Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Olmarik Removal [Solved]


  • This topic is locked This topic is locked

#1
cartuner

cartuner

    New Member

  • Member
  • Pip
  • 7 posts
Hi everyone :)

My PC got infected last night by the Win32 Trojan Olmarik. I'm running ESET NOD32 and it told me that it can't be removed. I researched about it a little bit and it isn't showing me the usual signs like the pop-up ads. The problems I'm facing are that my desktop has been wiped clean, the programs in the start menu are no longer accessible and neither are any of my files through My Computer. Here is the OTL log:

OTL logfile created on: 7/14/2012 5:05:18 PM - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\HPC2D\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 2.01 Gb Available Physical Memory | 67.46% Memory free
5.96 Gb Paging File | 4.90 Gb Available in Paging File | 82.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.42 Gb Total Space | 16.76 Gb Free Space | 22.52% Space Free | Partition Type: NTFS
Drive E: | 100.00 Mb Total Space | 71.66 Mb Free Space | 71.67% Space Free | Partition Type: NTFS

Computer Name: HPC2D-PC | User Name: HPC2D | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/14 17:03:29 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\HPC2D\Desktop\OTL.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/04/02 22:46:58 | 000,329,544 | -H-- | M] () -- C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2011/11/15 22:26:48 | 000,363,336 | -H-- | M] (AnchorFree Inc.) -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011/11/10 07:11:50 | 000,417,792 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011/11/10 07:11:20 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011/06/08 18:15:06 | 001,804,648 | -H-- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
PRC - [2011/04/11 14:44:44 | 000,112,800 | ---- | M] (Intel Corporation) -- C:\Windows\System32\IPROSetMonitor.exe
PRC - [2011/02/25 09:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/18 11:47:12 | 000,079,192 | -H-- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2010/11/20 16:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/01/08 14:15:24 | 001,118,208 | -H-- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
PRC - [2009/12/07 13:49:24 | 000,040,960 | -H-- | M] (Realtek) -- C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtlService.exe
PRC - [2009/11/16 09:04:30 | 000,735,960 | -H-- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009/11/16 09:03:32 | 002,054,360 | -H-- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2008/07/15 13:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/06/25 01:13:18 | 000,113,120 | -H-- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/11 04:06:10 | 000,077,520 | -H-- | M] () [On_Demand | Stopped] -- C:\Program Files\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2012/04/11 03:59:14 | 000,542,552 | -H-- | M] () [Auto | Stopped] -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2012/04/02 22:46:58 | 000,329,544 | -H-- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2011/11/15 22:26:48 | 000,363,336 | -H-- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2011/11/10 07:11:20 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011/10/27 10:34:30 | 000,718,384 | -H-- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011/09/21 17:17:19 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/04/11 14:44:44 | 000,112,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\System32\IPROSetMonitor.exe -- (Intel® PROSet Monitoring Service) Intel®
SRV - [2009/12/07 13:49:24 | 000,040,960 | -H-- | M] (Realtek) [Auto | Running] -- C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtlService.exe -- (Realtek87B)
SRV - [2009/11/16 09:12:54 | 000,020,680 | -H-- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009/11/16 09:04:30 | 000,735,960 | -H-- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2009/07/14 05:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 05:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 05:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 05:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/07/15 13:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)


========== Driver Services (SafeList) ==========

DRV - File not found [File_System | On_Demand | Stopped] -- C:\Windows\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (am7wpy2d)
DRV - [2012/07/14 04:29:40 | 000,023,368 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OlmarikFixer.sys -- (OlmarikFixer)
DRV - [2011/11/10 07:44:12 | 008,913,920 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011/11/10 06:12:20 | 000,263,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011/10/17 21:40:44 | 000,085,520 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011/06/27 18:06:15 | 000,431,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2011/05/25 03:40:12 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)
DRV - [2011/05/25 03:40:10 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2010/12/01 14:34:46 | 000,009,856 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DABlack.sys -- (DABlackFltr)
DRV - [2010/11/20 16:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 16:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 16:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 14:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 13:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 13:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 13:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/10/01 00:16:40 | 000,010,240 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VKbms.sys -- (VKbms)
DRV - [2010/03/26 01:15:50 | 000,221,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6232.sys -- (e1express) Intel®
DRV - [2010/01/07 11:20:22 | 000,375,808 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187.sys -- (RTL8187)
DRV - [2009/12/18 11:58:52 | 000,011,336 | -H-- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
DRV - [2009/11/16 09:06:52 | 000,095,896 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2009/11/16 09:03:36 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009/11/16 08:56:12 | 000,116,520 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\System32\drivers\eamon.sys -- (eamon)
DRV - [2009/11/10 15:50:08 | 000,012,416 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\copperhd.sys -- (UsbFltr)
DRV - [2009/09/18 14:32:06 | 000,045,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel®
DRV - [2009/08/10 15:25:36 | 000,039,936 | ---- | M] (Cypress Semiconductor) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CYUSB.sys -- (CYUSB)
DRV - [2009/07/14 03:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2008/08/26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2005/12/21 11:23:26 | 000,014,592 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBICP.sys -- (uisp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 195.229.241.173:8080

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..network.proxy.backup.ftp: "195.229.241.173"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.socks: "195.229.241.173"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "195.229.241.173"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "195.229.241.173"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.http: "195.229.241.173"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "195.229.241.173"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "195.229.241.173"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\HPC2D\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/25 01:13:18 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011/10/24 23:06:00 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011/11/26 20:16:13 | 000,000,000 | -H-D | M]

[2011/06/15 20:04:14 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\HPC2D\AppData\Roaming\Mozilla\Extensions
[2011/09/18 20:34:48 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\HPC2D\AppData\Roaming\Mozilla\Firefox\Profiles\z6w5fgep.default\extensions
[2011/07/08 15:26:38 | 000,002,057 | -H-- | M] () -- C:\Users\HPC2D\AppData\Roaming\Mozilla\Firefox\Profiles\z6w5fgep.default\searchplugins\youtube-video-search.xml
[2012/05/04 19:37:22 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/17 11:53:52 | 000,000,000 | -H-D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2012/06/25 01:13:18 | 000,085,472 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/25 01:13:16 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/25 01:13:16 | 000,002,040 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/11 01:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No CLSID value found.
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [HP Deskjet 3050A J611 series (NET)] C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_32)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.42.20.20 195.229.241.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5ED187B8-C31F-4614-8C3C-66E6E3FEECBA}: NameServer = 10.95.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6D749B7D-4AB0-4C6A-BF75-27F1E3ACB464}: DhcpNameServer = 213.42.20.20 195.229.241.222
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (C:\Windows\SYSTEM32\RtlGina\RtlGina.DLL) - C:\Windows\System32\RtlGina\RtlGina.dll (Realtek)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 01:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/14 17:03:37 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\HPC2D\Desktop\OTL.exe
[2012/07/14 16:51:37 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012/07/14 04:46:05 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/14 04:46:05 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/14 04:46:05 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/14 04:44:46 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012/07/14 04:42:58 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\Malwarebytes
[2012/07/14 04:42:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/14 04:42:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/14 04:42:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/14 04:42:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/14 04:41:46 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/14 04:41:44 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012/07/14 04:41:27 | 010,652,120 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\HPC2D\Desktop\mbam-setup-1.62.0.1300.exe
[2012/07/14 04:41:14 | 004,577,833 | R--- | C] (Swearware) -- C:\Users\HPC2D\Desktop\ComboFix.exe
[2012/07/14 04:35:56 | 002,135,640 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\HPC2D\Desktop\tdsskiller.exe
[2012/07/14 04:29:40 | 000,023,368 | ---- | C] (ESET) -- C:\Windows\System32\drivers\OlmarikFixer.sys
[2012/07/14 04:29:29 | 000,140,768 | ---- | C] (ESET spol. s r.o.) -- C:\Users\HPC2D\Desktop\EOlmarikTdl4Cleaner.exe
[2012/07/14 04:09:46 | 000,348,704 | ---- | C] (ESET spol. s r.o.) -- C:\Users\HPC2D\Desktop\EOlmarikRemover.exe
[2012/07/13 13:50:30 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Roaming\Need for Speed World
[2012/07/13 13:26:06 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\Electronic_Arts_Inc
[2012/07/13 13:25:54 | 000,000,000 | -H-D | C] -- C:\ProgramData\Electronic Arts
[2012/07/13 13:25:54 | 000,000,000 | -H-D | C] -- C:\Program Files\Electronic Arts
[2012/07/12 16:31:04 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{4D38FED7-D1E1-4255-BC30-8E2C01039602}
[2012/07/12 16:30:51 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{594601B8-B19C-4D5E-A837-A77EA7571D5F}
[2012/07/10 18:36:54 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{01CEE81B-C191-4BAC-87CA-ADCF2297A158}
[2012/07/10 18:36:41 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{4320C7A0-1FC6-4962-A225-89A81F0F8C6F}
[2012/07/10 03:13:54 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{F57C333B-8155-4A59-ADFD-6E194BC42C57}
[2012/07/10 03:13:42 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{26A17067-FCD3-4AAA-B12E-4F192093D88E}
[2012/07/08 15:40:53 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{DDBBFDAA-68EC-477C-97B5-122A3EDA93D4}
[2012/07/08 15:40:33 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{012608F9-C11B-4FF4-8544-E6D3A8AF2636}
[2012/07/07 14:31:23 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Roaming\TempMods
[2012/07/07 14:24:22 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{61D25424-22B2-4BFC-A53E-15C2971C1E82}
[2012/07/07 14:24:08 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{16DCABEA-0C80-4A27-9FC0-13E26D091541}
[2012/07/07 14:22:09 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Roaming\Simraceway
[2012/07/07 14:22:03 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\CrashRpt
[2012/07/07 14:20:10 | 000,000,000 | -H-D | C] -- C:\Program Files\SimracewayUpdater
[2012/07/07 14:20:10 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Simraceway
[2012/07/07 14:19:38 | 000,000,000 | -H-D | C] -- C:\Program Files\Simraceway
[2012/07/03 22:57:09 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{CF395E5F-7249-48F0-8811-532AFEE93AE1}
[2012/07/03 22:56:55 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{5BCE131F-A6D2-4AEA-A647-5B06FDFD3807}
[2012/07/02 15:37:08 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{DC6F45E2-D13F-45A1-8AC4-27723DDE00EC}
[2012/07/02 15:36:55 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{278FB69D-1249-456C-9325-EB84D99D8369}
[2012/06/30 18:32:43 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{10D7D83A-4D54-42E6-B847-D85C318204AA}
[2012/06/30 18:32:27 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{FEB15E7B-55CF-494D-BD8E-8CAE16A633CC}
[2012/06/27 15:57:09 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{10C2B255-B40C-4ADE-8823-269192921214}
[2012/06/27 15:56:56 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{A1EDAA3A-6962-4E1F-9B29-A0317A024B37}
[2012/06/27 03:04:36 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{B7627218-C0A7-4AC5-A404-BCB12573FF3B}
[2012/06/27 03:04:22 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{32F82DA0-0F57-4816-B6AC-EEAD50568239}
[2012/06/25 00:54:00 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Roaming\StreamTorrent
[2012/06/24 03:41:55 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{913A51F6-A301-48E6-9281-8A57EABCAAF4}
[2012/06/24 03:41:39 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{A328D702-4229-4DF3-8E2C-B40EBB6A4856}
[2012/06/23 16:38:41 | 000,000,000 | RH-D | C] -- C:\Users\HPC2D\Desktop\EXAM
[2012/06/20 15:09:38 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{573CB8CF-48D0-4963-95B4-EFBE34D29FAA}
[2012/06/20 15:09:24 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{F64AA690-215B-4462-AFBD-7E47C2606B40}
[2012/06/18 02:41:03 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{EF6F42E4-C32B-4C7C-A290-E77C8DCC7028}
[2012/06/15 23:00:50 | 000,000,000 | -H-D | C] -- C:\Users\HPC2D\AppData\Local\{0DBAB49A-8C41-4EDF-8972-7BA320D3F931}
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/14 17:03:29 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\HPC2D\Desktop\OTL.exe
[2012/07/14 16:58:40 | 000,020,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 16:58:40 | 000,020,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 16:54:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/14 16:51:33 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/14 16:51:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/14 16:51:04 | 2400,423,936 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/14 04:42:45 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/14 04:41:31 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\HPC2D\Desktop\mbam-setup-1.62.0.1300.exe
[2012/07/14 04:40:54 | 004,577,833 | R--- | M] (Swearware) -- C:\Users\HPC2D\Desktop\ComboFix.exe
[2012/07/14 04:35:58 | 002,135,640 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\HPC2D\Desktop\tdsskiller.exe
[2012/07/14 04:29:40 | 000,023,368 | ---- | M] (ESET) -- C:\Windows\System32\drivers\OlmarikFixer.sys
[2012/07/14 04:29:29 | 000,140,768 | ---- | M] (ESET spol. s r.o.) -- C:\Users\HPC2D\Desktop\EOlmarikTdl4Cleaner.exe
[2012/07/14 04:09:42 | 000,348,704 | ---- | M] (ESET spol. s r.o.) -- C:\Users\HPC2D\Desktop\EOlmarikRemover.exe
[2012/07/14 03:47:08 | 000,001,954 | -H-- | M] () -- C:\Users\HPC2D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3050A J611 series (Network).lnk
[2012/07/10 16:57:58 | 000,626,450 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/07/10 16:57:58 | 000,107,586 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/07/08 17:40:32 | 004,625,421 | -H-- | M] () -- C:\Users\HPC2D\Desktop\[Songs.PK] 04 - Jism 2 - Ye Jism.mp3
[2012/07/08 15:45:21 | 000,007,889 | -H-- | M] () -- C:\Users\HPC2D\Desktop\ticket.htm
[2012/06/24 14:49:49 | 000,409,072 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/06/23 17:09:16 | 000,000,057 | -H-- | M] () -- C:\ProgramData\Ament.ini
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/14 04:46:05 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/14 04:46:05 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/14 04:46:05 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/14 04:46:05 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/14 04:46:05 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/14 04:42:45 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/08 17:40:28 | 004,625,421 | -H-- | C] () -- C:\Users\HPC2D\Desktop\[Songs.PK] 04 - Jism 2 - Ye Jism.mp3
[2012/07/08 15:45:21 | 000,007,889 | -H-- | C] () -- C:\Users\HPC2D\Desktop\ticket.htm
[2012/06/24 14:41:42 | 000,001,954 | -H-- | C] () -- C:\Users\HPC2D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3050A J611 series (Network).lnk
[2012/06/23 17:09:16 | 000,000,057 | -H-- | C] () -- C:\ProgramData\Ament.ini
[2012/04/09 23:08:52 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat
[2012/01/06 19:55:33 | 000,000,000 | -H-- | C] () -- C:\Users\HPC2D\AppData\Local\{BC37EE0F-8684-4128-AE98-F0C268C9A406}
[2012/01/06 19:53:37 | 000,000,000 | -H-- | C] () -- C:\Users\HPC2D\AppData\Local\{0F3C25A6-7A53-46C0-8B90-A90AD964FE9D}
[2011/11/10 06:28:32 | 000,204,960 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2011/11/10 06:28:32 | 000,157,152 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2011/11/09 22:39:44 | 000,059,904 | ---- | C] () -- C:\Windows\System32\OpenVideo.dll
[2011/11/09 22:39:32 | 000,054,784 | ---- | C] () -- C:\Windows\System32\OVDecode.dll
[2011/10/21 23:30:14 | 000,243,168 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011/09/21 13:55:33 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011/09/13 03:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2011/06/24 02:29:32 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/06/15 20:04:08 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/06/13 21:26:56 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe
[2011/06/13 21:18:05 | 000,176,235 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
[2011/06/13 20:58:15 | 000,221,341 | ---- | C] () -- C:\Windows\hpoins19.dat
[2011/06/13 20:58:15 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2011/06/09 01:57:22 | 001,929,576 | ---- | C] () -- C:\Windows\System32\HPScanTRDrv_DJ3050A_J611.dll
[2011/04/09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

========== LOP Check ==========

[2012/06/26 20:32:18 | 000,032,540 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi as you have run Combofix I may not be able to retrieve some of the shortcuts

  • Download RogueKiller and save it on your desktop.
  • Quit all programs
  • Start RogueKiller.exe.
  • Wait until Prescan has finished ...
  • Click on Scan
Posted Image
  • Wait for the end of the scan.
  • The report has been created on the desktop.
  • Click on the Delete button.
Posted Image
  • The report has been created on the desktop.

  • Next click on the ShortcutsFix
    Posted Image
  • The report has been created on the desktop.

Please post: All RKreport.txt text files located on your desktop.

THEN

Download aswMBR.exe ( 4.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan

Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply

Posted Image
  • 0

#3
cartuner

cartuner

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Thank you Essexboy! My desktop has been restored :)
I ran RogueKiller as you asked me to, the logs have been attached to the post.
I downloaded aswMBR but the file is not working, what do I do now?

Attached Files


  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK found the problem

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo System drive
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 76202 Mo
2 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 156270592 | Size: 10 Mo Malware

The malware has taken over the hard drive boot.

This next programme may not work, just like aswMBR in that case jump down to the second step. If TDSSKiller does work then just run that segment

Download the latest version of TDSSKiller from here and save it to your Desktop.


  • Doubleclick on TDSSKiller.exe to run the application
    Posted Image
  • Then click on Change parameters.

    Posted Image
  • Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
  • Click the Start Scan button.

  • If a suspicious object is detected, the default action will be Skip, click on Continue.

    Posted Image
  • If malicious objects are found, they will show in the Scan results and offer three (3) options.
  • Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
  • Get the report by selecting Reports

    Posted Image
  • Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.


Second step if TDSSKiller fails

I need you to download:
gparted-live-0.10.0-3.iso (115.1 MB)

Create a bootable CD, for Gparted from the ISO image.

You can use ImgBurn do this.

Now boot off of the newly created Gparted CD.

Posted Image

You should be here... Press ENTER

Posted Image

By default, "do not touch keymap" is highlighted.
Leave this setting alone and just press ENTER.

Posted Image

Choose your language and press ENTER. English is default [33]

Posted Image

Once again, at this prompt, press ENTER
You will now be taken to the main GUI screen below

Posted Image

According to your logs, the partition that you want to delete is 10 MB

Click the trash can icon to delete and then click Apply.

You should now be here confirming your actions:

Posted Image

Now you should be here:

Posted Image

Posted Image

Is "boot" next to your 100MB System drive partition 0?
If "boot" is not next to your 100MB system drive under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:

Posted Image


Now double-click the Posted Image button.

You should receive a small pop up like this: Posted Image

Choose reboot and then press OK.
  • 0

#5
cartuner

cartuner

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Alright, I did all of that and it went pretty well.
What do I do next?
  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Which part worked.. Did TDSSKiller run or did you have to use Gparted ?

Could you now run a fresh OTL scan please selecting all users, and let me know what problems remain
  • 0

#7
cartuner

cartuner

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Oops, I forgot to mention that I used Gparted since TDSSKiller wasn't working either.
Here is the fresh OTL log:

OTL logfile created on: 7/14/2012 11:03:23 PM - Run 2
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\HPC2D\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 71.17% Memory free
5.96 Gb Paging File | 4.98 Gb Available in Paging File | 83.50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.42 Gb Total Space | 16.15 Gb Free Space | 21.71% Space Free | Partition Type: NTFS
Drive E: | 100.00 Mb Total Space | 71.66 Mb Free Space | 71.67% Space Free | Partition Type: NTFS

Computer Name: HPC2D-PC | User Name: HPC2D | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/14 17:03:29 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\HPC2D\Desktop\OTL.exe
PRC - [2012/04/11 03:59:14 | 000,542,552 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe
PRC - [2012/04/02 22:46:58 | 000,329,544 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2012/02/14 18:20:35 | 000,738,680 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2011/11/15 22:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011/11/10 07:11:50 | 000,417,792 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011/11/10 07:11:20 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011/06/08 18:15:06 | 001,804,648 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
PRC - [2011/06/08 18:01:52 | 000,643,944 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe
PRC - [2011/04/11 14:44:44 | 000,112,800 | ---- | M] (Intel Corporation) -- C:\Windows\System32\IPROSetMonitor.exe
PRC - [2011/02/25 09:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/18 11:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2010/11/20 16:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/01/08 14:15:24 | 001,118,208 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtWLan.exe
PRC - [2009/12/07 13:49:24 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtlService.exe
PRC - [2009/11/16 09:04:30 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009/11/16 09:03:32 | 002,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2008/07/15 13:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE


========== Modules (No Company Name) ==========

MOD - [2012/06/05 21:10:15 | 000,240,128 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\9bfbf0613d3780e34d98333c7b381218\WindowsFormsIntegration.ni.dll
MOD - [2012/06/05 21:08:51 | 002,297,856 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll
MOD - [2012/06/05 01:16:15 | 000,368,128 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012/06/05 01:16:06 | 011,833,344 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\1a690902e9a6293de228c16fab21e2f7\System.Web.ni.dll
MOD - [2012/06/05 01:16:00 | 000,771,584 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/06/05 01:15:47 | 014,340,608 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07f019692c382d588d3c6cb2da2a9ec5\PresentationFramework.ni.dll
MOD - [2012/06/05 01:15:28 | 012,433,408 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\90555968565afd59bce4b0974e9903bd\System.Windows.Forms.ni.dll
MOD - [2012/06/05 01:15:22 | 001,590,784 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\69f6e582cb79f107c61308b468c1a215\System.Drawing.ni.dll
MOD - [2012/06/05 01:15:19 | 000,060,928 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ca2eff60beb3ba00a529a2d42dceca22\UIAutomationProvider.ni.dll
MOD - [2012/06/05 01:15:18 | 012,237,824 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2d1fd350e9bc62ce659e5cbcfd555796\PresentationCore.ni.dll
MOD - [2012/06/05 01:15:09 | 003,347,968 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/06/05 01:15:01 | 005,452,800 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/06/05 01:14:54 | 000,971,264 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/06/05 01:14:52 | 007,967,232 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/06/05 01:14:38 | 011,492,864 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011/11/09 22:10:38 | 000,369,152 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/06/25 01:13:18 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/11 04:06:10 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2012/04/11 03:59:14 | 000,542,552 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2012/04/02 22:46:58 | 000,329,544 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2011/11/15 22:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2011/11/10 07:11:20 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011/10/27 10:34:30 | 000,718,384 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011/09/21 17:17:19 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/04/11 14:44:44 | 000,112,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\System32\IPROSetMonitor.exe -- (Intel® PROSet Monitoring Service) Intel®
SRV - [2009/12/07 13:49:24 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files\REALTEK\RTL8187 Wireless LAN Utility\RtlService.exe -- (Realtek87B)
SRV - [2009/11/16 09:12:54 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009/11/16 09:04:30 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2009/07/14 05:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 05:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 05:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 05:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/07/15 13:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (a5d8xdoo)
DRV - [2012/07/14 04:29:40 | 000,023,368 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OlmarikFixer.sys -- (OlmarikFixer)
DRV - [2011/11/10 07:44:12 | 008,913,920 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011/11/10 06:12:20 | 000,263,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011/10/17 21:40:44 | 000,085,520 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011/06/27 18:06:15 | 000,431,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2011/05/25 03:40:12 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)
DRV - [2011/05/25 03:40:10 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2010/12/01 14:34:46 | 000,009,856 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DABlack.sys -- (DABlackFltr)
DRV - [2010/11/20 16:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 16:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 16:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 14:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 13:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 13:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 13:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/10/01 00:16:40 | 000,010,240 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VKbms.sys -- (VKbms)
DRV - [2010/03/26 01:15:50 | 000,221,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6232.sys -- (e1express) Intel®
DRV - [2010/01/07 11:20:22 | 000,375,808 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187.sys -- (RTL8187)
DRV - [2009/12/18 11:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
DRV - [2009/11/16 09:06:52 | 000,095,896 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2009/11/16 09:03:36 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009/11/16 08:56:12 | 000,116,520 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\System32\drivers\eamon.sys -- (eamon)
DRV - [2009/11/10 15:50:08 | 000,012,416 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\copperhd.sys -- (UsbFltr)
DRV - [2009/09/18 14:32:06 | 000,045,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel®
DRV - [2009/08/10 15:25:36 | 000,039,936 | ---- | M] (Cypress Semiconductor) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CYUSB.sys -- (CYUSB)
DRV - [2009/07/14 03:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2008/08/26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2005/12/21 11:23:26 | 000,014,592 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBICP.sys -- (uisp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 195.229.241.173:8080

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..network.proxy.backup.ftp: "195.229.241.173"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.socks: "195.229.241.173"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "195.229.241.173"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "195.229.241.173"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.http: "195.229.241.173"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "195.229.241.173"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "195.229.241.173"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\HPC2D\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/25 01:13:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011/10/24 23:06:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011/11/26 20:16:13 | 000,000,000 | ---D | M]

[2011/06/15 20:04:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HPC2D\AppData\Roaming\Mozilla\Extensions
[2011/09/18 20:34:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HPC2D\AppData\Roaming\Mozilla\Firefox\Profiles\z6w5fgep.default\extensions
[2011/07/08 15:26:38 | 000,002,057 | ---- | M] () -- C:\Users\HPC2D\AppData\Roaming\Mozilla\Firefox\Profiles\z6w5fgep.default\searchplugins\youtube-video-search.xml
[2012/05/04 19:37:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/17 11:53:52 | 000,000,000 | ---D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2012/06/25 01:13:18 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/25 01:13:16 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/25 01:13:16 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/11 01:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\..\Toolbar\WebBrowser: (no name) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No CLSID value found.
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-2787673202-530888288-3304730987-1000..\Run: [] File not found
O4 - HKU\S-1-5-21-2787673202-530888288-3304730987-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-2787673202-530888288-3304730987-1000..\Run: [HP Deskjet 3050A J611 series (NET)] C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_32)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.42.20.20 195.229.241.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5ED187B8-C31F-4614-8C3C-66E6E3FEECBA}: NameServer = 10.95.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6D749B7D-4AB0-4C6A-BF75-27F1E3ACB464}: DhcpNameServer = 213.42.20.20 195.229.241.222
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (C:\Windows\SYSTEM32\RtlGina\RtlGina.DLL) - C:\Windows\System32\RtlGina\RtlGina.dll (Realtek)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 01:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/14 20:51:08 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{AA68E112-2148-4867-A4A6-7D659FC60872}
[2012/07/14 20:50:54 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{39B0A557-C551-4186-8EB5-A06EE6C37554}
[2012/07/14 20:40:29 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012/07/14 20:08:19 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\Canneverbe Limited
[2012/07/14 20:08:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2012/07/14 20:07:59 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP
[2012/07/14 20:06:58 | 005,340,256 | ---- | C] (Canneverbe Limited ) -- C:\Users\HPC2D\Desktop\cdbxp_setup_4.4.1.3243.exe
[2012/07/14 19:26:01 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\ImgBurn
[2012/07/14 19:25:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
[2012/07/14 19:25:38 | 000,000,000 | ---D | C] -- C:\Program Files\ImgBurn
[2012/07/14 19:24:22 | 006,055,875 | ---- | C] (LIGHTNING UK!) -- C:\Users\HPC2D\Desktop\SetupImgBurn_2.5.6.0.exe
[2012/07/14 19:10:30 | 002,135,640 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\HPC2D\Desktop\tdsskiller.exe
[2012/07/14 18:35:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\HPC2D\Desktop\aswMBR.exe
[2012/07/14 18:27:45 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\Desktop\RK_Quarantine
[2012/07/14 17:03:37 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\HPC2D\Desktop\OTL.exe
[2012/07/14 04:46:05 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/14 04:46:05 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/14 04:46:05 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/14 04:42:58 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\Malwarebytes
[2012/07/14 04:42:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/14 04:42:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/14 04:41:46 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/14 04:41:44 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012/07/14 04:29:40 | 000,023,368 | ---- | C] (ESET) -- C:\Windows\System32\drivers\OlmarikFixer.sys
[2012/07/13 13:50:30 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\Need for Speed World
[2012/07/13 13:26:06 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\Electronic_Arts_Inc
[2012/07/13 13:25:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2012/07/13 13:25:54 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2012/07/12 16:31:04 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{4D38FED7-D1E1-4255-BC30-8E2C01039602}
[2012/07/12 16:30:51 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{594601B8-B19C-4D5E-A837-A77EA7571D5F}
[2012/07/10 18:36:54 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{01CEE81B-C191-4BAC-87CA-ADCF2297A158}
[2012/07/10 18:36:41 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{4320C7A0-1FC6-4962-A225-89A81F0F8C6F}
[2012/07/10 03:13:54 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{F57C333B-8155-4A59-ADFD-6E194BC42C57}
[2012/07/10 03:13:42 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{26A17067-FCD3-4AAA-B12E-4F192093D88E}
[2012/07/08 15:40:53 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{DDBBFDAA-68EC-477C-97B5-122A3EDA93D4}
[2012/07/08 15:40:33 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{012608F9-C11B-4FF4-8544-E6D3A8AF2636}
[2012/07/07 14:31:23 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\TempMods
[2012/07/07 14:24:22 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{61D25424-22B2-4BFC-A53E-15C2971C1E82}
[2012/07/07 14:24:08 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{16DCABEA-0C80-4A27-9FC0-13E26D091541}
[2012/07/07 14:22:09 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\Simraceway
[2012/07/07 14:22:03 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\CrashRpt
[2012/07/07 14:20:10 | 000,000,000 | ---D | C] -- C:\Program Files\SimracewayUpdater
[2012/07/07 14:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Simraceway
[2012/07/07 14:19:38 | 000,000,000 | ---D | C] -- C:\Program Files\Simraceway
[2012/07/03 22:57:09 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{CF395E5F-7249-48F0-8811-532AFEE93AE1}
[2012/07/03 22:56:55 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{5BCE131F-A6D2-4AEA-A647-5B06FDFD3807}
[2012/07/02 15:37:08 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{DC6F45E2-D13F-45A1-8AC4-27723DDE00EC}
[2012/07/02 15:36:55 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{278FB69D-1249-456C-9325-EB84D99D8369}
[2012/06/30 18:32:43 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{10D7D83A-4D54-42E6-B847-D85C318204AA}
[2012/06/30 18:32:27 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{FEB15E7B-55CF-494D-BD8E-8CAE16A633CC}
[2012/06/27 15:57:09 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{10C2B255-B40C-4ADE-8823-269192921214}
[2012/06/27 15:56:56 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{A1EDAA3A-6962-4E1F-9B29-A0317A024B37}
[2012/06/27 03:04:36 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{B7627218-C0A7-4AC5-A404-BCB12573FF3B}
[2012/06/27 03:04:22 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{32F82DA0-0F57-4816-B6AC-EEAD50568239}
[2012/06/25 00:54:00 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Roaming\StreamTorrent
[2012/06/24 03:41:55 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{913A51F6-A301-48E6-9281-8A57EABCAAF4}
[2012/06/24 03:41:39 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{A328D702-4229-4DF3-8E2C-B40EBB6A4856}
[2012/06/23 17:11:16 | 000,544,616 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\System32\HPDiscoPMa011.dll
[2012/06/23 16:38:41 | 000,000,000 | R--D | C] -- C:\Users\HPC2D\Desktop\EXAM
[2012/06/20 15:09:38 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{573CB8CF-48D0-4963-95B4-EFBE34D29FAA}
[2012/06/20 15:09:24 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{F64AA690-215B-4462-AFBD-7E47C2606B40}
[2012/06/18 02:41:03 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{EF6F42E4-C32B-4C7C-A290-E77C8DCC7028}
[2012/06/15 23:00:50 | 000,000,000 | ---D | C] -- C:\Users\HPC2D\AppData\Local\{0DBAB49A-8C41-4EDF-8972-7BA320D3F931}
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/14 22:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/14 20:47:48 | 000,020,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 20:47:48 | 000,020,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 20:40:52 | 000,001,954 | ---- | M] () -- C:\Users\HPC2D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3050A J611 series (Network).lnk
[2012/07/14 20:40:41 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/14 20:40:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/14 20:40:06 | 2400,423,936 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/14 20:08:01 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012/07/14 20:07:01 | 005,340,256 | ---- | M] (Canneverbe Limited ) -- C:\Users\HPC2D\Desktop\cdbxp_setup_4.4.1.3243.exe
[2012/07/14 19:25:39 | 000,001,811 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk
[2012/07/14 19:24:54 | 006,055,875 | ---- | M] (LIGHTNING UK!) -- C:\Users\HPC2D\Desktop\SetupImgBurn_2.5.6.0.exe
[2012/07/14 19:19:23 | 129,642,496 | ---- | M] () -- C:\Users\HPC2D\Desktop\gparted-live-0.12.1-5.iso
[2012/07/14 19:10:38 | 002,135,640 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\HPC2D\Desktop\tdsskiller.exe
[2012/07/14 18:35:30 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\HPC2D\Desktop\aswMBR.exe
[2012/07/14 17:03:29 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\HPC2D\Desktop\OTL.exe
[2012/07/14 04:29:40 | 000,023,368 | ---- | M] (ESET) -- C:\Windows\System32\drivers\OlmarikFixer.sys
[2012/07/13 13:25:54 | 000,002,163 | ---- | M] () -- C:\Users\Public\Desktop\Need For Speed World.lnk
[2012/07/10 16:57:58 | 000,626,450 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/07/10 16:57:58 | 000,107,586 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/07/08 17:40:32 | 004,625,421 | ---- | M] () -- C:\Users\HPC2D\Desktop\[Songs.PK] 04 - Jism 2 - Ye Jism.mp3
[2012/07/08 15:45:21 | 000,007,889 | ---- | M] () -- C:\Users\HPC2D\Desktop\ticket.htm
[2012/06/24 14:49:49 | 000,409,072 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/06/23 17:09:16 | 000,000,057 | -H-- | M] () -- C:\ProgramData\Ament.ini
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/14 20:08:01 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012/07/14 20:08:01 | 000,001,845 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012/07/14 19:25:39 | 000,001,823 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
[2012/07/14 19:25:39 | 000,001,811 | ---- | C] () -- C:\Users\Public\Desktop\ImgBurn.lnk
[2012/07/14 19:17:10 | 129,642,496 | ---- | C] () -- C:\Users\HPC2D\Desktop\gparted-live-0.12.1-5.iso
[2012/07/14 18:31:25 | 000,002,163 | ---- | C] () -- C:\Users\Public\Desktop\Need For Speed World.lnk
[2012/07/14 18:31:24 | 000,002,432 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/07/14 18:31:24 | 000,001,515 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/07/14 18:31:24 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/07/14 18:31:24 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/07/14 18:31:24 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/07/14 18:31:24 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/07/14 18:31:24 | 000,001,320 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/07/14 18:31:24 | 000,001,251 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2012/07/14 18:31:24 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/07/14 18:31:24 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/07/14 18:31:22 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/07/14 04:46:05 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/14 04:46:05 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/14 04:46:05 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/14 04:46:05 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/14 04:46:05 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/08 17:40:28 | 004,625,421 | ---- | C] () -- C:\Users\HPC2D\Desktop\[Songs.PK] 04 - Jism 2 - Ye Jism.mp3
[2012/07/08 15:45:21 | 000,007,889 | ---- | C] () -- C:\Users\HPC2D\Desktop\ticket.htm
[2012/06/24 14:41:42 | 000,001,954 | ---- | C] () -- C:\Users\HPC2D\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3050A J611 series (Network).lnk
[2012/06/23 17:09:16 | 000,000,057 | -H-- | C] () -- C:\ProgramData\Ament.ini
[2012/04/09 23:08:52 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat
[2012/01/06 19:55:33 | 000,000,000 | ---- | C] () -- C:\Users\HPC2D\AppData\Local\{BC37EE0F-8684-4128-AE98-F0C268C9A406}
[2012/01/06 19:53:37 | 000,000,000 | ---- | C] () -- C:\Users\HPC2D\AppData\Local\{0F3C25A6-7A53-46C0-8B90-A90AD964FE9D}
[2011/11/10 06:28:32 | 000,204,960 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2011/11/10 06:28:32 | 000,157,152 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2011/11/09 22:39:44 | 000,059,904 | ---- | C] () -- C:\Windows\System32\OpenVideo.dll
[2011/11/09 22:39:32 | 000,054,784 | ---- | C] () -- C:\Windows\System32\OVDecode.dll
[2011/10/21 23:30:14 | 000,243,168 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011/09/21 13:55:33 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011/09/13 03:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2011/06/24 02:29:32 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/06/15 20:04:08 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/06/13 21:26:56 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe
[2011/06/13 21:18:05 | 000,176,235 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
[2011/06/13 20:58:15 | 000,221,341 | ---- | C] () -- C:\Windows\hpoins19.dat
[2011/06/13 20:58:15 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2011/06/09 01:57:22 | 001,929,576 | ---- | C] () -- C:\Windows\System32\HPScanTRDrv_DJ3050A_J611.dll
[2011/04/09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

< End of report >
  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
I see you have run Combofix, could you post that log please..

Also for the Gparted section was it easy to understand, or do I need to get better screenshots ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Posted Image

    :OTL
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKU\S-1-5-21-2787673202-530888288-3304730987-1000\..\Toolbar\WebBrowser: (no name) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No CLSID value found.

    :Files
    ipconfig /flushdns /c

    :Commands
    [resethosts]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Could you now retry aswMBR please, then let me know how the computer is ehaving
  • 0

#9
cartuner

cartuner

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
My brother had run ComboFix on this computer, this was before I approached this site. He has deleted it since and I don't think the logs are recoverable.
Gparted section was very clear and very simple to execute.

I've attached both logs, one from the OTL Quick Scan after running the fix and the other is from running the aswMBR scan. I just scanned and attached the log, I didn't run the Fix MBR process.

Thanks a lot for your prompt and clear replies :thumbsup:

Attached Files


Edited by cartuner, 14 July 2012 - 02:57 PM.

  • 0

#10
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Well the bad boy is history now :cool:

I have updated the screenshots to be a little bigger now as I thought they were a tad small, or I need new glasses :lol:

OK so how is the computer now ? Any outstanding problems
  • 0

#11
cartuner

cartuner

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
It is running perfect. Exactly how it was running before this pesky Olmarik infected it.

I cannot express how thankful I am to you and to whoever is responsible for Geeks To Go. A friend of mine referred me to this site and I'm glad that it helped me out.

:thumbsup: everyone
  • 0

#12
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Commands
    [resethosts]
    [emptytemp]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

  • Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
  • In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK

    Posted Image
  • Follow the prompts on the screen
  • A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Go to control panel
  • Select folder options (Appearance > Folder options in category view)
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

Posted Image
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:
  • Go to this site and click Do I have Java
  • It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point
  • Go to Control Panel and select System
  • Select System
  • On the left select System Protection and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create

Now we can purge the infected ones
  • GoStart > All programs > Accessories > system tools
  • Right click Disc cleanup and select run as administrator
  • Select Your main drive and accept the warning if you get one
  • For a few moments the system will make some calculations
  • Select the More Options tab
  • In the System Restore and Shadow Backups select Clean up
  • Select Delete on the pop up
  • Select OK
  • Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Posted Image
Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe :wave:
  • 0

#13
cartuner

cartuner

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
All done! :)
  • 0

#14
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP