[mdogornone]

A virus is making my hard drive look empty. all desktop icons were deleted, and ihave 0 access to any files. however my computer starts up perfectly fine. AFter running OTS and OTL i noticed that when i click save as in my notepad i can see all of my old files... i can alter them from there as well. So i know they still exist (i had faith they still did) my start menu is blank, all programs is empty. skype starts up and runs all by itself when i start the computer... (which it did before). While inspecting the c; drive via the save as from notepad i noticed a .ini file in what seems to be every file.
there are also a lot of .dat files all over the place and other files i've never seen before.
When i open the desktop.ini file (it opens in notepad) i get this bit of code:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21816 

That is all. Here is the log from the OTL

OTL logfile created on: 8/5/2012 8:06:26 AM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.91 Gb Total Physical Memory | 2.50 Gb Available Physical Memory | 64.04% Memory free
9.76 Gb Paging File | 8.24 Gb Available in Paging File | 84.42% Paging File free
Paging file location(s): c:\pagefile.sys 5998 20000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 286.03 Gb Total Space | 135.09 Gb Free Space | 47.23% Space Free | Partition Type: NTFS
Drive D: | 11.87 Gb Total Space | 2.00 Gb Free Space | 16.82% Space Free | Partition Type: NTFS

Computer Name: MDOG-PC | User Name: mdog | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/05 08:05:54 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\OTL.exe
PRC - [2011/10/10 01:17:19 | 000,189,248 | -H-- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exe
PRC - [2011/10/10 01:17:11 | 000,075,136 | -H-- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011/03/28 18:07:50 | 000,094,264 | -H-- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe


========== Modules (No Company Name) ==========

MOD - [2010/01/22 12:30:00 | 007,745,536 | -H-- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2010/01/22 12:29:58 | 002,121,728 | -H-- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2007/11/28 16:51:42 | 001,039,872 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxdncoms.exe -- (lxdn_device)
SRV - [2012/08/04 09:09:57 | 000,257,224 | -H-- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/19 00:26:03 | 000,113,120 | -H-- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/03 13:19:28 | 000,160,944 | RH-- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/10/10 01:17:19 | 000,189,248 | -H-- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2011/10/10 01:17:11 | 000,075,136 | -H-- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011/09/09 18:10:28 | 000,086,072 | -H-- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe -- (HP Support Assistant Service)
SRV - [2011/03/28 18:07:50 | 000,094,264 | -H-- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/03/18 15:16:28 | 000,130,384 | -H-- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/29 02:02:00 | 003,407,292 | -H-- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/05/31 20:11:54 | 000,443,784 | -H-- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 20:11:46 | 000,225,672 | -H-- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/02/15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/10/13 12:05:50 | 010,629,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 04:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010/09/26 23:15:22 | 002,374,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/06/21 18:07:33 | 000,102,656 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\swiwdmbusx64.sys -- (swiwdmbus)
DRV:64bit: - [2010/06/21 17:51:29 | 000,210,944 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\swumxa3.sys -- (SWUMXA3)
DRV:64bit: - [2010/06/21 17:51:01 | 000,240,640 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\swnc8ua3.sys -- (SWNC8UA3)
DRV:64bit: - [2010/03/15 10:45:28 | 000,145,408 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV:64bit: - [2010/02/26 12:05:32 | 000,699,960 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009/10/22 13:54:24 | 000,040,464 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\70940952.sys -- (70940952)
DRV:64bit: - [2009/10/09 23:30:56 | 000,352,784 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\7094095.sys -- (setup_9.0.0.722_03.08.2012_14-33drv)
DRV:64bit: - [2009/09/25 17:59:46 | 000,157,712 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\70940951.sys -- (70940951)
DRV:64bit: - [2009/09/21 01:43:52 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bus.sys -- (ss_bus)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/18 23:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/06/10 16:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009/06/10 16:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009/06/10 16:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009/06/10 15:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009/06/10 15:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/04/29 10:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2009/04/08 15:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009/03/02 02:05:32 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2008/05/06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007/03/07 15:13:20 | 000,017,920 | ---- | M] (June Fabrics Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pnetmdm64.sys -- (pnetmdm)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2005/01/01 04:43:08 | 000,004,682 | -H-- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {403CE8DA-BA42-478B-945D-BCD60FB70B3C}
IE:64bit: - HKLM\..\SearchScopes\{397CFBAF-01FE-4A0D-950E-041F4905DC38}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpl
IE:64bit: - HKLM\..\SearchScopes\{403CE8DA-BA42-478B-945D-BCD60FB70B3C}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb
IE - HKLM\..\SearchScopes,DefaultScope = {0B4A10D1-FBD6-451d-BFDA-F03252B05984}
IE - HKLM\..\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}: "URL" = http://slirsredirect...mrud=03-05-2010
IE - HKLM\..\SearchScopes\{397CFBAF-01FE-4A0D-950E-041F4905DC38}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpl
IE - HKLM\..\SearchScopes\{403CE8DA-BA42-478B-945D-BCD60FB70B3C}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {8FB1610F-6ECE-403E-BD2F-701B27A34869}
IE - HKCU\..\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}: "URL" = http://slirsredirect...mrud=03-05-2010
IE - HKCU\..\SearchScopes\{212a3fbe-daab-4087-98e9-daac859cf18d}: "URL" = http://slirsredirect...u10aiminstabie7
IE - HKCU\..\SearchScopes\{397CFBAF-01FE-4A0D-950E-041F4905DC38}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpl
IE - HKCU\..\SearchScopes\{403CE8DA-BA42-478B-945D-BCD60FB70B3C}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{8FB1610F-6ECE-403E-BD2F-701B27A34869}: "URL" = http://www.google.co...age={startPage}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.c...fr&d=2012-01-21 19:31:44&v=9.0.0.23&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AOL Search"
FF - prefs.js..browser.search.defaulturl: "http://aim.search.ao...rud=03-05-2010"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://isearch.avg.c...5:57&sap=ku&q="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/03 10:58:58 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/01 12:53:08 | 000,000,000 | -H-D | M]

[2009/12/18 10:20:40 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\mdog\AppData\Roaming\Mozilla\Extensions
[2012/05/02 16:48:07 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\extensions
[2012/08/01 12:52:01 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/05/02 20:43:43 | 000,001,490 | -H-- | M] () -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\searchplugins\AIM Search.xml
[2010/05/02 20:44:43 | 000,002,343 | -H-- | M] () -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\searchplugins\aol-search.xml
[2012/08/03 10:58:58 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/07/13 19:17:47 | 000,136,672 | -H-- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/01/21 20:31:41 | 000,003,766 | -H-- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/13 19:16:36 | 000,002,252 | -H-- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/07/13 19:16:36 | 000,002,040 | -H-- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com/

O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\mdog\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKCU..\Run: [attcm.exe] C:\Program Files (x86)\AT&T\AT&T Communication Manager\attcm.exe File not found
O4 - HKCU..\Run: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" File not found
O4 - HKCU..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW File not found
O4 - HKCU..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - Startup: C:\Users\mdog\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_03.08.2012_14-33.lnk = C:\Users\mdog\Desktop\Virus Removal Tool\setup_9.0.0.722_03.08.2012_14-33\startup.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WallpaperStyle = 2
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: usmc.mil ([sso.mol] https in Trusted sites)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.4.0)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.4.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35272DF3-56BE-4422-9783-9E6111FD6BEE}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{67b793f5-528f-11e0-ab4b-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{67b793f5-528f-11e0-ab4b-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{80717ae9-528a-11e0-ab32-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{80717ae9-528a-11e0-ab32-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{92ed6b48-4f91-11e0-b459-001f16eb6a17}\Shell - "" = AutoRun
O33 - MountPoints2\{92ed6b48-4f91-11e0-b459-001f16eb6a17}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{92ed6b4d-4f91-11e0-b459-001f16eb6a17}\Shell - "" = AutoRun
O33 - MountPoints2\{92ed6b4d-4f91-11e0-b459-001f16eb6a17}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{e1a04b6f-5298-11e0-af60-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{e1a04b6f-5298-11e0-af60-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{ebba4d69-5288-11e0-8608-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{ebba4d69-5288-11e0-8608-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{ebba4d6c-5288-11e0-8608-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{ebba4d6c-5288-11e0-8608-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/05 08:07:01 | 000,646,656 | ---- | C] (OldTimer Tools) -- C:\OTS.exe
[2012/08/05 08:06:01 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\OTL.exe
[2012/08/04 10:14:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012/08/04 10:13:36 | 000,352,784 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\7094095.sys
[2012/08/04 10:13:36 | 000,157,712 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\70940951.sys
[2012/08/04 10:13:36 | 000,040,464 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\70940952.sys
[2012/08/04 10:13:36 | 000,000,000 | ---D | C] -- C:\Users\mdog\Desktop\Virus Removal Tool
[2012/08/02 10:37:27 | 000,000,000 | -H-D | C] -- C:\Users\mdog\AppData\Local\AVG Secure Search
[2012/08/02 10:37:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\AVG Secure Search
[2012/08/02 10:36:52 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\AVG Secure Search
[2012/08/02 10:36:51 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\AVG Secure Search
[2012/08/02 10:36:12 | 000,000,000 | -H-D | C] -- C:\Windows\SysWow64\drivers\AVG
[2012/08/01 10:28:26 | 000,000,000 | -H-D | C] -- C:\Windows\Minidump
[2012/08/01 09:02:16 | 000,000,000 | -H-D | C] -- C:\Users\mdog\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Recovery
[2012/07/30 23:34:26 | 000,000,000 | -H-D | C] -- C:\Users\mdog\Desktop\minecraft
[2012/07/29 07:27:49 | 000,000,000 | -H-D | C] -- C:\Users\mdog\AppData\Roaming\wargaming.net
[2012/07/29 07:27:31 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
[2012/07/29 07:27:30 | 000,000,000 | -H-D | C] -- C:\Games
[2012/07/17 00:06:06 | 000,000,000 | -H-D | C] -- C:\Users\mdog\Documents\The Lord of the Rings Online
[2012/07/17 00:06:06 | 000,000,000 | -H-D | C] -- C:\Users\mdog\AppData\Local\The Lord of the Rings Online
[2012/07/16 21:39:38 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012/07/16 21:39:38 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012/07/16 21:38:57 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Warner Bros
[2012/07/16 19:27:39 | 000,000,000 | -H-D | C] -- C:\Users\mdog\AppData\Local\GameStop
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/05 08:09:23 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/05 08:09:23 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/05 08:07:42 | 000,793,646 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/08/05 08:07:42 | 000,669,884 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/08/05 08:07:42 | 000,125,934 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/08/05 08:06:54 | 000,646,656 | ---- | M] (OldTimer Tools) -- C:\OTS.exe
[2012/08/05 08:05:54 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\OTL.exe
[2012/08/05 08:02:05 | 000,000,890 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/05 08:01:37 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2012/08/05 08:01:30 | 000,067,584 | --S- | M] () -- C:\Windows\BootStat.dat
[2012/08/05 08:01:24 | 3145,089,024 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/05 07:50:00 | 000,000,260 | -H-- | M] () -- C:\Windows\tasks\RGames Updater.job
[2012/08/05 07:40:00 | 000,000,894 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/05 06:43:00 | 000,000,928 | -H-- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-864392982-4153142020-2938811377-1006UA.job
[2012/08/05 03:43:00 | 000,000,906 | -H-- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-864392982-4153142020-2938811377-1006Core.job
[2012/08/04 10:33:23 | 000,012,590 | ---- | M] () -- C:\Users\mdog\Desktop\Computer - Shortcut.lnk
[2012/08/04 10:14:41 | 000,002,235 | ---- | M] () -- C:\Users\mdog\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_03.08.2012_14-33.lnk
[2012/08/04 09:09:57 | 000,000,830 | -H-- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/04 08:56:16 | 515,959,457 | -H-- | M] () -- C:\Windows\MEMORY.DMP
[2012/08/03 10:59:05 | 000,002,044 | -H-- | M] () -- C:\Users\mdog\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/03 10:59:05 | 000,001,090 | -H-- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/08/02 10:25:59 | 000,000,592 | -H-- | M] () -- C:\ProgramData\PaW1cXSvgYvGGh
[2012/08/02 10:22:17 | 000,000,072 | -H-- | M] () -- C:\ProgramData\-PaW1cXSvgYvGGhr
[2012/08/02 10:22:17 | 000,000,072 | -H-- | M] () -- C:\ProgramData\-PaW1cXSvgYvGGh
[2012/08/01 09:02:16 | 000,000,679 | -H-- | M] () -- C:\Users\mdog\Application Data\Microsoft\Internet Explorer\Quick Launch\File_Recovery.lnk
[2012/08/01 09:02:16 | 000,000,655 | -H-- | M] () -- C:\Users\mdog\Desktop\File_Recovery.lnk
[2012/08/01 02:56:17 | 000,033,958 | -H-- | M] () -- C:\ProgramData\uninstaller.exe
[2012/07/30 03:35:54 | 000,000,328 | -H-- | M] () -- C:\Windows\tasks\HPCeeScheduleFormdog.job
[2012/07/17 17:45:19 | 000,001,729 | -H-- | M] () -- C:\Users\mdog\Desktop\TurbineLauncher - Shortcut.lnk
[2012/07/16 22:09:33 | 000,810,218 | -H-- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/12 09:29:52 | 004,534,272 | -H-- | M] () -- C:\ProgramData\ReadOnlyInstaller.msi
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/08/04 10:33:23 | 000,012,590 | ---- | C] () -- C:\Users\mdog\Desktop\Computer - Shortcut.lnk
[2012/08/04 10:14:41 | 000,002,235 | ---- | C] () -- C:\Users\mdog\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_03.08.2012_14-33.lnk
[2012/08/04 09:09:57 | 000,000,830 | -H-- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/03 10:53:18 | 000,001,102 | -H-- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/08/03 10:51:51 | 000,000,582 | -H-- | C] () -- C:\Users\mdog\Desktop\Launcher.exe - Shortcut.lnk
[2012/08/01 10:28:17 | 515,959,457 | -H-- | C] () -- C:\Windows\MEMORY.DMP
[2012/08/01 09:02:18 | 000,000,072 | -H-- | C] () -- C:\ProgramData\-PaW1cXSvgYvGGhr
[2012/08/01 09:02:18 | 000,000,072 | -H-- | C] () -- C:\ProgramData\-PaW1cXSvgYvGGh
[2012/08/01 09:02:16 | 000,000,679 | -H-- | C] () -- C:\Users\mdog\Application Data\Microsoft\Internet Explorer\Quick Launch\File_Recovery.lnk
[2012/08/01 09:02:16 | 000,000,655 | -H-- | C] () -- C:\Users\mdog\Desktop\File_Recovery.lnk
[2012/08/01 09:02:12 | 000,000,592 | -H-- | C] () -- C:\ProgramData\PaW1cXSvgYvGGh
[2012/08/01 02:56:17 | 000,033,958 | -H-- | C] () -- C:\ProgramData\uninstaller.exe
[2012/08/01 02:56:05 | 000,000,260 | -H-- | C] () -- C:\Windows\tasks\RGames Updater.job
[2012/07/30 23:24:30 | 000,067,584 | --S- | C] () -- C:\Windows\BootStat.dat
[2012/07/17 17:45:19 | 000,001,729 | -H-- | C] () -- C:\Users\mdog\Desktop\TurbineLauncher - Shortcut.lnk
[2012/07/12 09:29:52 | 004,534,272 | -H-- | C] () -- C:\ProgramData\ReadOnlyInstaller.msi
[2012/06/19 14:56:39 | 000,000,262 | -H-- | C] () -- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2012/05/10 22:42:56 | 000,000,016 | -H-- | C] () -- C:\Windows\guiinfo.dat
[2012/01/11 15:04:34 | 000,001,446 | -HS- | C] () -- C:\Users\mdog\AppData\Local\m78j3pk134egv07y66
[2012/01/11 15:04:34 | 000,001,446 | -HS- | C] () -- C:\ProgramData\m78j3pk134egv07y66
[2011/10/13 12:04:02 | 000,092,356 | -H-- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2011/10/09 23:26:50 | 000,189,248 | -H-- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011/10/09 23:26:43 | 000,075,136 | -H-- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011/05/11 22:57:08 | 000,001,854 | -H-- | C] () -- C:\Users\mdog\AppData\Roaming\GhostObjGAFix.xml
[2010/06/03 15:50:13 | 000,000,092 | -H-- | C] () -- C:\Users\mdog\AppData\Local\fusioncache.dat
[2010/02/28 23:30:38 | 000,007,601 | -H-- | C] () -- C:\Users\mdog\AppData\Local\Resmon.ResmonCfg
[2010/02/09 17:32:52 | 000,010,752 | -H-- | C] () -- C:\Users\mdog\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/13 10:20:34 | 000,000,604 | -H-- | C] () -- C:\Users\mdog\AppData\Roaming\wklnhst.dat
[2009/09/27 00:39:48 | 000,000,290 | -H-- | C] () -- C:\ProgramData\hpqp.ini

========== LOP Check ==========

[2012/08/03 13:24:22 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\.minecraft
[2010/05/02 20:48:01 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\acccore
[2011/07/10 19:38:10 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\FileZilla
[2010/02/17 16:53:36 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\funkitron
[2012/01/22 15:48:13 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\GetRightToGo
[2010/03/02 15:55:37 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\iWin
[2010/03/25 12:45:52 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Lexmark Productivity Studio
[2012/03/17 10:52:15 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\LolClient
[2012/05/27 20:53:11 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\LolClient2
[2012/08/01 12:52:02 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\MilkShape 3D 1.x.x
[2012/08/01 12:52:01 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\muvee Technologies
[2010/02/18 15:35:10 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\OpenOffice.org
[2012/01/14 16:27:34 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Pamela
[2012/01/14 16:39:54 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Pamela Call Recorder
[2012/01/16 02:20:48 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\PrettyMay
[2011/03/19 19:16:52 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Sierra Wireless
[2011/09/01 23:13:40 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Stardock
[2009/12/13 10:20:36 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Template
[2010/06/03 15:50:33 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Turbine
[2012/07/29 20:41:52 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\wargaming.net
[2010/06/02 00:52:05 | 000,000,000 | -H-D | M] -- C:\Users\mdog\AppData\Roaming\Wings3D
[2012/08/05 03:43:00 | 000,000,906 | -H-- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-864392982-4153142020-2938811377-1006Core.job
[2012/08/05 06:43:00 | 000,000,928 | -H-- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-864392982-4153142020-2938811377-1006UA.job
[2012/08/05 07:50:00 | 000,000,260 | -H-- | M] () -- C:\Windows\Tasks\RGames Updater.job
[2011/06/28 21:33:07 | 000,032,568 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >



Any attention and help would be GREATLY appreciated... i thank you all ahead of time for any help.

[Advertisements]

Your files are still there. Just hidden. We should be able to get everything back unless you have cleaned out your temp files. This bug usually moves all of your links to %Temp%\smtmp

which is usually C:\Users\mdog\AppData\Local\Temp\smtmp. This is a hidden system folder so to see it you need to:
Open the Control Panel menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and exit My Computer.
Now your computer is configured to show all hidden files.

This should allow you to see your other files again tho you won't see anything in Start, All Programs yet.

Do not do anything to the smtmp folder (other than perhaps copy it and paste a copy on your desktop) or we won't be able to get your links back.

What is F: ?

Copy the text in the code box by highlighting and Ctrl + c

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;*.local
[2012/08/02 10:25:59 | 000,000,592 | -H-- | M] () -- C:\ProgramData\PaW1cXSvgYvGGh
[2012/08/02 10:22:17 | 000,000,072 | -H-- | M] () -- C:\ProgramData\-PaW1cXSvgYvGGhr
[2012/08/02 10:22:17 | 000,000,072 | -H-- | M] () -- C:\ProgramData\-PaW1cXSvgYvGGh
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\mdog\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKCU..\Run: [attcm.exe] C:\Program Files (x86)\AT&T\AT&T Communication Manager\attcm.exe File not found
O4 - HKCU..\Run: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" File not found
O4 - HKCU..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW File not found
O33 - MountPoints2\{67b793f5-528f-11e0-ab4b-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{67b793f5-528f-11e0-ab4b-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{80717ae9-528a-11e0-ab32-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{80717ae9-528a-11e0-ab32-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{92ed6b48-4f91-11e0-b459-001f16eb6a17}\Shell - "" = AutoRun
O33 - MountPoints2\{92ed6b48-4f91-11e0-b459-001f16eb6a17}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{92ed6b4d-4f91-11e0-b459-001f16eb6a17}\Shell - "" = AutoRun
O33 - MountPoints2\{92ed6b4d-4f91-11e0-b459-001f16eb6a17}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{e1a04b6f-5298-11e0-af60-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{e1a04b6f-5298-11e0-af60-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{ebba4d69-5288-11e0-8608-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{ebba4d69-5288-11e0-8608-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{ebba4d6c-5288-11e0-8608-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{ebba4d6c-5288-11e0-8608-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
[2012/08/05 07:50:00 | 000,000,260 | -H-- | M] () -- C:\Windows\tasks\RGames Updater.job
[2012/08/01 12:52:01 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/05/02 20:43:43 | 000,001,490 | -H-- | M] () -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\searchplugins\AIM Search.xml
[2010/05/02 20:44:43 | 000,002,343 | -H-- | M] () -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\searchplugins\aol-search.xml
[2012/01/11 15:04:34 | 000,001,446 | -HS- | C] () -- C:\Users\mdog\AppData\Local\m78j3pk134egv07y66
[2012/01/11 15:04:34 | 000,001,446 | -HS- | C] () -- C:\ProgramData\m78j3pk134egv07y66

:files
xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C
F:\WIN\setup.exe
F:\Autorun.inf

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"
     
:Commands
[EMPTYFLASH]
[EMPTYJAVA]
[purity]
[Reboot]

then Rightclick on OTL and select Run As Administrator to start. Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the RUN FIX button (NOT THE QUICK SCAN button!) at the top
Let the program run unhindered, OTL will reboot the PC when it is done.

Download, Save and Right click on unhide.exe and Run As Administrator from

http://download.blee...nler/unhide.exe



If one of the following will not run then just skip to the next one then go back and try the things that wouldn't run again after finishing the others.

Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:

http://www.malwareby...lwarebytes_free

SAVE the free version of Malwarebytes' Anti-Malware to your desktop.

Rightclick on Malwarebytes' Anti-Malware and select Run As Administrator and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.

* Once the program has loaded, select Perform Quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.



ComboFix

:!: It must be saved to your desktop, do not run it from your browser:!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Save this file -- to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Rightclick on ComboFix and select Run As Administrator to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.

If you get an error: 'illegal operation attempted on a registry key that has been marked for deletion'
just reboot once and it should go away.

Download TDSSKiller:
http://support.kaspe.../tdsskiller.exe
Save it to your desktop then right click and Run as Administrator

If TDSSKiller alerts you that the system needs to reboot, please consent.
When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.


Download aswMBR.exe ( 511KB ) to your desktop.
Right click aswMBR.exe and Run as Administrator

change the a-v scan to None.
uncheck trace disk IO calls
Click the "Scan" button to start scan (Allow the Avast Engine)
On completion of the scan (Note if the Fix button is enabled (not the FixMBR button) and tell me) click save log, save it to your desktop and post in your next reply


Run OTL (Vista or Win 7 => right click and Run As Administrator)

select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste both of them.


Ron

[RKinner]

Your files are still there. Just hidden. We should be able to get everything back unless you have cleaned out your temp files. This bug usually moves all of your links to %Temp%\smtmp

which is usually C:\Users\mdog\AppData\Local\Temp\smtmp. This is a hidden system folder so to see it you need to:
Open the Control Panel menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and exit My Computer.
Now your computer is configured to show all hidden files.

This should allow you to see your other files again tho you won't see anything in Start, All Programs yet.

Do not do anything to the smtmp folder (other than perhaps copy it and paste a copy on your desktop) or we won't be able to get your links back.

What is F: ?

Copy the text in the code box by highlighting and Ctrl + c

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;*.local
[2012/08/02 10:25:59 | 000,000,592 | -H-- | M] () -- C:\ProgramData\PaW1cXSvgYvGGh
[2012/08/02 10:22:17 | 000,000,072 | -H-- | M] () -- C:\ProgramData\-PaW1cXSvgYvGGhr
[2012/08/02 10:22:17 | 000,000,072 | -H-- | M] () -- C:\ProgramData\-PaW1cXSvgYvGGh
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\mdog\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKCU..\Run: [attcm.exe] C:\Program Files (x86)\AT&T\AT&T Communication Manager\attcm.exe File not found
O4 - HKCU..\Run: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" File not found
O4 - HKCU..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW File not found
O33 - MountPoints2\{67b793f5-528f-11e0-ab4b-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{67b793f5-528f-11e0-ab4b-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{80717ae9-528a-11e0-ab32-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{80717ae9-528a-11e0-ab32-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{92ed6b48-4f91-11e0-b459-001f16eb6a17}\Shell - "" = AutoRun
O33 - MountPoints2\{92ed6b48-4f91-11e0-b459-001f16eb6a17}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{92ed6b4d-4f91-11e0-b459-001f16eb6a17}\Shell - "" = AutoRun
O33 - MountPoints2\{92ed6b4d-4f91-11e0-b459-001f16eb6a17}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{e1a04b6f-5298-11e0-af60-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{e1a04b6f-5298-11e0-af60-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{ebba4d69-5288-11e0-8608-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{ebba4d69-5288-11e0-8608-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{ebba4d6c-5288-11e0-8608-0c60764c21ed}\Shell - "" = AutoRun
O33 - MountPoints2\{ebba4d6c-5288-11e0-8608-0c60764c21ed}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
[2012/08/05 07:50:00 | 000,000,260 | -H-- | M] () -- C:\Windows\tasks\RGames Updater.job
[2012/08/01 12:52:01 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/05/02 20:43:43 | 000,001,490 | -H-- | M] () -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\searchplugins\AIM Search.xml
[2010/05/02 20:44:43 | 000,002,343 | -H-- | M] () -- C:\Users\mdog\AppData\Roaming\Mozilla\Firefox\Profiles\jomeag4j.default\searchplugins\aol-search.xml
[2012/01/11 15:04:34 | 000,001,446 | -HS- | C] () -- C:\Users\mdog\AppData\Local\m78j3pk134egv07y66
[2012/01/11 15:04:34 | 000,001,446 | -HS- | C] () -- C:\ProgramData\m78j3pk134egv07y66

:files
xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C
F:\WIN\setup.exe
F:\Autorun.inf

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"
     
:Commands
[EMPTYFLASH]
[EMPTYJAVA]
[purity]
[Reboot]

then Rightclick on OTL and select Run As Administrator to start. Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the RUN FIX button (NOT THE QUICK SCAN button!) at the top
Let the program run unhindered, OTL will reboot the PC when it is done.

Download, Save and Right click on unhide.exe and Run As Administrator from

http://download.blee...nler/unhide.exe



If one of the following will not run then just skip to the next one then go back and try the things that wouldn't run again after finishing the others.

Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:

http://www.malwareby...lwarebytes_free

SAVE the free version of Malwarebytes' Anti-Malware to your desktop.

Rightclick on Malwarebytes' Anti-Malware and select Run As Administrator and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.

* Once the program has loaded, select Perform Quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.



ComboFix

:!: It must be saved to your desktop, do not run it from your browser:!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Save this file -- to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Rightclick on ComboFix and select Run As Administrator to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.

If you get an error: 'illegal operation attempted on a registry key that has been marked for deletion'
just reboot once and it should go away.

Download TDSSKiller:
http://support.kaspe.../tdsskiller.exe
Save it to your desktop then right click and Run as Administrator

If TDSSKiller alerts you that the system needs to reboot, please consent.
When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.


Download aswMBR.exe ( 511KB ) to your desktop.
Right click aswMBR.exe and Run as Administrator

change the a-v scan to None.
uncheck trace disk IO calls
Click the "Scan" button to start scan (Allow the Avast Engine)
On completion of the scan (Note if the Fix button is enabled (not the FixMBR button) and tell me) click save log, save it to your desktop and post in your next reply


Run OTL (Vista or Win 7 => right click and Run As Administrator)

select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste both of them.


Ron