It`s been 3 days since google wont load.All other sites load normally.
What can be the problem that causes this ?
I deleted cookies and cache but it still wont load,it`s so frustrating.
Edited by Lukka09, 13 January 2013 - 02:30 PM.
Google won't load [Solved]
Started by
Lukka09
, Jan 13 2013 02:29 PM
-
This topic is locked
#1
Posted 13 January 2013 - 02:29 PM
Lukka09
-
- Member
-
- 40 posts
Member
It`s been 3 days since google wont load.All other sites load normally.
What can be the problem that causes this ?
I deleted cookies and cache but it still wont load,it`s so frustrating.
#2
Posted 13 January 2013 - 02:31 PM
gringo_pr
-
- Malware Removal
-
- 7,268 posts
Trusted Helper
Greetings and Welcome to The Forums!!
My name is Gringo and I'll be glad to help you with your malware problems.
I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us
NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.
NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.
I need to get some reports to get a base to start from so I need you to run these programs first.
-DeFogger-
-Security Check-
-Download DDS-
information and logs
Gringo
My name is Gringo and I'll be glad to help you with your malware problems.
I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us
- Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
- Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
- Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
- Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.
NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.
I need to get some reports to get a base to start from so I need you to run these programs first.
-DeFogger-
- Please download DeFogger to your desktop.
Double click DeFogger to run the tool.
- The application window will appear
- Click the Disable button to disable your CD Emulation drivers
- Click Yes to continue
- A 'Finished!' message will appear
- Click OK
- DeFogger may ask you to reboot the machine, if it does - click OK
-Security Check-
- Download Security Check by screen317 from here.
- Save it to your Desktop.
- Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
-Download DDS-
- Please download DDS from one of the links below and save it to your desktop:
Download DDS and save it to your desktop
Link1
Link2
Link3
- Double-Click on dds.scr and a command window will appear. This is normal.
- Shortly after two logs will appear:
- DDS.txt
- Attach.txt
- A window will open instructing you save & post the logs
- Save the logs to a convenient place such as your desktop
- Copy the contents of both logs & post in your next reply
information and logs
- In your next post I need the following
- both reports from DDS
- report from security check
- let me know of any problems you may have had
Gringo
#3
Posted 13 January 2013 - 03:04 PM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
When i run defogger it doesnt show the message Finished.
I waited 10 min but nothing.Should i proceed anyway with another steps?
I waited 10 min but nothing.Should i proceed anyway with another steps?
#4
Posted 13 January 2013 - 03:14 PM
gringo_pr
-
- Malware Removal
-
- 7,268 posts
Trusted Helper
yes proceed
#5
Posted 13 January 2013 - 05:55 PM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
Results of screen317's Security Check version 0.99.56
Windows XP Service Pack 2 x86
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
ESET NOD32 Antivirus 3.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java™ 6 Update 31
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.4.402.278
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox 13.0.1 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
All Users Application Data Telenor Internet OnlineUpdate\ouc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 22% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
These are results after second step.Should i proceed to the third now ?
Windows XP Service Pack 2 x86
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
ESET NOD32 Antivirus 3.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java™ 6 Update 31
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.4.402.278
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox 13.0.1 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
All Users Application Data Telenor Internet OnlineUpdate\ouc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 22% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
These are results after second step.Should i proceed to the third now ?
#6
Posted 13 January 2013 - 06:02 PM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_31
Run by Administrator at 0:58:28 on 2013-01-14
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2039.1123 [GMT 1:00]
.
AV: ESET NOD32 Antivirus 3.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ================
.
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\GameTracker\GSInGameService.exe
C:\Documents and Settings\All Users\Application Data\DatacardService\HWDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Documents and Settings\All Users\Application Data\Telenor Internet\OnlineUpdate\ouc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uURLSearchHooks: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\prxtbBS_0.dll
mWinlogon: TaskMan = c:\documents and settings\administrator\cbzvl.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\conduitengine\prxConduitEngine.dll
BHO: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\prxtbBS_0.dll
TB: BS Player Toolbar: {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - c:\program files\bs_player\prxtbBS_0.dll
TB: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\prxtbBS_0.dll
TB: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\conduitengine\prxConduitEngine.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [WirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AESTFltr] c:\windows\system32\AESTFltr.exe /NoDlg
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.163.182,93.188.166.182
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{C16233F8-F1AB-45C1-A0CB-20638E12A7BF} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer = 93.188.163.182,93.188.166.182
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?client=firefox-a&rls=org.mozilla:en-US:official&channel=s&hl=en&source=hp&biw=1366&bih=578&btnG=Google+Search
FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\extensions\[email protected]\components\RadioWMPCoreGecko19.dll
FF - component: c:\program files\realnetworks\realdownloader\browserplugins\firefox\ext\components\nprndlffbrowserrecordext.dll
FF - component: c:\program files\realnetworks\realdownloader\browserplugins\firefox\ext\components\nprndlffbrowserrecordlegacyext.dll
FF - plugin: c:\documents and settings\administrator\application data\torrentstream\player\npts.dll
FF - plugin: c:\documents and settings\administrator\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\program files\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\program files\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_278.dll
FF - ExtSQL: 2012-12-13 01:15; jid1-m7xzZLMj29zzjA@jetpack; c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\extensions\jid1-m7xzZLMj29zzjA@jetpack
.
============= SERVICES / DRIVERS ===============
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-3-9 242240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]
R2 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2007-12-21 468224]
R2 GS In-Game Service;GS In-Game Service;c:\program files\gametracker\GSInGameService.exe [2011-11-10 1677072]
R2 HWDeviceService.exe;HWDeviceService.exe;c:\documents and settings\all users\application data\datacardservice\HWDeviceService.exe [2011-3-14 271712]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader\rndlresolversvc.exe [2012-3-23 31920]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-11-13 113536]
R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-11-13 209464]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2011-11-15 73216]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
S2 Telenor Internet. RunOuc;Telenor Internet. OUC;c:\program files\telenor internet\updatedog\ouc.exe [2011-11-15 239968]
S3 cpuz135;cpuz135;\??\c:\windows\temp\cpuz135\cpuz135_x32.sys --> c:\windows\temp\cpuz135\cpuz135_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2011-11-15 102784]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2011-11-15 235392]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\futuremark\futuremark systeminfo\FMSISvc.exe [2012-6-24 135584]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys --> c:\windows\system32\drivers\ewusbdev.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
.
=============== File Associations ===============
.
ShellExec: BitComet.exe: open="c:\program files\bitcomet\BitComet.exe"
.
=============== Created Last 30 ================
.
2013-01-10 23:03:47 1758720 ----atw- c:\documents and settings\administrator\application data\microsoft\engine_vx.dll
2013-01-10 23:03:46 29784 ----atw- c:\documents and settings\administrator\application data\microsoft\qwadjb.dll
2013-01-10 23:03:46 18724 ----atw- c:\documents and settings\administrator\application data\microsoft\bass.dll
2013-01-10 23:03:46 17472 ----atw- c:\documents and settings\administrator\application data\microsoft\rsaadjd.dll
2013-01-10 23:03:46 17472 ----atw- c:\documents and settings\administrator\application data\microsoft\1eaadjc.dll
2013-01-10 23:03:46 16448 ----atw- c:\documents and settings\administrator\application data\microsoft\kfgresk.dll
2013-01-10 23:03:46 14456 ----atw- c:\documents and settings\administrator\application data\microsoft\mjcriu.dll
2013-01-10 23:03:46 12352 ----atw- c:\documents and settings\administrator\application data\microsoft\peaadje.dll
2013-01-10 23:03:46 105016 ----atw- c:\documents and settings\administrator\application data\microsoft\~DFK1184cfa2.tmp
2013-01-10 23:01:51 261880 ---ha-w- c:\windows\system32\BytescoutScreenCapturingFilter.dll
2013-01-10 23:01:51 175864 ---ha-w- c:\windows\system32\BytescoutVideoMixerFilter.dll
2013-01-10 23:01:50 421624 ---ha-w- c:\windows\system32\BytescoutScreenCapturing.dll
2013-01-10 23:01:50 -------- d-----w- c:\documents and settings\administrator\application data\Apowersoft
2013-01-10 23:00:54 -------- d-----w- c:\program files\Apowersoft
.
==================== Find3M ====================
.
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: Hitachi_HTS543232L9A300 rev.FB4OC40J -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-4
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A135ECC]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x879e0879; SUB DWORD [EBP-0x4], 0x879e0135; PUSH EDI; CALL 0xffffffffffffdf2c; }
1 ntkrnlpa!IofCallDriver[0x804EEEB8] -> \Device\Harddisk0\DR0[0x8A378AB8]
3 CLASSPNP[0xBA0E905B] -> ntkrnlpa!IofCallDriver[0x804EEEB8] -> \Device\0000007b[0x8A32A520]
5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EEEB8] -> [0x8A328D98]
[0x8A2675F0] -> IRP_MJ_CREATE -> 0x8A135ECC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-4 -> \??\IDE#DiskHitachi_HTS543232L9A300_________________FB4OC40J#393039303730424634433630454c47465638434a#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A135AF1
user & kernel MBR OK
sectors 625142446 (+255): user != kernel
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 0:59:29.79 ===============
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_31
Run by Administrator at 0:58:28 on 2013-01-14
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2039.1123 [GMT 1:00]
.
AV: ESET NOD32 Antivirus 3.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ================
.
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\GameTracker\GSInGameService.exe
C:\Documents and Settings\All Users\Application Data\DatacardService\HWDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Documents and Settings\All Users\Application Data\Telenor Internet\OnlineUpdate\ouc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uURLSearchHooks: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\prxtbBS_0.dll
mWinlogon: TaskMan = c:\documents and settings\administrator\cbzvl.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\conduitengine\prxConduitEngine.dll
BHO: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\prxtbBS_0.dll
TB: BS Player Toolbar: {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - c:\program files\bs_player\prxtbBS_0.dll
TB: BS Player Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - c:\program files\bs_player\prxtbBS_0.dll
TB: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\conduitengine\prxConduitEngine.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [WirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AESTFltr] c:\windows\system32\AESTFltr.exe /NoDlg
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.163.182,93.188.166.182
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{C16233F8-F1AB-45C1-A0CB-20638E12A7BF} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer = 93.188.163.182,93.188.166.182
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?client=firefox-a&rls=org.mozilla:en-US:official&channel=s&hl=en&source=hp&biw=1366&bih=578&btnG=Google+Search
FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\extensions\[email protected]\components\RadioWMPCoreGecko19.dll
FF - component: c:\program files\realnetworks\realdownloader\browserplugins\firefox\ext\components\nprndlffbrowserrecordext.dll
FF - component: c:\program files\realnetworks\realdownloader\browserplugins\firefox\ext\components\nprndlffbrowserrecordlegacyext.dll
FF - plugin: c:\documents and settings\administrator\application data\torrentstream\player\npts.dll
FF - plugin: c:\documents and settings\administrator\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\program files\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\program files\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_278.dll
FF - ExtSQL: 2012-12-13 01:15; jid1-m7xzZLMj29zzjA@jetpack; c:\documents and settings\administrator\application data\mozilla\firefox\profiles\3qc889uv.default\extensions\jid1-m7xzZLMj29zzjA@jetpack
.
============= SERVICES / DRIVERS ===============
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-3-9 242240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]
R2 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2007-12-21 468224]
R2 GS In-Game Service;GS In-Game Service;c:\program files\gametracker\GSInGameService.exe [2011-11-10 1677072]
R2 HWDeviceService.exe;HWDeviceService.exe;c:\documents and settings\all users\application data\datacardservice\HWDeviceService.exe [2011-3-14 271712]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader\rndlresolversvc.exe [2012-3-23 31920]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-11-13 113536]
R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-11-13 209464]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2011-11-15 73216]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
S2 Telenor Internet. RunOuc;Telenor Internet. OUC;c:\program files\telenor internet\updatedog\ouc.exe [2011-11-15 239968]
S3 cpuz135;cpuz135;\??\c:\windows\temp\cpuz135\cpuz135_x32.sys --> c:\windows\temp\cpuz135\cpuz135_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2011-11-15 102784]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2011-11-15 235392]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\futuremark\futuremark systeminfo\FMSISvc.exe [2012-6-24 135584]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys --> c:\windows\system32\drivers\ewusbdev.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
.
=============== File Associations ===============
.
ShellExec: BitComet.exe: open="c:\program files\bitcomet\BitComet.exe"
.
=============== Created Last 30 ================
.
2013-01-10 23:03:47 1758720 ----atw- c:\documents and settings\administrator\application data\microsoft\engine_vx.dll
2013-01-10 23:03:46 29784 ----atw- c:\documents and settings\administrator\application data\microsoft\qwadjb.dll
2013-01-10 23:03:46 18724 ----atw- c:\documents and settings\administrator\application data\microsoft\bass.dll
2013-01-10 23:03:46 17472 ----atw- c:\documents and settings\administrator\application data\microsoft\rsaadjd.dll
2013-01-10 23:03:46 17472 ----atw- c:\documents and settings\administrator\application data\microsoft\1eaadjc.dll
2013-01-10 23:03:46 16448 ----atw- c:\documents and settings\administrator\application data\microsoft\kfgresk.dll
2013-01-10 23:03:46 14456 ----atw- c:\documents and settings\administrator\application data\microsoft\mjcriu.dll
2013-01-10 23:03:46 12352 ----atw- c:\documents and settings\administrator\application data\microsoft\peaadje.dll
2013-01-10 23:03:46 105016 ----atw- c:\documents and settings\administrator\application data\microsoft\~DFK1184cfa2.tmp
2013-01-10 23:01:51 261880 ---ha-w- c:\windows\system32\BytescoutScreenCapturingFilter.dll
2013-01-10 23:01:51 175864 ---ha-w- c:\windows\system32\BytescoutVideoMixerFilter.dll
2013-01-10 23:01:50 421624 ---ha-w- c:\windows\system32\BytescoutScreenCapturing.dll
2013-01-10 23:01:50 -------- d-----w- c:\documents and settings\administrator\application data\Apowersoft
2013-01-10 23:00:54 -------- d-----w- c:\program files\Apowersoft
.
