Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

computer has system care antivirus and I want it gone [Solved]

Started by mbowli_nc392 , Apr 10 2013 12:09 AM

  • This topic is locked This topic is locked

#1
mbowli_nc392
Posted 10 April 2013 - 12:09 AM

mbowli_nc392

    New Member

  • Member
  • Pip
  • 6 posts
OTL logfile created on: 4/10/2013 2:04:08 AM - Run 7
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Auser\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.96 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 54.34% Memory free
3.81 Gb Paging File | 3.07 Gb Available in Paging File | 80.43% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 220.72 Gb Free Space | 94.78% Space Free | Partition Type: NTFS

Computer Name: CHOICENODE | User Name: Auser | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Auser\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Auser\Application Data\DefaultTab\DefaultTab\DTUpdate.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\dkabcoms.exe ( )
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\WINDOWS\RTDCPL.EXE (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe ()
PRC - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Auser\Application Data\DefaultTab\DefaultTab\DTUpdate.exe ()
MOD - C:\WINDOWS\system32\mmcppubw.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanDll.dll ()
MOD - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe ()
MOD - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe ()


========== Services (SafeList) ==========

SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (DefaultTabUpdate) -- C:\Documents and Settings\Auser\Application Data\DefaultTab\DefaultTab\DTUpdate.exe ()
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (Norton PC Checkup Application Launcher) -- C:\Program Files\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) -- C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe (McAfee, Inc.)
SRV - (SmcService) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
SRV - (dkab_device) -- C:\WINDOWS\system32\dkabcoms.exe ( )
SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SRV - (SNAC) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (Symantec Corporation)
SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (SiSWLSvc) -- C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe ()


========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (cerc6) -- File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (mbamchameleon) -- C:\WINDOWS\system32\drivers\mbamchameleon.sys ()
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20130409.009\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20130409.009\NAVENG.SYS (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SRTSPL) -- C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSPX) -- C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SPBBCDrv) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (CmtlPort) -- C:\WINDOWS\system32\drivers\rp2cport.sys (Comtrol Corporation)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtDHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RcktPort) -- C:\WINDOWS\system32\drivers\rp2.sys (Comtrol Corporation)
DRV - (SYMTDI) -- C:\WINDOWS\system32\drivers\symtdi.sys (Symantec Corporation)
DRV - (SYMREDRV) -- C:\WINDOWS\system32\drivers\symredrv.sys (Symantec Corporation)
DRV - (k57w2k) -- C:\WINDOWS\system32\drivers\k57xp32.sys (Broadcom Corporation)
DRV - (Blfp) -- C:\WINDOWS\system32\drivers\baspxp32.sys (Broadcom Corporation)
DRV - (SIS163u) -- C:\WINDOWS\system32\drivers\sis163u.sys (SiS Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=OIE8HP&PC=UP50
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpa...D-782BCBA57060}
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://start.sweetpa...D-782BCBA57060}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=OIE8HP&PC=UP50
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpa...D-782BCBA57060}
IE - HKCU\..\SearchScopes,DefaultScope = {A44845DD-137B-4038-A8E7-F2A504E66342}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{2D6125E5-549C-42E1-97A0-77B77C451668}: "URL" = http://www.mysearchr...q={searchTerms}
IE - HKCU\..\SearchScopes\{A44845DD-137B-4038-A8E7-F2A504E66342}: "URL" = http://search.condui...8229282925&UM=2
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://start.sweetpa...D-782BCBA57060}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..CT3287375.browser.search.defaultthis.engineName: "true"
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaultthis.engineName: "Vafmusic Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://start.sweetpa...-782BCBA57060}"
FF - prefs.js..extensions.enabledAddons: %7B6c3bc03f-d7b9-43ac-8931-c242e3cae971%7D:10.15.0.562
FF - prefs.js..extensions.enabledAddons: addon%40defaulttab.com:1.4.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..keyword.URL: "http://search.condui...3120416&UM=&q="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.condui...={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.condui...3120416&UM=&q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}: C:\Program Files\Updater By SweetPacks\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/09 23:26:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/11/30 00:18:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Extensions
[2013/04/10 01:18:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions
[2013/04/10 00:41:28 | 000,000,000 | ---D | M] (Vafmusic) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\{6c3bc03f-d7b9-43ac-8931-c242e3cae971}
[2013/04/10 01:18:31 | 000,029,604 | ---- | M] () (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\[email protected]
[2013/01/21 16:29:31 | 000,004,028 | ---- | M] () (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\{7246ec39-79ec-4e18-88af-18c7bcb0266b}.xpi
[2013/04/09 23:23:44 | 000,000,993 | ---- | M] () -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\searchplugins\conduit.xml
[2013/04/10 01:50:53 | 000,001,977 | ---- | M] () -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\searchplugins\search-here.xml
[2013/04/10 01:18:36 | 000,001,720 | ---- | M] () -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\searchplugins\sweetim.xml
[2013/03/08 00:22:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/03/08 00:22:57 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013/01/16 16:10:30 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/02/27 01:00:37 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/01/21 17:44:27 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (DefaultTab Browser Helper) - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Documents and Settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabBHO.dll (Search Results LLC.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTDCPL.EXE (Realtek Semiconductor Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Configuration Utility HW.32.lnk = C:\WINDOWS\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1.exe (InstallShield Software Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([] in My Computer)
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: choicecentral.com ([support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: chotel.com ([] in My Computer)
O15 - HKCU\..Trusted Domains: chotel.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: remove.me ([] in My Computer)
O15 - HKCU\..Trusted Domains: remove.me ([]* in Trusted sites)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.micr...loadManager.cab (Reg Error: Key error.)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto....veX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logme...rl.cab?lmi=1007 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{352F1033-F0A0-485B-9963-5617FCFCF3C8}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/23 14:04:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: Baspshta - (C:\WINDOWS\system32\mmcppubw.dll) - C:\WINDOWS\system32\mmcppubw.dll ()
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/04/10 01:12:27 | 000,000,000 | ---D | C] -- C:\Program Files\DomaIQ Uninstaller
[2013/04/10 01:11:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Application Data\DefaultTab
[2013/04/10 00:45:26 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2013/04/10 00:32:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Application Data\FixZeroAccess
[2013/04/09 23:33:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Application Data\PriceGong
[2013/04/09 23:25:34 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2013/04/09 23:25:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit
[2013/04/09 23:25:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/09 23:25:03 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/04/09 23:24:34 | 000,000,000 | -HSD | C] -- C:\WINDOWS\System32\AI_RecycleBin
[2013/04/09 23:24:11 | 000,000,000 | -HSD | C] -- C:\AI_RecycleBin
[2013/04/09 23:24:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Local Settings\Application Data\Updater19962
[2013/04/09 23:23:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Application Data\Strongvault
[2013/04/09 22:54:03 | 004,411,440 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Auser\My Documents\avg_avct_stb_all_2013_2667_cm10.exe
[2013/04/09 21:38:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Start Menu\Programs\System Care Antivirus
[2013/04/09 21:32:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\10B897FCA90C4996000010B887494EC3
[2013/03/17 00:09:22 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/10 01:48:18 | 000,002,657 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Configuration Utility HW.32.lnk
[2013/04/10 01:47:42 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/04/10 01:47:20 | 000,000,482 | ---- | M] () -- C:\WINDOWS\tasks\DGChrome14943 Watcher.job
[2013/04/10 01:47:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/04/10 01:11:30 | 000,000,884 | RHS- | M] () -- C:\Documents and Settings\Auser\ntuser.pol
[2013/04/10 01:06:05 | 000,337,848 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/04/10 01:04:09 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/04/10 00:47:47 | 000,035,144 | ---- | M] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/04/10 00:37:33 | 000,000,468 | ---- | M] () -- C:\WINDOWS\tasks\PC Checkup 3 Weekly Scan.job
[2013/04/09 23:26:33 | 000,000,009 | ---- | M] () -- C:\END
[2013/04/09 23:26:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/04/09 23:01:41 | 000,144,648 | ---- | M] () -- C:\Documents and Settings\Auser\My Documents\SupportBridge.exe
[2013/04/09 22:54:16 | 004,411,440 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Auser\My Documents\avg_avct_stb_all_2013_2667_cm10.exe
[2013/04/09 21:31:17 | 000,063,488 | -H-- | M] () -- C:\WINDOWS\System32\mmcppubw.dll
[2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/03/27 15:47:47 | 000,002,471 | ---- | M] () -- C:\Documents and Settings\Auser\My Documents\ReportProxyServlet.pdf
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/10 01:11:30 | 000,000,884 | RHS- | C] () -- C:\Documents and Settings\Auser\ntuser.pol
[2013/04/10 01:11:25 | 000,000,482 | ---- | C] () -- C:\WINDOWS\tasks\DGChrome14943 Watcher.job
[2013/04/10 00:47:47 | 000,035,144 | ---- | C] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/04/09 23:23:07 | 000,000,009 | ---- | C] () -- C:\END
[2013/04/09 21:51:40 | 000,144,648 | ---- | C] () -- C:\Documents and Settings\Auser\My Documents\SupportBridge.exe
[2013/04/09 21:31:17 | 000,063,488 | -H-- | C] () -- C:\WINDOWS\System32\mmcppubw.dll
[2013/03/27 15:47:47 | 000,002,471 | ---- | C] () -- C:\Documents and Settings\Auser\My Documents\ReportProxyServlet.pdf
[2013/03/13 03:02:12 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2013/02/22 01:43:21 | 000,209,895 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\census.cache
[2013/02/22 01:43:14 | 000,158,660 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\ars.cache
[2013/02/22 01:30:40 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\housecall.guid.cache
[2013/01/19 02:15:59 | 002,250,054 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.bmp
[2013/01/19 02:15:36 | 000,350,795 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.jpg
[2013/01/13 22:32:25 | 000,006,528 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\7246ec39-79ec-4e18-88af-18c7bcb0266b.crx
[2013/01/06 05:36:47 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/01/06 05:36:47 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/01/06 05:36:47 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/01/06 05:36:47 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/01/06 05:36:47 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/11/16 04:28:48 | 001,488,022 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1417001333-1935655697-2147097355-1003-0.dat
[2012/11/10 05:48:50 | 000,299,638 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/09/15 04:46:51 | 000,005,348 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2012/09/05 10:48:38 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012/09/03 05:38:15 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/27 09:49:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\swunilog.ini
[2012/07/24 01:40:26 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/05/15 21:05:44 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/05/15 20:02:38 | 000,495,616 | R--- | C] () -- C:\WINDOWS\System32\softcoin.dll
[2012/05/15 20:02:37 | 000,356,352 | R--- | C] () -- C:\WINDOWS\System32\gencoin.dll
[2012/05/15 18:57:04 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\lexlog.dll
[2012/05/15 18:54:11 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabpmui.dll
[2012/05/15 18:54:10 | 001,044,480 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabserv.dll
[2012/05/15 18:54:10 | 000,847,872 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabusb1.dll
[2012/05/15 18:54:10 | 000,479,232 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabpar1.dll
[2012/05/15 18:54:10 | 000,344,064 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabiesc.dll
[2012/05/15 18:54:09 | 000,909,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabip1.dll
[2012/05/15 18:54:09 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\dkablmpm.dll
[2012/05/15 18:54:09 | 000,450,560 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabiobj.dll
[2012/05/15 18:54:09 | 000,368,640 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabinpa.dll
[2012/05/15 18:54:08 | 000,802,816 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabcomc.dll
[2012/05/15 18:54:08 | 000,603,456 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabcoms.exe
[2012/05/15 18:54:08 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabcomm.dll
[2012/05/15 18:54:08 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabhcp.dll
[2012/04/11 16:59:30 | 000,009,584 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll

========== ZeroAccess Check ==========

[2013/04/09 21:30:57 | 000,002,048 | -HS- | M] () -- C:\RECYCLER\S-1-5-18\$49ba4cc03380111052d4fee1910fe109\@
[2013/03/28 21:00:04 | 000,000,000 | -HSD | M] -- C:\RECYCLER\S-1-5-18\$49ba4cc03380111052d4fee1910fe109\L
[2013/04/10 00:24:07 | 000,000,000 | -HSD | M] -- C:\RECYCLER\S-1-5-18\$49ba4cc03380111052d4fee1910fe109\U
[2010/02/23 15:25:30 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
"ThreadingModel" = Apartment
"" = %SystemRoot%\system32\SHELL32.dll -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 03:00:00 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %SystemRoot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 03:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

========== LOP Check ==========

[2013/04/10 00:01:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\10B897FCA90C4996000010B887494EC3
[2013/03/29 16:38:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CA-SupportBridge
[2012/07/26 21:07:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2012/07/26 22:57:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2012/11/16 01:57:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BE42545F-033F-4590-A2DB-7AE2913B86B8}
[2013/04/10 01:11:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\DefaultTab
[2013/04/10 00:32:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\FixZeroAccess
[2012/11/30 02:09:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\OpenOffice.org
[2012/06/01 00:04:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\Oracle
[2012/11/04 18:54:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\PCCUStubInstaller
[2013/04/09 23:33:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\PriceGong
[2013/04/09 23:31:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\Strongvault

========== Purity Check ==========



< End of report >
  • 0

Advertisements

#2
maliprog
Posted 10 April 2013 - 12:35 AM

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hello mbowli_nc392 and welcome to my office here at G2G! :)

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:
  • Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
  • Absence of symptoms does not always mean the computer is clean
  • Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
  • Please DO NOT run any scans or fix on your own without my direction.
  • Please read all of my response through at least once before attempting to follow the procedures described.
  • If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
  • Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
  • You must reply within 3 days or your topic will be closed

Step 1

NOTE: This fix is custom made for this system only and for current system state! Don't try to run it on another system!

Please close all running programs and Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    MOD - C:\WINDOWS\system32\mmcppubw.dll ()
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpa...D-782BCBA57060}
    IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://start.sweetpa...D-782BCBA57060}
    IE - HKCU\..\SearchScopes\{2D6125E5-549C-42E1-97A0-77B77C451668}: "URL" = http://www.mysearchr...q={searchTerms}
    IE - HKCU\..\SearchScopes\{A44845DD-137B-4038-A8E7-F2A504E66342}: "URL" = http://search.condui...8229282925&UM=2
    IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://start.sweetpa...D-782BCBA57060}
    FF - prefs.js..browser.startup.homepage: "http://start.sweetpa...-782BCBA57060}"
    FF - prefs.js..keyword.URL: "http://search.condui...3120416&UM=&q="
    FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.condui...={searchTerms}"
    FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.condui...3120416&UM=&q="
    O36 - AppCertDlls: Baspshta - (C:\WINDOWS\system32\mmcppubw.dll) - C:\WINDOWS\system32\mmcppubw.dll ()
    [2013/04/09 23:25:34 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
    [2013/04/09 23:25:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit
    [2013/04/09 21:38:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Start Menu\Programs\System Care Antivirus
    [2013/04/09 21:32:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\10B897FCA90C4996000010B887494EC3

    :Files
    C:\Documents and Settings\All Users\Application Data\10B897FCA90C4996000010B887494EC3
    C:\RECYCLER\S-1-5-18\$49ba4cc03380111052d4fee1910fe109


    :Commands
    [purity]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Post the fix log it produces in your next reply or you can find it in C:\_OTL\MovedFiles

Step 2

Download and Install Combofix

Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks

    Posted Image

    Posted Image
  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion just reboot your system once, that will cure it.


Please make sure you include the combo fix log in your next reply

Step 3

Please don't forget to include these items in your reply:

  • OTL fix log
  • Combofix log
It would be helpful if you could post each log in separate post using "Add Reply" button
  • 0

#3
mbowli_nc392
Posted 10 April 2013 - 12:49 AM

mbowli_nc392

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2D6125E5-549C-42E1-97A0-77B77C451668}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2D6125E5-549C-42E1-97A0-77B77C451668}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A44845DD-137B-4038-A8E7-F2A504E66342}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A44845DD-137B-4038-A8E7-F2A504E66342}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
Prefs.js: "http://start.sweetpa...-782BCBA57060}" removed from browser.startup.homepage
Prefs.js: "http://search.condui...3120416&UM=&q=" removed from keyword.URL
Prefs.js: "http://search.condui...={searchTerms}" removed from sweetim.toolbar.previous.browser.search.defaulturl
Prefs.js: "http://search.condui...3120416&UM=&q=" removed from sweetim.toolbar.previous.keyword.URL
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\Baspshta deleted successfully.
C:\WINDOWS\system32\mmcppubw.dll moved successfully.
C:\Program Files\Conduit\Community Alerts folder moved successfully.
C:\Program Files\Conduit folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\Log folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\LanguagePacks folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\Feeds folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts\Dialogs folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit\Community Alerts folder moved successfully.
C:\Documents and Settings\Auser\Local Settings\Application Data\Conduit folder moved successfully.
C:\Documents and Settings\Auser\Start Menu\Programs\System Care Antivirus folder moved successfully.
Folder C:\Documents and Settings\All Users\Application Data\10B897FCA90C4996000010B887494EC3\ not found.
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\10B897FCA90C4996000010B887494EC3 folder moved successfully.
C:\RECYCLER\S-1-5-18\$49ba4cc03380111052d4fee1910fe109\U folder moved successfully.
C:\RECYCLER\S-1-5-18\$49ba4cc03380111052d4fee1910fe109\L folder moved successfully.
C:\RECYCLER\S-1-5-18\$49ba4cc03380111052d4fee1910fe109 folder moved successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.69.0 log created on 04102013_023850
  • 0

#4
mbowli_nc392
Posted 10 April 2013 - 01:01 AM

mbowli_nc392

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
ComboFix 13-04-10.01 - Auser 04/10/2013 2:52.5.2 - x86
Running from: c:\documents and settings\Auser\My Documents\Downloads\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\addon.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\amazon_ie.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabBHO.cfg
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabBHO.dll
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabStart.exe
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabStart64.exe
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabUninstaller.exe
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabWrap.dll
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DefaultTabWrap64.dll
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DT.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\DTUpdate.exe
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\ebay_ie.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\facebook_ie.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\search_here_ie.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\searchhere.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\twitter_ie.ico
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\uninstalldt.exe
c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\wikipedia_ie.ico
c:\documents and settings\Auser\Application Data\PriceGong
c:\documents and settings\Auser\Application Data\PriceGong\Data\1.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\a.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\b.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\c.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\d.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\e.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\f.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\g.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\h.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\i.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\j.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\k.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\l.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\m.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\n.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\o.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\p.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\q.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\r.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\s.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\t.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\u.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\v.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\w.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\x.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\y.txt
c:\documents and settings\Auser\Application Data\PriceGong\Data\z.txt
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DefaultTabUpdate
-------\Legacy_DefaultTabUpdate
-------\Service_DefaultTabUpdate
-------\Service_DefaultTabUpdate
.
.
((((((((((((((((((((((((( Files Created from 2013-03-10 to 2013-04-10 )))))))))))))))))))))))))))))))
.
.
2013-04-10 06:38 . 2013-04-10 06:38 -------- d-----w- C:\_OTL
2013-04-10 05:12 . 2013-04-10 05:12 -------- d-----w- c:\program files\DomaIQ Uninstaller
2013-04-10 05:11 . 2013-04-10 06:54 -------- d-----w- c:\documents and settings\Auser\Application Data\DefaultTab
2013-04-10 04:47 . 2013-04-10 04:47 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-04-10 04:45 . 2013-04-10 04:45 -------- d--h--w- c:\windows\PIF
2013-04-10 04:32 . 2013-04-10 04:32 -------- d-----w- c:\documents and settings\Auser\Application Data\FixZeroAccess
2013-04-10 03:25 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-10 03:24 . 2013-04-10 03:32 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2013-04-10 03:24 . 2013-03-06 10:38 770384 ----a-w- c:\windows\system32\msvcr100.dll
2013-04-10 03:24 . 2013-03-06 10:38 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-04-10 03:24 . 2013-04-10 03:32 -------- d-----w- C:\AI_RecycleBin
2013-04-10 03:24 . 2013-04-10 03:24 -------- d-----w- c:\documents and settings\Auser\Local Settings\Application Data\Updater19962
2013-04-10 03:23 . 2013-04-10 03:31 -------- d-----w- c:\documents and settings\Auser\Application Data\Strongvault
2013-03-31 11:13 . 2001-08-18 02:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2013-03-31 11:13 . 2008-04-14 09:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2013-03-31 11:13 . 2008-04-14 04:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2013-03-31 11:13 . 2008-04-14 04:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2013-03-18 19:40 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
2013-03-17 04:09 . 2013-03-17 04:27 -------- d-----w- c:\program files\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-08 08:36 . 2008-04-14 07:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32 . 2008-04-14 07:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50 . 2008-04-14 00:01 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-02 02:06 . 2008-04-14 07:00 916480 ----a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06 . 2008-04-14 07:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06 . 2008-04-14 07:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25 . 2008-04-14 07:00 1867264 ----a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08 . 2008-04-14 07:00 385024 ------w- c:\windows\system32\html.iec
2013-02-27 22:26 . 2012-05-17 02:56 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-27 22:26 . 2012-05-17 02:56 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-27 07:56 . 2010-02-23 17:59 2067456 ----a-w- c:\windows\system32\mstscax.dll
2013-02-12 00:32 . 2008-04-14 07:00 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-01-30 21:21 . 2013-01-30 21:21 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-01-30 21:21 . 2013-01-30 21:21 143872 ----a-w- c:\windows\system32\javacpl.cpl
2013-01-30 21:21 . 2012-06-01 04:04 859552 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-01-30 21:21 . 2012-06-01 04:04 780192 ----a-w- c:\windows\system32\deployJava1.dll
2013-01-26 03:55 . 2008-04-14 07:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-23 11:12 . 2012-04-11 20:59 9584 ----a-w- c:\windows\system32\ractrlkeyhook.dll
2013-01-19 10:49 . 2012-05-15 23:29 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2013-01-19 10:49 . 2012-05-15 23:29 125488 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2013-03-08 04:22 . 2013-03-08 04:22 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-28 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-28 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-28 142872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2010-05-07 115560]
"RTHDCPL"="RTDCPL.EXE" [2009-08-26 2691072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]
Wireless Configuration Utility HW.32.lnk - c:\windows\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1.exe [2012-8-27 40960]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 12:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R0 cerc6;cerc6; [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 CmtlPort;Comtrol Serial Port;c:\windows\system32\DRIVERS\rp2cport.sys [x]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.1.121\McCHSvc.exe [x]
R3 RcktPort;Comtrol RocketPort Infinity;c:\windows\system32\DRIVERS\rp2.sys [x]
R3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [x]
S2 dkab_device;dkab_device;c:\windows\system32\DKabcoms.exe [x]
S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 k57w2k;Broadcom NetLink ™ Gigabit Ethernet;c:\windows\system32\DRIVERS\k57xp32.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-17 22:26]
.
2013-04-10 c:\windows\Tasks\PC Checkup 3 Weekly Scan.job
- c:\program files\Norton PC Checkup 3.0\NLAppLauncher.exe [2012-11-04 03:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={03A7F514-A19D-11E2-B3DD-782BCBA57060}
mStart Page =
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: choiceadvantage.com
Trusted Zone: choiceadvantage.com\www
Trusted Zone: choicecentral.com\support
Trusted Zone: chotel.com
Trusted Zone: remove.me
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3287375&SearchSource=2&CUI=UN25848836783120416&UM=&q=
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-04-09 23:25; {6c3bc03f-d7b9-43ac-8931-c242e3cae971}; c:\documents and settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\{6c3bc03f-d7b9-43ac-8931-c242e3cae971}
FF - ExtSQL: 2013-04-10 01:18; [email protected]; c:\documents and settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\[email protected]
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-DefaultTab - c:\documents and settings\Auser\Application Data\DefaultTab\DefaultTab\uninstalldt.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-10 02:57
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3348)
c:\windows\system32\WININET.dll
c:\windows\system32\igfxdo.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTDCPL.EXE
c:\program files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
.
**************************************************************************
.
Completion time: 2013-04-10 02:59:21 - machine was rebooted
ComboFix-quarantined-files.txt 2013-04-10 06:59
ComboFix2.txt 2013-01-21 21:45
ComboFix3.txt 2013-01-21 20:43
ComboFix4.txt 2013-01-06 10:33
ComboFix5.txt 2013-04-10 06:50
.
Pre-Run: 236,967,530,496 bytes free
Post-Run: 236,964,671,488 bytes free
.
- - End Of File - - 7C69F9197E3CE54C0C86D645552729AC
  • 0

#5
maliprog
Posted 10 April 2013 - 01:03 AM

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Can you please update your Malwarebytes and do Quick Scan. Remove all findings and post log here for me after the scan.
  • 0

#6
mbowli_nc392
Posted 10 April 2013 - 01:10 AM

mbowli_nc392

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.04.10.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Auser :: CHOICENODE [administrator]

4/10/2013 3:07:16 AM
mbam-log-2013-04-10 (03-07-16).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 216952
Time elapsed: 2 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\SOFTWARE\CROSSRIDER (Adware.GamePlayLab) -> Quarantined and deleted successfully.

Registry Values Detected: 1
HKCU\Software\Crossrider|215AppVerifier (Adware.GamePlayLab) -> Data: 11956122d2b981eff489607e187bd966 -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
  • 0

#7
maliprog
Posted 10 April 2013 - 01:13 AM

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Before we continue can you restart your system once and tell me how is your system now? Problems?
  • 0

#8
mbowli_nc392
Posted 10 April 2013 - 01:19 AM

mbowli_nc392

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
System seems fine
  • 0

#9
maliprog
Posted 10 April 2013 - 01:23 AM

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Nice to hear that. Let's do OTL Quick Scan to see if anything left.

  • Run OTL.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open notepad window. OTL.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file, and post it with your next reply.

  • 0

#10
mbowli_nc392
Posted 10 April 2013 - 01:29 AM

mbowli_nc392

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
OTL logfile created on: 4/10/2013 3:25:54 AM - Run 8
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Auser\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.96 Gb Total Physical Memory | 1.29 Gb Available Physical Memory | 65.49% Memory free
3.81 Gb Paging File | 3.35 Gb Available in Paging File | 87.92% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 220.72 Gb Free Space | 94.78% Space Free | Partition Type: NTFS

Computer Name: CHOICENODE | User Name: Auser | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Auser\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\dkabcoms.exe ( )
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\WINDOWS\RTDCPL.EXE (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe ()
PRC - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanDll.dll ()
MOD - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe ()
MOD - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe ()


========== Services (SafeList) ==========

SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (Norton PC Checkup Application Launcher) -- C:\Program Files\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) -- C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe (McAfee, Inc.)
SRV - (SmcService) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
SRV - (dkab_device) -- C:\WINDOWS\system32\dkabcoms.exe ( )
SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SRV - (SNAC) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (Symantec Corporation)
SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (SiSWLSvc) -- C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe ()


========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (cerc6) -- File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (mbamchameleon) -- C:\WINDOWS\system32\drivers\mbamchameleon.sys ()
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20130409.009\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20130409.009\NAVENG.SYS (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SRTSPL) -- C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSPX) -- C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SPBBCDrv) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (CmtlPort) -- C:\WINDOWS\system32\drivers\rp2cport.sys (Comtrol Corporation)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtDHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RcktPort) -- C:\WINDOWS\system32\drivers\rp2.sys (Comtrol Corporation)
DRV - (SYMTDI) -- C:\WINDOWS\system32\drivers\symtdi.sys (Symantec Corporation)
DRV - (SYMREDRV) -- C:\WINDOWS\system32\drivers\symredrv.sys (Symantec Corporation)
DRV - (k57w2k) -- C:\WINDOWS\system32\drivers\k57xp32.sys (Broadcom Corporation)
DRV - (Blfp) -- C:\WINDOWS\system32\drivers\baspxp32.sys (Broadcom Corporation)
DRV - (SIS163u) -- C:\WINDOWS\system32\drivers\sis163u.sys (SiS Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpa...D-782BCBA57060}
IE - HKCU\..\SearchScopes,DefaultScope = {A44845DD-137B-4038-A8E7-F2A504E66342}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..CT3287375.browser.search.defaultthis.engineName: "true"
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaultthis.engineName: "Vafmusic Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledAddons: %7B6c3bc03f-d7b9-43ac-8931-c242e3cae971%7D:10.15.0.562
FF - prefs.js..extensions.enabledAddons: addon%40defaulttab.com:1.4.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..keyword.URL: "http://search.condui...3120416&UM=&q="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "about:home"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}: C:\Program Files\Updater By SweetPacks\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/09 23:26:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/11/30 00:18:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Extensions
[2013/04/10 01:18:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions
[2013/04/10 00:41:28 | 000,000,000 | ---D | M] (Vafmusic) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\{6c3bc03f-d7b9-43ac-8931-c242e3cae971}
[2013/04/10 01:18:31 | 000,029,604 | ---- | M] () (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\[email protected]
[2013/01/21 16:29:31 | 000,004,028 | ---- | M] () (No name found) -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\extensions\{7246ec39-79ec-4e18-88af-18c7bcb0266b}.xpi
[2013/04/09 23:23:44 | 000,000,993 | ---- | M] () -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\searchplugins\conduit.xml
[2013/04/10 03:18:14 | 000,001,977 | ---- | M] () -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\searchplugins\search-here.xml
[2013/04/10 01:18:36 | 000,001,720 | ---- | M] () -- C:\Documents and Settings\Auser\Application Data\Mozilla\Firefox\Profiles\kqo41fxs.default\searchplugins\sweetim.xml
[2013/03/08 00:22:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/03/08 00:22:57 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013/01/16 16:10:30 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/02/27 01:00:37 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/04/10 02:56:47 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTDCPL.EXE (Realtek Semiconductor Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Configuration Utility HW.32.lnk = C:\WINDOWS\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1.exe (InstallShield Software Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([] in My Computer)
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: choiceadvantage.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: choicecentral.com ([support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: chotel.com ([] in My Computer)
O15 - HKCU\..Trusted Domains: chotel.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: remove.me ([] in My Computer)
O15 - HKCU\..Trusted Domains: remove.me ([]* in Trusted sites)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.micr...loadManager.cab (Reg Error: Key error.)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto....veX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logme...rl.cab?lmi=1007 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{352F1033-F0A0-485B-9963-5617FCFCF3C8}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/23 14:04:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/04/10 02:38:50 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/04/10 01:12:27 | 000,000,000 | ---D | C] -- C:\Program Files\DomaIQ Uninstaller
[2013/04/10 01:11:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Application Data\DefaultTab
[2013/04/10 00:45:26 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2013/04/10 00:32:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Application Data\FixZeroAccess
[2013/04/09 23:25:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/09 23:25:03 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/04/09 23:24:34 | 000,000,000 | -HSD | C] -- C:\WINDOWS\System32\AI_RecycleBin
[2013/04/09 23:24:11 | 000,000,000 | ---D | C] -- C:\AI_RecycleBin
[2013/04/09 23:24:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Local Settings\Application Data\Updater19962
[2013/04/09 23:23:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Auser\Application Data\Strongvault
[2013/04/09 22:54:03 | 004,411,440 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Auser\My Documents\avg_avct_stb_all_2013_2667_cm10.exe
[2013/03/17 00:09:22 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/10 03:26:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/04/10 03:17:00 | 000,002,657 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Configuration Utility HW.32.lnk
[2013/04/10 03:16:43 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/04/10 03:15:44 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/04/10 02:56:47 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/04/10 01:11:30 | 000,000,884 | RHS- | M] () -- C:\Documents and Settings\Auser\ntuser.pol
[2013/04/10 01:06:05 | 000,337,848 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/04/10 01:04:09 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/04/10 00:47:47 | 000,035,144 | ---- | M] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/04/10 00:37:33 | 000,000,468 | ---- | M] () -- C:\WINDOWS\tasks\PC Checkup 3 Weekly Scan.job
[2013/04/09 23:26:33 | 000,000,009 | ---- | M] () -- C:\END
[2013/04/09 23:01:41 | 000,144,648 | ---- | M] () -- C:\Documents and Settings\Auser\My Documents\SupportBridge.exe
[2013/04/09 22:54:16 | 004,411,440 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Auser\My Documents\avg_avct_stb_all_2013_2667_cm10.exe
[2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/03/27 15:47:47 | 000,002,471 | ---- | M] () -- C:\Documents and Settings\Auser\My Documents\ReportProxyServlet.pdf
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/10 01:11:30 | 000,000,884 | RHS- | C] () -- C:\Documents and Settings\Auser\ntuser.pol
[2013/04/10 00:47:47 | 000,035,144 | ---- | C] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/04/09 23:23:07 | 000,000,009 | ---- | C] () -- C:\END
[2013/04/09 21:51:40 | 000,144,648 | ---- | C] () -- C:\Documents and Settings\Auser\My Documents\SupportBridge.exe
[2013/03/27 15:47:47 | 000,002,471 | ---- | C] () -- C:\Documents and Settings\Auser\My Documents\ReportProxyServlet.pdf
[2013/03/13 03:02:12 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2013/02/22 01:43:21 | 000,209,895 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\census.cache
[2013/02/22 01:43:14 | 000,158,660 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\ars.cache
[2013/02/22 01:30:40 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\housecall.guid.cache
[2013/01/19 02:15:59 | 002,250,054 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.bmp
[2013/01/19 02:15:36 | 000,350,795 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.jpg
[2013/01/13 22:32:25 | 000,006,528 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\7246ec39-79ec-4e18-88af-18c7bcb0266b.crx
[2013/01/06 05:36:47 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/01/06 05:36:47 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/01/06 05:36:47 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/01/06 05:36:47 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/01/06 05:36:47 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/11/16 04:28:48 | 001,488,022 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1417001333-1935655697-2147097355-1003-0.dat
[2012/11/10 05:48:50 | 000,299,638 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/09/15 04:46:51 | 000,005,348 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2012/09/05 10:48:38 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012/09/03 05:38:15 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\Auser\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/27 09:49:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\swunilog.ini
[2012/07/24 01:40:26 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/05/15 21:05:44 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/05/15 20:02:38 | 000,495,616 | R--- | C] () -- C:\WINDOWS\System32\softcoin.dll
[2012/05/15 20:02:37 | 000,356,352 | R--- | C] () -- C:\WINDOWS\System32\gencoin.dll
[2012/05/15 18:57:04 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\lexlog.dll
[2012/05/15 18:54:11 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabpmui.dll
[2012/05/15 18:54:10 | 001,044,480 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabserv.dll
[2012/05/15 18:54:10 | 000,847,872 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabusb1.dll
[2012/05/15 18:54:10 | 000,479,232 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabpar1.dll
[2012/05/15 18:54:10 | 000,344,064 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabiesc.dll
[2012/05/15 18:54:09 | 000,909,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabip1.dll
[2012/05/15 18:54:09 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\dkablmpm.dll
[2012/05/15 18:54:09 | 000,450,560 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabiobj.dll
[2012/05/15 18:54:09 | 000,368,640 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabinpa.dll
[2012/05/15 18:54:08 | 000,802,816 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabcomc.dll
[2012/05/15 18:54:08 | 000,603,456 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabcoms.exe
[2012/05/15 18:54:08 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabcomm.dll
[2012/05/15 18:54:08 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\dkabhcp.dll
[2012/04/11 16:59:30 | 000,009,584 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll

========== ZeroAccess Check ==========

[2010/02/23 15:25:30 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 03:00:00 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 03:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

========== LOP Check ==========

[2013/03/29 16:38:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CA-SupportBridge
[2012/07/26 21:07:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2012/07/26 22:57:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2012/11/16 01:57:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BE42545F-033F-4590-A2DB-7AE2913B86B8}
[2013/04/10 02:54:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\DefaultTab
[2013/04/10 00:32:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\FixZeroAccess
[2012/11/30 02:09:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\OpenOffice.org
[2012/06/01 00:04:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\Oracle
[2012/11/04 18:54:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\PCCUStubInstaller
[2013/04/09 23:31:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Auser\Application Data\Strongvault

========== Purity Check ==========



< End of report >
  • 0

#11
maliprog
Posted 10 April 2013 - 01:31 AM

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Your logs and system are clean now. I don't see any malware on your logs. I'm glad we fix up your computer.

Step 1

Please close all running programs and Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL

    :Commands
    [purity]
    [emptytemp]
    [resethosts]
    [clearallrestorepoints]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
Step 2

We need to clean up your PC from programs we used.

Please start OTL one more time and click CleanUp button. OTL will restart your system at the end.

In case that any of the software we used in this fix still remains on your system please delete it manually (Right click on it and select Delete).

General recommendations

Here are some recommendations you should follow to minimize infection risk in the future:

1. Something to read

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

2. Make Backups of Important Files

Please read this article Home Computer Data Backup.

3. Regularly update your software

To eliminate design flaws and security vulnerabilities, all software needs to be updated to the latest version or the vendor’s patch installed.

You should download Update Checker from here. The program will automaticly check for newer version of software installed on your system.
  • 0

#12
maliprog
Posted 12 April 2013 - 12:07 AM

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP