantine
[2012/04/26 16:45:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\rogerrabbit\Recent
[2012/04/26 14:25:55 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/25 20:33:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Watchtower Library 2011
[2012/04/25 12:29:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\Unity
[2012/04/21 18:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\eFile Express 2011
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/01 01:02:00 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/01 00:56:45 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/01 00:56:29 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/01 00:56:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/01 00:34:59 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2012/04/30 23:53:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/30 22:20:27 | 000,001,022 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job
[2012/04/30 19:20:09 | 000,001,000 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/28 21:55:58 | 000,001,546 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2012/04/28 21:55:58 | 000,001,528 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
[2012/04/28 21:49:59 | 126,146,560 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\gparted-live-0.12.1-1.iso
[2012/04/28 00:57:52 | 002,074,160 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\rogerrabbit\Desktop\tdsskiller.exe
[2012/04/27 15:41:28 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2012/04/27 13:13:34 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\rogerrabbit\Desktop\aswMBR.exe
[2012/04/26 23:27:59 | 000,000,293 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\Shortcut to Display.lnk
[2012/04/26 23:20:59 | 000,000,920 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\LEGO Racers.lnk
[2012/04/26 22:25:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\rogerrabbit\Desktop\OTL.exe
[2012/04/26 16:47:19 | 001,280,512 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/26 14:09:15 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/04/25 20:33:48 | 000,000,967 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/19 13:29:14 | 000,130,684 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:23:35 | 000,012,663 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/17 13:31:43 | 000,083,464 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011_Federal_1040[1].pdf
[2012/04/17 11:26:46 | 000,149,977 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/16 14:06:40 | 031,879,867 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/11 03:22:16 | 000,505,056 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/11 03:22:16 | 000,088,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/04/11 03:01:34 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:11 | 000,027,844 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 13:40:14 | 000,023,272 | ---- | M] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/01 00:34:56 | 000,000,947 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2012/05/01 00:34:56 | 000,000,785 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
[2012/04/28 21:55:58 | 000,001,546 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2012/04/28 21:55:58 | 000,001,528 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ImgBurn.lnk
[2012/04/28 21:50:00 | 126,146,560 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\gparted-live-0.12.1-1.iso
[2012/04/26 23:27:59 | 000,000,293 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\Shortcut to Display.lnk
[2012/04/26 23:20:59 | 000,000,920 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\LEGO Racers.lnk
[2012/04/26 18:35:36 | 000,000,901 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2012/04/26 18:35:36 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/26 18:35:36 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/04/26 18:35:36 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2012/04/26 18:35:36 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/26 18:35:36 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2012/04/26 18:35:36 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/04/26 18:35:35 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/04/26 18:35:35 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/04/26 18:35:30 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2012/04/26 16:15:19 | 001,280,512 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\RogueKiller.exe
[2012/04/25 20:33:48 | 000,000,967 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\Desktop\Watchtower Library 2011 - español.lnk
[2012/04/25 12:47:20 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/19 14:52:55 | 000,130,684 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\km 04-12.PDF
[2012/04/17 14:25:30 | 000,012,663 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 sched c.PDF
[2012/04/16 14:06:24 | 031,879,867 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\watch.zip
[2012/04/16 12:19:25 | 000,149,977 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\W7.PDF
[2012/04/11 03:01:31 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/04/03 17:14:32 | 000,027,844 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\2011 ia.PDF
[2012/04/03 16:26:15 | 000,023,272 | ---- | C] () -- C:\Documents and Settings\rogerrabbit\My Documents\ta.pdf
[2012/03/21 16:22:04 | 000,045,568 | ---- | C] () -- C:\WINDOWS\UniFish3.exe
[2012/03/05 19:56:33 | 000,000,738 | -H-- | C] () -- C:\WINDOWS\tsac.ini
[2012/03/05 19:43:40 | 000,095,232 | ---- | C] () -- C:\WINDOWS\UNTSAC.EXE
[2012/03/05 19:43:40 | 000,002,552 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2012/03/05 19:43:37 | 000,000,225 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2012/03/03 15:49:21 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2012/03/03 15:47:10 | 000,000,496 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2012/02/24 01:08:52 | 000,161,736 | ---- | C] () -- C:\Program Files\64res.dll
[2012/02/15 18:38:45 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/08/13 18:54:57 | 000,000,026 | -H-- | C] () -- C:\WINDOWS\msbdemos.ini
[2011/08/08 10:31:39 | 000,000,041 | ---- | C] () -- C:\WINDOWS\MAGAUT.INI
[2011/08/06 22:48:32 | 000,000,227 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2011/08/06 22:47:51 | 000,000,298 | -H-- | C] () -- C:\WINDOWS\Chutes.ini
[2011/07/12 22:40:13 | 001,352,000 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/07/12 15:58:24 | 000,017,920 | -H-- | C] () -- C:\Documents and Settings\rogerrabbit\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/07 12:02:12 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe
[2011/06/03 16:07:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/09/11 13:28:58 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/11 12:51:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/09/11 12:44:54 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/09/11 07:31:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/09/11 07:29:50 | 000,267,008 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2011/06/03 15:38:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/07/12 15:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2012/03/06 01:04:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Amazon
[2011/06/03 16:09:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Flock
[2011/06/10 13:02:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Foxit Software
[2012/04/30 16:32:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\ImgBurn
[2011/07/12 15:55:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Research In Motion
[2012/04/25 12:30:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Spotify
[2011/06/16 22:38:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\rogerrabbit\Application Data\Watchtower
[2012/04/30 19:20:09 | 000,001,000 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003Core.job
[2012/04/30 22:20:27 | 000,001,022 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2000478354-790525478-1177238915-1003UA.job

========== Purity Check ==========

< End of report >

Edited by dixaloo, 01 May 2012 - 12:32 AM.

#10
Essexboy

Posted 01 May 2012 - 11:46 AM

GeekU Moderator

Retired Staff
69,964 posts

Were you able to delete the bad partition ?

Lets now retry aswMBR

Download aswMBR.exe ( 4.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan

Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply

Posted Image

#11
dixaloo

Posted 01 May 2012 - 12:29 PM

New Member

Topic Starter
Member
7 posts

Woohoo! aswMBR ran finally, so I scanned it, attached are the results. Btw, I did delete the bad file that gparted had listed it was around 4MB. Do you want me to try Tdskiller again and see if it will run? My pc is running faster now

Attached Files

aswMBR.txt 2.04KB 71 downloads

#12
Essexboy

Posted 01 May 2012 - 12:44 PM

GeekU Moderator

Retired Staff
69,964 posts

Aye run TDSSKiller if you like - it will find nothing mind, but you will get to see it run.

OK lets now look for orphans before I send you on your after being tidied up

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

#13
dixaloo

Posted 01 May 2012 - 03:06 PM

New Member

Topic Starter
Member
7 posts

I think we are good, I'm not being redirected anymore and everything seems to be back to normal. Thank you thank you! I was able to run TDSSKiller, it did find a medium level threat but I skipped and continued, no malicious objects as you foretold. What should I do with the RK_quarantine file that is on my desktop? It was there when my desktop icons reappeared. Delete it or leave it alone?

Here is the log from MalwarebytesMalwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.05.01.11

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
rogerrabbit :: D530AUCTION [administrator]

5/1/2012 2:35:09 PM
mbam-log-2012-05-01 (14-35-09).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 194432
Time elapsed: 40 minute(s), 36 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Documents and Settings\rogerrabbit\Local Settings\Temp\0.25776472601532785 (Exploit.Drop.9) -> Quarantined and deleted successfully.

(end)

#14
Essexboy

Posted 01 May 2012 - 03:25 PM

GeekU Moderator

Retired Staff
69,964 posts

OTL should remove the quarantine folder, if it does not then just delete it

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands
[resethosts]
[emptytemp]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

Go to this site and click Do I have Java
It will check your current version and then offer to update to the latest version

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe :wave:

#15
Essexboy

Posted 03 May 2012 - 11:49 AM

GeekU Moderator

Retired Staff
69,964 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.