==================== Find3M ====================
.
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: Hitachi_HTS543232L9A300 rev.FB4OC40J -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-4
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A135ECC]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x879e0879; SUB DWORD [EBP-0x4], 0x879e0135; PUSH EDI; CALL 0xffffffffffffdf2c; }
1 ntkrnlpa!IofCallDriver[0x804EEEB8] -> \Device\Harddisk0\DR0[0x8A378AB8]
3 CLASSPNP[0xBA0E905B] -> ntkrnlpa!IofCallDriver[0x804EEEB8] -> \Device\0000007b[0x8A32A520]
5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EEEB8] -> [0x8A328D98]
[0x8A2675F0] -> IRP_MJ_CREATE -> 0x8A135ECC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-4 -> \??\IDE#DiskHitachi_HTS543232L9A300_________________FB4OC40J#393039303730424634433630454c47465638434a#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A135AF1
user & kernel MBR OK
sectors 625142446 (+255): user != kernel
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 0:59:29.79 ===============
#7
Posted 13 January 2013 - 06:03 PM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 5/7/2005 5:24:05 PM
System Uptime: 1/13/2013 5:43:06 PM (7 hours ago)
.
Motherboard: Hewlett-Packard | | 308A
Processor: Intel® Core™2 Duo CPU T5870 @ 2.00GHz | U10 | 1995/200mhz
Processor: Intel® Core™2 Duo CPU T5870 @ 2.00GHz | U10 | 777/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 146 GiB total, 15.02 GiB free.
D: is FIXED (NTFS) - 152 GiB total, 151.531 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ROOT\MEDIA\0000
Manufacturer:
Name:
PNP Device ID: ROOT\MEDIA\0000
Service:
.
==== System Restore Points ===================
.
RP503: 10/13/2012 3:17:06 PM - System Checkpoint
RP504: 10/14/2012 7:08:02 PM - System Checkpoint
RP505: 10/23/2012 6:56:26 PM - System Checkpoint
RP506: 10/28/2012 1:37:20 PM - System Checkpoint
RP507: 11/3/2012 10:36:29 PM - System Checkpoint
RP508: 11/20/2012 6:05:13 PM - System Checkpoint
RP509: 11/22/2012 4:58:54 AM - System Checkpoint
RP510: 11/23/2012 10:09:12 PM - System Checkpoint
RP511: 11/24/2012 11:57:11 PM - System Checkpoint
RP512: 11/26/2012 5:13:33 PM - System Checkpoint
RP513: 11/28/2012 11:57:57 PM - System Checkpoint
RP514: 11/30/2012 12:46:48 AM - System Checkpoint
RP515: 12/9/2012 10:02:41 PM - System Checkpoint
RP516: 12/10/2012 10:58:21 PM - System Checkpoint
RP517: 12/14/2012 4:02:53 PM - System Checkpoint
RP518: 12/19/2012 4:06:56 PM - System Checkpoint
RP519: 12/20/2012 4:07:09 PM - System Checkpoint
RP520: 12/21/2012 7:28:57 PM - System Checkpoint
RP521: 12/23/2012 11:29:09 PM - System Checkpoint
RP522: 12/25/2012 8:42:27 PM - System Checkpoint
RP523: 12/26/2012 10:58:32 PM - System Checkpoint
RP524: 12/28/2012 8:34:01 PM - System Checkpoint
RP525: 12/31/2012 4:26:20 AM - System Checkpoint
RP526: 1/4/2013 1:48:44 AM - System Checkpoint
RP527: 1/7/2013 6:46:08 PM - System Checkpoint
RP528: 1/9/2013 1:00:33 PM - System Checkpoint
RP529: 1/10/2013 4:27:43 PM - System Checkpoint
RP530: 1/12/2013 4:37:02 PM - System Checkpoint
.
==== Installed Programs ======================
.
µTorrent
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.5.2
Adobe Shockwave Player 11.5
Agere Systems HDA Modem
Athens 2004 (v1.0.0)
BitComet 1.17
Broadcom 802.11 Wireless LAN Adapter
BS.Player FREE
BS.Player PRO
BS_Player Toolbar
Call of Duty® 4 - Modern Warfare™
CCleaner
Counter-Strike 1.6
DAEMON Tools Lite
ESET NOD32 Antivirus
FLV Player 2.0 (build 25)
Futuremark SystemInfo
GameSpy Arcade
GameSpy Software
GameTracker Lite
GOM Player
HP Common Access Service Library
HP Integrated Module with Bluetooth wireless technology
HP Quick Launch Buttons 6.50 A1
HP Wireless Assistant
Intel® Graphics Media Accelerator Driver
Java Auto Updater
Java™ 6 Update 31
K-Lite Codec Pack 4.7.5 (Full)
LimeWire 5.4.6
Mafia
Medal of Honor Allied Assault
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 13.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
mts mobilni internet
Nero 7 Ultra Edition
neroxml
NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)
PCSX2 - Playstation 2 Emulator
PowerDVD
PunkBuster Services
RealDownloader
Segoe UI
Skype™ 5.10
SopCast 3.4.8
Streaming Video Recorder V4.2.2
Synaptics Pointing Device Driver
System Requirements Lab CYRI
Telenor Internet
Tool Collection 3
Torrent Stream 1.0.6
Ubisoft Game Launcher
Veetle TV
VLC media player 2.0.0
WebFldrs XP
Winamp
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR archiver
Yahoo! BrowserPlus 2.9.8
.
==== Event Viewer Messages From Past Week ========
.
1/8/2013 3:02:05 AM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
1/7/2013 3:48:55 PM, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).
1/7/2013 3:45:59 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/7/2013 3:43:02 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/7/2013 3:12:49 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Telenor Internet. OUC service to connect.
1/7/2013 3:12:49 PM, error: Service Control Manager [7000] - The Telenor Internet. OUC service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/11/2013 3:44:50 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
1/11/2013 3:44:50 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
1/10/2013 2:52:27 PM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{C16233F8-F1AB-45C1-A0CB-20638E12A7BF} because another computer on the network has the same name. The server could not start.
1/10/2013 2:52:26 PM, error: NetBT [4321] - The name "XP :20" could not be registered on the Interface with IP address 192.168.1.65. The machine with the IP address 192.168.1.71 did not allow the name to be claimed by this machine.
1/10/2013 2:52:26 PM, error: NetBT [4321] - The name "XP :0" could not be registered on the Interface with IP address 192.168.1.65. The machine with the IP address 192.168.1.71 did not allow the name to be claimed by this machine.
.
==== End Of File ===========================
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 5/7/2005 5:24:05 PM
System Uptime: 1/13/2013 5:43:06 PM (7 hours ago)
.
Motherboard: Hewlett-Packard | | 308A
Processor: Intel® Core™2 Duo CPU T5870 @ 2.00GHz | U10 | 1995/200mhz
Processor: Intel® Core™2 Duo CPU T5870 @ 2.00GHz | U10 | 777/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 146 GiB total, 15.02 GiB free.
D: is FIXED (NTFS) - 152 GiB total, 151.531 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ROOT\MEDIA\0000
Manufacturer:
Name:
PNP Device ID: ROOT\MEDIA\0000
Service:
.
==== System Restore Points ===================
.
RP503: 10/13/2012 3:17:06 PM - System Checkpoint
RP504: 10/14/2012 7:08:02 PM - System Checkpoint
RP505: 10/23/2012 6:56:26 PM - System Checkpoint
RP506: 10/28/2012 1:37:20 PM - System Checkpoint
RP507: 11/3/2012 10:36:29 PM - System Checkpoint
RP508: 11/20/2012 6:05:13 PM - System Checkpoint
RP509: 11/22/2012 4:58:54 AM - System Checkpoint
RP510: 11/23/2012 10:09:12 PM - System Checkpoint
RP511: 11/24/2012 11:57:11 PM - System Checkpoint
RP512: 11/26/2012 5:13:33 PM - System Checkpoint
RP513: 11/28/2012 11:57:57 PM - System Checkpoint
RP514: 11/30/2012 12:46:48 AM - System Checkpoint
RP515: 12/9/2012 10:02:41 PM - System Checkpoint
RP516: 12/10/2012 10:58:21 PM - System Checkpoint
RP517: 12/14/2012 4:02:53 PM - System Checkpoint
RP518: 12/19/2012 4:06:56 PM - System Checkpoint
RP519: 12/20/2012 4:07:09 PM - System Checkpoint
RP520: 12/21/2012 7:28:57 PM - System Checkpoint
RP521: 12/23/2012 11:29:09 PM - System Checkpoint
RP522: 12/25/2012 8:42:27 PM - System Checkpoint
RP523: 12/26/2012 10:58:32 PM - System Checkpoint
RP524: 12/28/2012 8:34:01 PM - System Checkpoint
RP525: 12/31/2012 4:26:20 AM - System Checkpoint
RP526: 1/4/2013 1:48:44 AM - System Checkpoint
RP527: 1/7/2013 6:46:08 PM - System Checkpoint
RP528: 1/9/2013 1:00:33 PM - System Checkpoint
RP529: 1/10/2013 4:27:43 PM - System Checkpoint
RP530: 1/12/2013 4:37:02 PM - System Checkpoint
.
==== Installed Programs ======================
.
µTorrent
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.5.2
Adobe Shockwave Player 11.5
Agere Systems HDA Modem
Athens 2004 (v1.0.0)
BitComet 1.17
Broadcom 802.11 Wireless LAN Adapter
BS.Player FREE
BS.Player PRO
BS_Player Toolbar
Call of Duty® 4 - Modern Warfare™
CCleaner
Counter-Strike 1.6
DAEMON Tools Lite
ESET NOD32 Antivirus
FLV Player 2.0 (build 25)
Futuremark SystemInfo
GameSpy Arcade
GameSpy Software
GameTracker Lite
GOM Player
HP Common Access Service Library
HP Integrated Module with Bluetooth wireless technology
HP Quick Launch Buttons 6.50 A1
HP Wireless Assistant
Intel® Graphics Media Accelerator Driver
Java Auto Updater
Java™ 6 Update 31
K-Lite Codec Pack 4.7.5 (Full)
LimeWire 5.4.6
Mafia
Medal of Honor Allied Assault
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 13.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
mts mobilni internet
Nero 7 Ultra Edition
neroxml
NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)
PCSX2 - Playstation 2 Emulator
PowerDVD
PunkBuster Services
RealDownloader
Segoe UI
Skype™ 5.10
SopCast 3.4.8
Streaming Video Recorder V4.2.2
Synaptics Pointing Device Driver
System Requirements Lab CYRI
Telenor Internet
Tool Collection 3
Torrent Stream 1.0.6
Ubisoft Game Launcher
Veetle TV
VLC media player 2.0.0
WebFldrs XP
Winamp
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR archiver
Yahoo! BrowserPlus 2.9.8
.
==== Event Viewer Messages From Past Week ========
.
1/8/2013 3:02:05 AM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
1/7/2013 3:48:55 PM, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).
1/7/2013 3:45:59 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/7/2013 3:43:02 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/7/2013 3:12:49 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Telenor Internet. OUC service to connect.
1/7/2013 3:12:49 PM, error: Service Control Manager [7000] - The Telenor Internet. OUC service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/11/2013 3:44:50 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
1/11/2013 3:44:50 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
1/10/2013 2:52:27 PM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{C16233F8-F1AB-45C1-A0CB-20638E12A7BF} because another computer on the network has the same name. The server could not start.
1/10/2013 2:52:26 PM, error: NetBT [4321] - The name "XP :20" could not be registered on the Interface with IP address 192.168.1.65. The machine with the IP address 192.168.1.71 did not allow the name to be claimed by this machine.
1/10/2013 2:52:26 PM, error: NetBT [4321] - The name "XP :0" could not be registered on the Interface with IP address 192.168.1.65. The machine with the IP address 192.168.1.71 did not allow the name to be claimed by this machine.
.
==== End Of File ===========================
#8
Posted 13 January 2013 - 06:04 PM
gringo_pr
-
- Malware Removal
-
- 7,268 posts
Trusted Helper
Hello
These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.
-AdwCleaner-
--RogueKiller--
Gringo
These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.
-AdwCleaner-
- Please download AdwCleaner by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Delete.
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
--RogueKiller--
- Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+
Gringo
#9
Posted 13 January 2013 - 06:04 PM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
These are all the results.
#10
Posted 13 January 2013 - 06:06 PM
gringo_pr
-
- Malware Removal
-
- 7,268 posts
Trusted Helper
Hello
These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.
-AdwCleaner-
--RogueKiller--
Gringo
These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.
-AdwCleaner-
- Please download AdwCleaner by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Delete.
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
--RogueKiller--
- Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+
Gringo
#11
Posted 13 January 2013 - 06:25 PM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
So what you recommend to run?
Adw cleaner or Rogue killer?
Adw cleaner or Rogue killer?
#12
Posted 13 January 2013 - 07:12 PM
gringo_pr
-
- Malware Removal
-
- 7,268 posts
Trusted Helper
I want you to run both and send me the reports
#13
Posted 14 January 2013 - 09:18 AM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
# AdwCleaner v2.105 - Logfile created 01/14/2013 at 15:57:16
# Updated 08/01/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 2 (32 bits)
# User : Administrator - XP
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Administrator\My Documents\Downloads\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
File Deleted : C:\WINDOWS\system32\conduitEngine.tmp
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\Conduit
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\ConduitCommon
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\ConduitEngine
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\CT1750559
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\extensions\[email protected]
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\extensions\vshare@toolbar
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\BS_Player
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\ConduitEngine
Folder Deleted : C:\Program Files\BS_Player
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\ConduitEngine
***** [Registry] *****
Key Deleted : HKCU\Software\BS_Player
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\conduitEngine
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\Software\BS_Player
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{356583E3-64A5-450D-9269-CB9FF76F41F3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{38FFCF12-88E6-4882-AF1F-6FA0BEFA5310}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B799D2EF-9910-43E2-8670-186DE6DA92D1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT1750559
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{400D3D13-92BE-4192-873E-B63366B2B7E8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62ED52D0-1581-4D28-A035-C46593EFB8F7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{782D9D73-4D31-442B-A6BE-EF548A84B90C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BS_Player Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{356583E3-64A5-450D-9269-CB9FF76F41F3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BS_Player Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}]
***** [Internet Browsers] *****
-\\ Internet Explorer v7.0.5730.11
[OK] Registry is clean.
-\\ Mozilla Firefox v13.0.1 (en-US)
File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\prefs.js
Deleted : user_pref("CT1750559..clientLogIsEnabled", false);
Deleted : user_pref("CT1750559..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT1750559..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT1750559.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT1750559.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT1750559.AppTrackingLastCheckTime", "Sun May 15 2011 03:19:41 GMT+0200 (Central Europe D[...]
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129495727276863004", true);
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129502713039250930", true);
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129544988592463877", true);
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129634080503807015", true);
Deleted : user_pref("CT1750559.CTID", "CT1750559");
Deleted : user_pref("CT1750559.CurrentServerDate", "18-7-2012");
Deleted : user_pref("CT1750559.DialogsAlignMode", "LTR");
Deleted : user_pref("CT1750559.DialogsGetterLastCheckTime", "Wed Jul 18 2012 08:50:01 GMT+0200 (Central Europe[...]
Deleted : user_pref("CT1750559.DownloadReferralCookieData", "");
Deleted : user_pref("CT1750559.FirstServerDate", "7-9-2010");
Deleted : user_pref("CT1750559.FirstTime", true);
Deleted : user_pref("CT1750559.FirstTimeFF3", true);
Deleted : user_pref("CT1750559.FixPageNotFoundErrors", true);
Deleted : user_pref("CT1750559.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT1750559.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT1750559.HasUserGlobalKeys", true);
Deleted : user_pref("CT1750559.Initialize", true);
Deleted : user_pref("CT1750559.InitializeCommonPrefs", true);
Deleted : user_pref("CT1750559.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT1750559.InstallationType", "Unknown");
Deleted : user_pref("CT1750559.InstalledDate", "Tue Sep 07 2010 07:17:00 GMT+0200 (Central Europe Daylight Tim[...]
Deleted : user_pref("CT1750559.InvalidateCache", false);
Deleted : user_pref("CT1750559.IsGrouping", false);
Deleted : user_pref("CT1750559.IsMulticommunity", false);
Deleted : user_pref("CT1750559.IsOpenThankYouPage", true);
Deleted : user_pref("CT1750559.IsOpenUninstallPage", true);
Deleted : user_pref("CT1750559.LanguagePackLastCheckTime", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central Europe [...]
Deleted : user_pref("CT1750559.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT1750559.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT1750559.LastLogin_2.5.6.0", "Tue Sep 07 2010 07:17:01 GMT+0200 (Central Europe Daylight[...]
Deleted : user_pref("CT1750559.LastLogin_3.12.2.3", "Sun Jun 03 2012 22:40:34 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.LastLogin_3.13.0.6", "Sun Jul 01 2012 10:46:08 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.LastLogin_3.14.1.0", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.LastLogin_3.3.3.2", "Sun May 15 2011 03:19:31 GMT+0200 (Central Europe Daylight[...]
Deleted : user_pref("CT1750559.LatestVersion", "3.13.0.6");
Deleted : user_pref("CT1750559.Locale", "en-us");
Deleted : user_pref("CT1750559.LoginCache", 4);
Deleted : user_pref("CT1750559.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT1750559.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT1750559.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT1750559.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT1750559.RadioIsPodcast", false);
Deleted : user_pref("CT1750559.RadioLastCheckTime", "Sun May 15 2011 03:19:30 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT1750559.RadioLastUpdateServer", "128929877726170000");
Deleted : user_pref("CT1750559.RadioMediaID", "11237206");
Deleted : user_pref("CT1750559.RadioMediaType", "Media Player");
Deleted : user_pref("CT1750559.RadioMenuSelectedID", "EBRadioMenu_CT175055911237206");
Deleted : user_pref("CT1750559.RadioStationName", "1.FM%20Dance");
Deleted : user_pref("CT1750559.RadioStationURL", "hxxp://dance.1.fm/energydance128k?MSWMExt=.asf");
Deleted : user_pref("CT1750559.SHRINK_TOOLBAR", 1);
Deleted : user_pref("CT1750559.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Deleted : user_pref("CT1750559.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT1750559.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT175[...]
Deleted : user_pref("CT1750559.SearchInNewTabEnabled", true);
Deleted : user_pref("CT1750559.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT1750559.SearchInNewTabLastCheckTime", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central Europ[...]
Deleted : user_pref("CT1750559.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT1750559.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Deleted : user_pref("CT1750559.SearchProtectorToolbarDisabled", true);
Deleted : user_pref("CT1750559.ServiceMapLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+0200 (Central Europe Da[...]
Deleted : user_pref("CT1750559.SettingsCheckIntervalMin", 120);
Deleted : user_pref("CT1750559.SettingsLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+0200 (Central Europe Dayl[...]
Deleted : user_pref("CT1750559.SettingsLastUpdate", "1342340890");
Deleted : user_pref("CT1750559.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT1750559.ThirdPartyComponentsLastCheck", "Sun May 15 2011 03:19:30 GMT+0200 (Central Eur[...]
Deleted : user_pref("CT1750559.ThirdPartyComponentsLastUpdate", "1246790578");
Deleted : user_pref("CT1750559.ToolbarDisabled", false);
Deleted : user_pref("CT1750559.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1750559");
Deleted : user_pref("CT1750559.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT1750559.UserID", "UN75053644231071163");
Deleted : user_pref("CT1750559.WeatherNetwork", "");
Deleted : user_pref("CT1750559.WeatherPollDate", "Sun May 15 2011 03:19:31 GMT+0200 (Central Europe Daylight T[...]
Deleted : user_pref("CT1750559.WeatherUnit", "C");
Deleted : user_pref("CT1750559.alertChannelId", "31130");
Deleted : user_pref("CT1750559.backendstorage. amazon_dailyactivity", "31333035343232333733383131");
Deleted : user_pref("CT1750559.backendstorage. amazon_lifetimesent", "54525545");
Deleted : user_pref("CT1750559.backendstorage.amazonnew_all", "323432363738312C323632383039312C323632383337312[...]
Deleted : user_pref("CT1750559.backendstorage.appbuttondisablenull", "30");
Deleted : user_pref("CT1750559.backendstorage.twitter_v1.8.0_twitter_app_open_t_f", "66616C7365");
Deleted : user_pref("CT1750559.backendstorage.twitter_v1.9.0_twitter_app_open_t_f", "66616C7365");
Deleted : user_pref("CT1750559.clientLogIsEnabled", true);
Deleted : user_pref("CT1750559.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Deleted : user_pref("CT1750559.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT1750559.globalFirstTimeInfoLastCheckTime", "Sun May 15 2011 03:19:31 GMT+0200 (Central [...]
Deleted : user_pref("CT1750559.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT1750559.initDone", true);
Deleted : user_pref("CT1750559.isAppTrackingManagerOn", true);
Deleted : user_pref("CT1750559.myStuffEnabled", true);
Deleted : user_pref("CT1750559.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT1750559.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT1750559.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT1750559.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT1750559.oldAppsList", "128515954179600320,128520273115419467,128799492822006721,1287994[...]
Deleted : user_pref("CT1750559.revertSettingsEnabled", true);
Deleted : user_pref("CT1750559.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT1750559.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT1750559.testingCtid", "");
Deleted : user_pref("CT1750559.toolbarAppMetaDataLastCheckTime", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central E[...]
Deleted : user_pref("CT1750559.toolbarContextMenuLastCheckTime", "Sun May 15 2011 03:19:31 GMT+0200 (Central E[...]
Deleted : user_pref("CT1750559.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Deleted : user_pref("CT1750559.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.CantToolbarBeEngineOwner", "CT1750559");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT1750559/CT1750559[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/ME", "\"0\"")[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1750559", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1750559",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT1750559/CT1750559[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
Deleted : user_pref("CommunityToolbar.EngineHiddenByUser", true);
Deleted : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");
Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "[email protected]");
Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");
Deleted : user_pref("CommunityToolbar.IsEngineShown", false);
Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "ConduitEngine");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "[email protected]");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "conduitengine");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT1750559,ConduitEngine");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT1750559");
Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+02[...]
Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Wed Jul 18 2012 08:50:05 GMT+0200 (Centr[...]
Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.locale", "en");
Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+0200 (Central E[...]
Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.alert.userId", "5e0e8448-779c-405e-a845-53a2305ecfb8");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun May 15 2011 03:19:32 GMT+0200 (Cen[...]
Deleted : user_pref("CommunityToolbar.globalUserId", "1943bcbf-ec9e-4a1e-8535-3cbd7ee8af46");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Wed Jul 18 2012 08:50:09 GMT+0200 (Central Euro[...]
Deleted : user_pref("ConduitEngine.CTID", "ConduitEngine");
Deleted : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Sun May 15 2011 03:12:19 GMT+0200 (Central Eu[...]
Deleted : user_pref("ConduitEngine.FirstServerDate", "05/15/2011 04");
Deleted : user_pref("ConduitEngine.FirstTime", true);
Deleted : user_pref("ConduitEngine.FirstTimeFF3", true);
Deleted : user_pref("ConduitEngine.HasUserGlobalKeys", true);
Deleted : user_pref("ConduitEngine.Initialize", true);
Deleted : user_pref("ConduitEngine.InitializeCommonPrefs", true);
Deleted : user_pref("ConduitEngine.InstalledDate", "Sun May 15 2011 03:12:20 GMT+0200 (Central Europe Daylight[...]
Deleted : user_pref("ConduitEngine.IsMulticommunity", false);
Deleted : user_pref("ConduitEngine.IsOpenThankYouPage", false);
Deleted : user_pref("ConduitEngine.IsOpenUninstallPage", true);
Deleted : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Central Eur[...]
Deleted : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Sun May 15 2011 03:12:18 GMT+0200 (Central Europe Dayl[...]
Deleted : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
Deleted : user_pref("ConduitEngine.SettingsLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Central Europe [...]
Deleted : user_pref("ConduitEngine.UserID", "UN32771441095555753");
Deleted : user_pref("ConduitEngine.componentAlertEnabled", false);
Deleted : user_pref("ConduitEngine.engineLocale", "en-US");
Deleted : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Centr[...]
Deleted : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Cent[...]
Deleted : user_pref("ConduitEngine.initDone", true);
Deleted : user_pref("ConduitEngine.isAppTrackingManagerOn", true);
Deleted : user_pref("[email protected]", true);
Deleted : user_pref("[email protected]", true);
Deleted : user_pref("[email protected]", true);
Deleted : user_pref("vshare.install.date", "1282608000000");
Deleted : user_pref("vshare.install.finished", "1.0.0");
Deleted : user_pref("vshare.install.guid", "{fa70b992-82c3-4f81-a7d9-47a2023804e6}");
Deleted : user_pref("vshare.install.isHidden", true);
Deleted : user_pref("vshare.install.laststatreq", "1342569600000");
Deleted : user_pref("vshare.install.newtab", false);
*************************
AdwCleaner[S1].txt - [21499 octets] - [14/01/2013 15:57:16]
########## EOF - C:\AdwCleaner[S1].txt - [21560 octets] ##########
# Updated 08/01/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 2 (32 bits)
# User : Administrator - XP
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Administrator\My Documents\Downloads\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
File Deleted : C:\WINDOWS\system32\conduitEngine.tmp
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\Conduit
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\ConduitCommon
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\ConduitEngine
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\CT1750559
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\extensions\[email protected]
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\extensions\vshare@toolbar
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\BS_Player
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\ConduitEngine
Folder Deleted : C:\Program Files\BS_Player
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\ConduitEngine
***** [Registry] *****
Key Deleted : HKCU\Software\BS_Player
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\conduitEngine
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\Software\BS_Player
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{356583E3-64A5-450D-9269-CB9FF76F41F3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{38FFCF12-88E6-4882-AF1F-6FA0BEFA5310}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B799D2EF-9910-43E2-8670-186DE6DA92D1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT1750559
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{400D3D13-92BE-4192-873E-B63366B2B7E8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62ED52D0-1581-4D28-A035-C46593EFB8F7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{782D9D73-4D31-442B-A6BE-EF548A84B90C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BS_Player Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{356583E3-64A5-450D-9269-CB9FF76F41F3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BS_Player Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}]
***** [Internet Browsers] *****
-\\ Internet Explorer v7.0.5730.11
[OK] Registry is clean.
-\\ Mozilla Firefox v13.0.1 (en-US)
File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3qc889uv.default\prefs.js
Deleted : user_pref("CT1750559..clientLogIsEnabled", false);
Deleted : user_pref("CT1750559..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT1750559..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT1750559.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT1750559.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT1750559.AppTrackingLastCheckTime", "Sun May 15 2011 03:19:41 GMT+0200 (Central Europe D[...]
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129495727276863004", true);
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129502713039250930", true);
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129544988592463877", true);
Deleted : user_pref("CT1750559.BrowserCompStateIsOpen_129634080503807015", true);
Deleted : user_pref("CT1750559.CTID", "CT1750559");
Deleted : user_pref("CT1750559.CurrentServerDate", "18-7-2012");
Deleted : user_pref("CT1750559.DialogsAlignMode", "LTR");
Deleted : user_pref("CT1750559.DialogsGetterLastCheckTime", "Wed Jul 18 2012 08:50:01 GMT+0200 (Central Europe[...]
Deleted : user_pref("CT1750559.DownloadReferralCookieData", "");
Deleted : user_pref("CT1750559.FirstServerDate", "7-9-2010");
Deleted : user_pref("CT1750559.FirstTime", true);
Deleted : user_pref("CT1750559.FirstTimeFF3", true);
Deleted : user_pref("CT1750559.FixPageNotFoundErrors", true);
Deleted : user_pref("CT1750559.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT1750559.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT1750559.HasUserGlobalKeys", true);
Deleted : user_pref("CT1750559.Initialize", true);
Deleted : user_pref("CT1750559.InitializeCommonPrefs", true);
Deleted : user_pref("CT1750559.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT1750559.InstallationType", "Unknown");
Deleted : user_pref("CT1750559.InstalledDate", "Tue Sep 07 2010 07:17:00 GMT+0200 (Central Europe Daylight Tim[...]
Deleted : user_pref("CT1750559.InvalidateCache", false);
Deleted : user_pref("CT1750559.IsGrouping", false);
Deleted : user_pref("CT1750559.IsMulticommunity", false);
Deleted : user_pref("CT1750559.IsOpenThankYouPage", true);
Deleted : user_pref("CT1750559.IsOpenUninstallPage", true);
Deleted : user_pref("CT1750559.LanguagePackLastCheckTime", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central Europe [...]
Deleted : user_pref("CT1750559.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT1750559.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT1750559.LastLogin_2.5.6.0", "Tue Sep 07 2010 07:17:01 GMT+0200 (Central Europe Daylight[...]
Deleted : user_pref("CT1750559.LastLogin_3.12.2.3", "Sun Jun 03 2012 22:40:34 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.LastLogin_3.13.0.6", "Sun Jul 01 2012 10:46:08 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.LastLogin_3.14.1.0", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.LastLogin_3.3.3.2", "Sun May 15 2011 03:19:31 GMT+0200 (Central Europe Daylight[...]
Deleted : user_pref("CT1750559.LatestVersion", "3.13.0.6");
Deleted : user_pref("CT1750559.Locale", "en-us");
Deleted : user_pref("CT1750559.LoginCache", 4);
Deleted : user_pref("CT1750559.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT1750559.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT1750559.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT1750559.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT1750559.RadioIsPodcast", false);
Deleted : user_pref("CT1750559.RadioLastCheckTime", "Sun May 15 2011 03:19:30 GMT+0200 (Central Europe Dayligh[...]
Deleted : user_pref("CT1750559.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT1750559.RadioLastUpdateServer", "128929877726170000");
Deleted : user_pref("CT1750559.RadioMediaID", "11237206");
Deleted : user_pref("CT1750559.RadioMediaType", "Media Player");
Deleted : user_pref("CT1750559.RadioMenuSelectedID", "EBRadioMenu_CT175055911237206");
Deleted : user_pref("CT1750559.RadioStationName", "1.FM%20Dance");
Deleted : user_pref("CT1750559.RadioStationURL", "hxxp://dance.1.fm/energydance128k?MSWMExt=.asf");
Deleted : user_pref("CT1750559.SHRINK_TOOLBAR", 1);
Deleted : user_pref("CT1750559.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Deleted : user_pref("CT1750559.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT1750559.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT175[...]
Deleted : user_pref("CT1750559.SearchInNewTabEnabled", true);
Deleted : user_pref("CT1750559.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT1750559.SearchInNewTabLastCheckTime", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central Europ[...]
Deleted : user_pref("CT1750559.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT1750559.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Deleted : user_pref("CT1750559.SearchProtectorToolbarDisabled", true);
Deleted : user_pref("CT1750559.ServiceMapLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+0200 (Central Europe Da[...]
Deleted : user_pref("CT1750559.SettingsCheckIntervalMin", 120);
Deleted : user_pref("CT1750559.SettingsLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+0200 (Central Europe Dayl[...]
Deleted : user_pref("CT1750559.SettingsLastUpdate", "1342340890");
Deleted : user_pref("CT1750559.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT1750559.ThirdPartyComponentsLastCheck", "Sun May 15 2011 03:19:30 GMT+0200 (Central Eur[...]
Deleted : user_pref("CT1750559.ThirdPartyComponentsLastUpdate", "1246790578");
Deleted : user_pref("CT1750559.ToolbarDisabled", false);
Deleted : user_pref("CT1750559.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1750559");
Deleted : user_pref("CT1750559.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT1750559.UserID", "UN75053644231071163");
Deleted : user_pref("CT1750559.WeatherNetwork", "");
Deleted : user_pref("CT1750559.WeatherPollDate", "Sun May 15 2011 03:19:31 GMT+0200 (Central Europe Daylight T[...]
Deleted : user_pref("CT1750559.WeatherUnit", "C");
Deleted : user_pref("CT1750559.alertChannelId", "31130");
Deleted : user_pref("CT1750559.backendstorage. amazon_dailyactivity", "31333035343232333733383131");
Deleted : user_pref("CT1750559.backendstorage. amazon_lifetimesent", "54525545");
Deleted : user_pref("CT1750559.backendstorage.amazonnew_all", "323432363738312C323632383039312C323632383337312[...]
Deleted : user_pref("CT1750559.backendstorage.appbuttondisablenull", "30");
Deleted : user_pref("CT1750559.backendstorage.twitter_v1.8.0_twitter_app_open_t_f", "66616C7365");
Deleted : user_pref("CT1750559.backendstorage.twitter_v1.9.0_twitter_app_open_t_f", "66616C7365");
Deleted : user_pref("CT1750559.clientLogIsEnabled", true);
Deleted : user_pref("CT1750559.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Deleted : user_pref("CT1750559.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT1750559.globalFirstTimeInfoLastCheckTime", "Sun May 15 2011 03:19:31 GMT+0200 (Central [...]
Deleted : user_pref("CT1750559.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT1750559.initDone", true);
Deleted : user_pref("CT1750559.isAppTrackingManagerOn", true);
Deleted : user_pref("CT1750559.myStuffEnabled", true);
Deleted : user_pref("CT1750559.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT1750559.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT1750559.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT1750559.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT1750559.oldAppsList", "128515954179600320,128520273115419467,128799492822006721,1287994[...]
Deleted : user_pref("CT1750559.revertSettingsEnabled", true);
Deleted : user_pref("CT1750559.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT1750559.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT1750559.testingCtid", "");
Deleted : user_pref("CT1750559.toolbarAppMetaDataLastCheckTime", "Wed Jul 18 2012 08:49:59 GMT+0200 (Central E[...]
Deleted : user_pref("CT1750559.toolbarContextMenuLastCheckTime", "Sun May 15 2011 03:19:31 GMT+0200 (Central E[...]
Deleted : user_pref("CT1750559.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Deleted : user_pref("CT1750559.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.CantToolbarBeEngineOwner", "CT1750559");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT1750559/CT1750559[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/ME", "\"0\"")[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1750559", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1750559",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT1750559/CT1750559[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
Deleted : user_pref("CommunityToolbar.EngineHiddenByUser", true);
Deleted : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");
Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "[email protected]");
Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");
Deleted : user_pref("CommunityToolbar.IsEngineShown", false);
Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "ConduitEngine");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "[email protected]");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "conduitengine");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT1750559,ConduitEngine");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT1750559");
Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+02[...]
Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Wed Jul 18 2012 08:50:05 GMT+0200 (Centr[...]
Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.locale", "en");
Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Wed Jul 18 2012 08:49:56 GMT+0200 (Central E[...]
Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.alert.userId", "5e0e8448-779c-405e-a845-53a2305ecfb8");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun May 15 2011 03:19:32 GMT+0200 (Cen[...]
Deleted : user_pref("CommunityToolbar.globalUserId", "1943bcbf-ec9e-4a1e-8535-3cbd7ee8af46");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Wed Jul 18 2012 08:50:09 GMT+0200 (Central Euro[...]
Deleted : user_pref("ConduitEngine.CTID", "ConduitEngine");
Deleted : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Sun May 15 2011 03:12:19 GMT+0200 (Central Eu[...]
Deleted : user_pref("ConduitEngine.FirstServerDate", "05/15/2011 04");
Deleted : user_pref("ConduitEngine.FirstTime", true);
Deleted : user_pref("ConduitEngine.FirstTimeFF3", true);
Deleted : user_pref("ConduitEngine.HasUserGlobalKeys", true);
Deleted : user_pref("ConduitEngine.Initialize", true);
Deleted : user_pref("ConduitEngine.InitializeCommonPrefs", true);
Deleted : user_pref("ConduitEngine.InstalledDate", "Sun May 15 2011 03:12:20 GMT+0200 (Central Europe Daylight[...]
Deleted : user_pref("ConduitEngine.IsMulticommunity", false);
Deleted : user_pref("ConduitEngine.IsOpenThankYouPage", false);
Deleted : user_pref("ConduitEngine.IsOpenUninstallPage", true);
Deleted : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Central Eur[...]
Deleted : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Sun May 15 2011 03:12:18 GMT+0200 (Central Europe Dayl[...]
Deleted : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
Deleted : user_pref("ConduitEngine.SettingsLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Central Europe [...]
Deleted : user_pref("ConduitEngine.UserID", "UN32771441095555753");
Deleted : user_pref("ConduitEngine.componentAlertEnabled", false);
Deleted : user_pref("ConduitEngine.engineLocale", "en-US");
Deleted : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Centr[...]
Deleted : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Sun May 15 2011 03:12:18 GMT+0200 (Cent[...]
Deleted : user_pref("ConduitEngine.initDone", true);
Deleted : user_pref("ConduitEngine.isAppTrackingManagerOn", true);
Deleted : user_pref("[email protected]", true);
Deleted : user_pref("[email protected]", true);
Deleted : user_pref("[email protected]", true);
Deleted : user_pref("vshare.install.date", "1282608000000");
Deleted : user_pref("vshare.install.finished", "1.0.0");
Deleted : user_pref("vshare.install.guid", "{fa70b992-82c3-4f81-a7d9-47a2023804e6}");
Deleted : user_pref("vshare.install.isHidden", true);
Deleted : user_pref("vshare.install.laststatreq", "1342569600000");
Deleted : user_pref("vshare.install.newtab", false);
*************************
AdwCleaner[S1].txt - [21499 octets] - [14/01/2013 15:57:16]
########## EOF - C:\AdwCleaner[S1].txt - [21560 octets] ##########
#14
Posted 14 January 2013 - 09:23 AM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
When i ran Rogue killer i got 2 reports not 1.
Here they are :
RogueKiller V8.4.3 [Jan 10 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Normal mode
User : Administrator [Admin rights]
Mode : Scan -- Date : 01/14/2013 16:03:49
¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] ouc.exe -- C:\Documents and Settings\All Users\Application Data\Telenor Internet\OnlineUpdate\ouc.exe -> KILLED [TermProc]
¤¤¤ Registry Entries : 6 ¤¤¤
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
IRP[DriverStartIo] : atapi.sys -> HOOKED ([MAJOR] Unknown @ 0x8A13DAF1)
¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 9576a7729d76caa64a86e8098e910319
[BSP] 4d72f6b35ec96e6ad37578ccc1652806 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 149997 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 307194930 | Size: 155237 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_01142013_02d1603.txt >>
RKreport[1]_S_01142013_02d1603.txt
Here they are :
RogueKiller V8.4.3 [Jan 10 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Normal mode
User : Administrator [Admin rights]
Mode : Scan -- Date : 01/14/2013 16:03:49
¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] ouc.exe -- C:\Documents and Settings\All Users\Application Data\Telenor Internet\OnlineUpdate\ouc.exe -> KILLED [TermProc]
¤¤¤ Registry Entries : 6 ¤¤¤
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> FOUND
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
IRP[DriverStartIo] : atapi.sys -> HOOKED ([MAJOR] Unknown @ 0x8A13DAF1)
¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 9576a7729d76caa64a86e8098e910319
[BSP] 4d72f6b35ec96e6ad37578ccc1652806 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 149997 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 307194930 | Size: 155237 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_01142013_02d1603.txt >>
RKreport[1]_S_01142013_02d1603.txt
#15
Posted 14 January 2013 - 09:23 AM
Lukka09
- Topic Starter
-
- Member
-
- 40 posts
Member
RogueKiller V8.4.3 [Jan 10 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Normal mode
User : Administrator [Admin rights]
Mode : Remove -- Date : 01/14/2013 16:04:23
¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] ouc.exe -- C:\Documents and Settings\All Users\Application Data\Telenor Internet\OnlineUpdate\ouc.exe -> KILLED [TermProc]
¤¤¤ Registry Entries : 6 ¤¤¤
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
IRP[DriverStartIo] : atapi.sys -> HOOKED ([MAJOR] Unknown @ 0x8A13DAF1)
¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 9576a7729d76caa64a86e8098e910319
[BSP] 4d72f6b35ec96e6ad37578ccc1652806 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 149997 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 307194930 | Size: 155237 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[2]_D_01142013_02d1604.txt >>
RKreport[1]_S_01142013_02d1603.txt ; RKreport[2]_D_01142013_02d1604.txt
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Normal mode
User : Administrator [Admin rights]
Mode : Remove -- Date : 01/14/2013 16:04:23
¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] ouc.exe -- C:\Documents and Settings\All Users\Application Data\Telenor Internet\OnlineUpdate\ouc.exe -> KILLED [TermProc]
¤¤¤ Registry Entries : 6 ¤¤¤
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Parameters : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{EE8A4DD6-BACA-4945-B441-540906D6D850} : NameServer (93.188.163.182,93.188.166.182) -> NOT REMOVED, USE DNSFIX
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
IRP[DriverStartIo] : atapi.sys -> HOOKED ([MAJOR] Unknown @ 0x8A13DAF1)
¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 9576a7729d76caa64a86e8098e910319
[BSP] 4d72f6b35ec96e6ad37578ccc1652806 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 149997 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 307194930 | Size: 155237 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[2]_D_01142013_02d1604.txt >>
RKreport[1]_S_01142013_02d1603.txt ; RKreport[2]_D_01142013_02d1604.txt
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
