Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Can't remove RCMP Ukash virus [Solved]

Started by Twinbird , Apr 10 2013 06:08 PM

This topic is locked

#1
Twinbird

Posted 10 April 2013 - 06:08 PM

Member

Member
59 posts

I've been trying to remove this virus with no avail.

The problem: RCMP Ukash virus. When XP (32bit) attempts to start up, the desktop background appears and nothing else except this fake page telling me to send money to have my PC unlocked (looks like this http://tinyurl.com/cdyb567). There is a short period in which the taskbar and icons do load (during this time I can open up task manager, my computer, etc., this is for about half a minute and then the virus takes over and locks the PC). I am not able to start safe mode.

What I've tried: I've ran the bootable Windows Defender Offline which found a lot of things and apparently removed them. I've removed the HDD and scanned it with Malwarebytes and Avast which didn't help either. I used the Kaspersky Rescue Disc 10 (bootable) to run a scan (still didn't fix the problem). I used the AVG rescue disc, didn't fix the problem. I used the Anvi Rescue disc and ran a scan... virus still starts up.

All of these scans have detected problems and reported fixing them but the virus still starts up every-time on reboot (how, I don't know).

Any help would be appreciated!

#2
gringo_pr

Posted 10 April 2013 - 06:15 PM

Trusted Helper

Malware Removal
7,268 posts

Hello

Lets see if we can get this to run

Download OTLPE from either location and save it to your desktop:

http://oldtimer.geek...om/OTLPEStd.exe
http://ottools.noahd...et/OTLPEStd.exe
Double click the OTLPENet icon on your desktop
"Do you want to burn the CD?" choose Yes
ImgBurn will automatically extract and load the OTLPE Iso to be burned to CD
Place a blank CD in your CD-Rom
Click to start the burn process
You will see a dialog "Operation successfully completed"
Boot the non-working computer using the boot CD you just created
In order to do so, the computer must be set to boot from the CD first

Note : For information click here
Your system should now display a REATOGO-X-PE desktop.
Double-click on the OTLPE icon.
Select the Windows folder of the infected drive if it asks for a location
When asked "Do you wish to load the remote registry", select Yes
When asked "Do you wish to load remote user profile(s) for scanning", select Yes
Ensure the box "Automatically Load All Remaining Users" is checked and press "OK"
OTL should now start.
Push
When finished, the file will be saved in drive C:\OTL.txt
Copy this file to your USB drive.
Please post the contents of the C:\OTL.txt file in your next reply.

Gringo

#3
Twinbird

Posted 10 April 2013 - 06:57 PM

Member

Topic Starter
Member
59 posts

OTL logfile created on: 4/10/2013 9:50:24 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 224.38 Gb Total Space | 149.09 Gb Free Space | 66.45% Space Free | Partition Type: NTFS
Drive H: | 3.80 Gb Total Space | 3.76 Gb Free Space | 98.78% Space Free | Partition Type: NTFS
Drive I: | 8.49 Gb Total Space | 0.27 Gb Free Space | 3.13% Space Free | Partition Type: FAT32
Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (SENS32)
SRV - File not found [On_Demand] -- -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [Auto] -- -- (nvrd32)
SRV - [2013/03/13 09:15:32 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/01/31 14:40:13 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2011/01/31 14:40:08 | 005,897,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/01/31 14:40:01 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2009/03/27 22:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008/05/12 12:38:28 | 000,611,664 | ---- | M] (Lavasoft) [Auto] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice)
SRV - [2006/11/10 11:12:30 | 000,099,936 | ---- | M] () [Auto] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2005/08/03 03:19:16 | 000,058,880 | ---- | M] (Microsoft) [Auto] -- C:\WINDOWS\arservice.exe -- (ARSVC)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | System] -- -- (SBRE)
DRV - File not found [File_System | Boot] -- -- (Lbd)
DRV - [2013/03/18 03:28:41 | 000,124,504 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2013/01/15 19:50:32 | 000,226,016 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2011/11/10 14:44:14 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2011/09/13 08:59:58 | 000,029,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2011/05/06 08:53:38 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2011/04/05 17:35:20 | 000,332,248 | ---- | M] (Sunbelt Software, Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\SbFw.sys -- (SbFw)
DRV - [2011/01/31 14:40:10 | 000,122,448 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys -- (AVGIDSDriverxpx)
DRV - [2011/01/31 14:40:10 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys -- (AVGIDSFilterxpx)
DRV - [2011/01/31 14:40:10 | 000,026,192 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys -- (AVGIDSShimxpx)
DRV - [2011/01/31 14:40:10 | 000,025,168 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\AVGIDSxx.sys -- (AVGIDSErHrxpx)
DRV - [2011/01/31 14:39:58 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (AvgRkx86)
DRV - [2009/08/13 15:07:12 | 001,163,328 | ---- | M] (LSI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/02/11 12:40:40 | 005,028,352 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007/02/15 20:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2006/02/15 17:07:37 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2005/12/12 17:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
DRV - [2005/08/02 17:10:13 | 000,032,512 | ---- | M] (CACE Technologies) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2005/07/29 19:11:04 | 000,012,928 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2005/07/29 19:11:02 | 000,034,048 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2005/03/09 16:53:00 | 000,036,352 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/08/03 17:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2003/11/30 22:54:20 | 000,043,136 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.mocaflix.com/
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...lion&pf=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...lion&pf=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...lion&pf=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F8 11 BD 01 8B BC 51 4D A2 EF 24 09 88 68 D1 6D [binary data]
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...lion&pf=desktop
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...lion&pf=desktop
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.h...lion&pf=desktop
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...lion&pf=desktop
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.execulink...ulink/index.php
IE - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F8 11 BD 01 8B BC 51 4D A2 EF 24 09 88 68 D1 6D [binary data]
IE - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\URLSearchHook: {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\prxtbMin2.dll (Conduit Ltd.)
IE - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\URLSearchHook: {e306aaa2-3b4f-4802-9faf-0c10ab78b589} - Reg Error: Key error. File not found
IE - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F8 11 BD 01 8B BC 51 4D A2 EF 24 09 88 68 D1 6D [binary data]

IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F8 11 BD 01 8B BC 51 4D A2 EF 24 09 88 68 D1 6D [binary data]

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_39: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll ()
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll ()
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/10/07 12:02:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\RewardsArcade\498\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/07 22:39:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Mozilla\Firefox\Profiles\1zu3u0kx.default\extensions\[email protected] [2012/07/21 16:24:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/10/07 12:02:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Mozilla\Firefox\Profiles\1zu3u0kx.default\extensions\[email protected] [2012/11/23 19:46:10 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2012/01/24 12:39:27 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll ()
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: <Company name>)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)
O2 - BHO: (Mininova-Vuze Toolbar) - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\prxtbMin2.dll (Conduit Ltd.)
O2 - BHO: (no name) - {e306aaa2-3b4f-4802-9faf-0c10ab78b589} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Mininova-Vuze Toolbar) - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\prxtbMin2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {e306aaa2-3b4f-4802-9faf-0c10ab78b589} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\..\Toolbar\WebBrowser: (Mininova-Vuze Toolbar) - {D51D388B-F5DC-471A-A1CE-5E2D671091C0} - C:\Program Files\Mininova-Vuze\prxtbMin2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [DMAScheduler] C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Hq4RmJqLt] C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C..\Run: [AnyDVD] C:\DOCUME~1\HP_ADM~1.YOU\MYDOCU~1\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C..\Run: [Hq4RmJqLt] C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe ()
O4 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C..\Run: [msnmsgr] File not found
O4 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C..\Run: [QuickCet] File not found
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\U present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskBar = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetworkConnections = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetConnectDisconnect = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetIcon = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetHood = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWinKey = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetConnextDisconnect = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFavoritesMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = -1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\P present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: 몭몭몭몭몭 = Reg Error: Value error. File not found
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: 몭몭몭몭몭 = Reg Error: Value error. File not found
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: 몭몭몭몭몭 = Reg Error: Value error. File not found
O7 - HKU\Administrator_ON_C\Software\Policies\Microsoft\Internet Explorer\ present
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\Software\Policies\Microsoft\Internet Explorer\\ present
O7 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\LocalService_ON_C\Software\Policies\Microsoft\Internet Explorer\\ present
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\Software\Policies\Microsoft\Internet Explorer\H present
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_C\Software\Policies\Microsoft\Internet Explorer\H present
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.micr...78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_39)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2013/04/10 18:50:33 | 000,000,000 | ---D | C] -- C:\$Anvi Rescue Disk$
[2013/04/10 06:54:23 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2013/04/10 00:19:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft Antimalware
[2013/04/07 09:00:17 | 000,228,600 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2013/04/05 09:53:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\calibre - E-book Management
[2013/04/05 08:10:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\Somoto_V.1
[2013/04/05 08:10:47 | 000,000,000 | ---D | C] -- C:\Program Files\Somoto_V.1
[2013/04/05 08:10:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\QuickCet
[2013/03/25 18:17:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Joan's Documents\Desktop\Crystal Cove by Lisa Kleypas
[2013/03/25 07:29:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Joan's Documents\Desktop\Susan Mallery
[2013/03/20 16:28:29 | 000,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usb8023.sys
[2013/03/20 16:28:28 | 000,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usb8023x.sys
[2013/03/18 03:28:41 | 000,124,504 | ---- | C] (SlySoft, Inc.) -- C:\WINDOWS\System32\drivers\AnyDVD.sys
[2009/01/19 20:34:22 | 003,292,312 | ---- | C] (LG Software Innovations ) -- C:\Program Files\1clickdvdcopysetupnt5.6.0.0.exe
[2008/05/28 10:34:58 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\pcouffin.sys
[2005/09/24 11:49:16 | 000,012,288 | ---- | C] (Hewlett-Packard Development Company, L.P.) -- C:\WINDOWS\Fonts\RandFont.dll
[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\*.tmp files -> C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/10 19:52:50 | 000,000,248 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat
[2013/04/10 19:51:46 | 000,043,531 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2013/04/10 19:51:44 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1972439474-2229743540-1109621959-1008.job
[2013/04/10 19:51:30 | 000,000,444 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{BC409505-022D-495D-8DE6-0C2C5BD5125A}.job
[2013/04/10 19:49:07 | 000,000,580 | -H-- | M] () -- C:\WINDOWS\tasks\OptimizerProUpdaterTask{169C5ADC-8B17-45CF-A12C-157F7C74B078}.job
[2013/04/10 19:49:07 | 000,000,556 | -H-- | M] () -- C:\WINDOWS\tasks\TheBflixUpdaterTask{1B55F978-E9FA-4A15-9048-C4924F55D3A2}.job
[2013/04/10 19:49:07 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\YourFile Update.job
[2013/04/10 19:49:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/04/10 19:48:59 | 2078,855,168 | -HS- | M] () -- C:\hiberfil.sys
[2013/04/10 18:45:11 | 116,688,849 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2013/04/10 18:40:37 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1972439474-2229743540-1109621959-1008.job
[2013/04/08 23:15:16 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/04/08 19:00:03 | 000,161,109 | ---- | M] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\4e78f2a3-26f0-42fd-ab98-6cbe621bc56e
[2013/04/08 18:59:41 | 000,141,312 | ---- | M] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe
[2013/04/08 16:18:54 | 000,002,477 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk
[2013/04/08 11:13:00 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2013/04/07 09:00:17 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2013/04/05 20:38:00 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\Reimage Reminder.job
[2013/04/05 19:53:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\calibre - E-book Management
[2013/04/05 09:53:34 | 000,000,730 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\calibre - E-book management.lnk
[2013/04/05 08:10:55 | 000,000,009 | ---- | M] () -- C:\END
[2013/04/04 11:27:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/04/01 10:28:03 | 000,000,328 | ---- | M] () -- C:\WINDOWS\tasks\HPCeeSchedule.job
[2013/03/31 12:49:57 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/03/28 07:37:43 | 000,001,189 | ---- | M] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\vso_ts_preview.xml
[2013/03/27 05:48:00 | 000,000,486 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2013/03/24 21:34:12 | 000,001,013 | ---- | M] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Microsoft\Internet Explorer\Quick Launch\1CLICK DVD COPY 5.lnk
[2013/03/24 21:34:12 | 000,001,001 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Joan's Documents\Desktop\1CLICK DVD COPY 5.lnk
[2013/03/24 21:34:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\1Click DVD Copy 5
[2013/03/23 11:04:13 | 000,002,479 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
[2013/03/22 15:37:16 | 000,000,789 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\AnyDVD.lnk
[2013/03/18 03:28:41 | 000,124,504 | ---- | M] (SlySoft, Inc.) -- C:\WINDOWS\System32\drivers\AnyDVD.sys
[2013/03/14 03:04:02 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/03/14 03:01:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2013/03/13 09:15:31 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/03/13 09:15:31 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\*.tmp files -> C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/09 17:20:03 | 2078,855,168 | -HS- | C] () -- C:\hiberfil.sys
[2013/04/08 19:00:03 | 000,161,109 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\4e78f2a3-26f0-42fd-ab98-6cbe621bc56e
[2013/04/08 18:59:53 | 000,141,312 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe
[2013/04/05 09:53:34 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\calibre - E-book management.lnk
[2013/04/05 08:10:20 | 000,000,009 | ---- | C] () -- C:\END
[2013/03/27 06:16:19 | 000,063,241 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\My Documents\Reference #28720940_ Your WinRAR order.eml
[2013/03/27 06:16:19 | 000,063,143 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\My Documents\Reference #28720940_ Payment information for WinRAR.eml
[2013/03/27 06:16:19 | 000,004,516 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\My Documents\WinRAR delivery information (CleverB-28720940).eml
[2013/03/27 06:16:12 | 000,006,169 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\My Documents\LG Software Innovations 2009 renewal.eml
[2012/07/06 18:42:48 | 000,217,840 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\census.cache
[2012/07/06 18:42:37 | 000,177,271 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\ars.cache
[2012/07/06 18:24:37 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\housecall.guid.cache
[2012/05/08 19:43:43 | 000,111,600 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2012/03/01 17:09:00 | 000,003,344 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\ipad
[2012/02/15 07:44:44 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/23 21:38:45 | 000,000,286 | ---- | C] () -- C:\WINDOWS\reimage.ini
[2012/01/23 20:02:20 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2011/11/11 15:16:41 | 000,000,072 | ---- | C] () -- C:\WINDOWS\PBUpdate.ini
[2011/10/19 15:14:37 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/10/19 15:14:37 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/01/27 16:57:07 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2011/01/27 13:20:46 | 000,000,092 | ---- | C] () -- C:\WINDOWS\ka.ini
[2010/10/04 21:28:09 | 000,241,664 | ---- | C] () -- C:\Documents and Settings\NetworkService\s-1-5-20.rrr
[2010/10/04 21:28:09 | 000,241,664 | ---- | C] () -- C:\Documents and Settings\LocalService\s-1-5-19.rrr
[2010/09/16 15:21:13 | 000,203,776 | -HS- | C] () -- C:\WINDOWS\System32\unrar.exe
[2010/05/11 21:29:10 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/08/25 16:00:26 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2009/08/25 16:00:26 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2009/07/15 13:33:56 | 000,000,108 | ---- | C] () -- C:\WINDOWS\TripleS.ini
[2009/07/15 13:31:43 | 000,000,123 | ---- | C] () -- C:\WINDOWS\Wedding.ini
[2009/07/15 13:06:01 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Sports.ini
[2009/05/29 18:42:20 | 000,309,248 | ---- | C] () -- C:\WINDOWS\System32\sqlite36_engine.dll
[2009/03/11 15:01:28 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\DirectCOM.dll
[2009/01/15 19:41:19 | 000,022,782 | ---- | C] () -- C:\WINDOWS\System32\UninstXviDDec.exe
[2009/01/15 18:01:46 | 000,001,189 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\vso_ts_preview.xml
[2008/12/29 21:10:24 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2008/12/16 19:07:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/10/05 12:02:31 | 002,965,504 | ---- | C] () -- C:\WINDOWS\System32\TranscodingDLL.dll
[2008/10/05 12:02:31 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2008/10/05 12:02:31 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\akrip32.dll
[2008/10/05 12:02:30 | 000,864,256 | ---- | C] () -- C:\WINDOWS\System32\FreeImage.dll
[2008/10/05 12:02:30 | 000,055,808 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2008/07/17 20:23:27 | 000,049,152 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/11 21:12:56 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2008/05/28 10:34:58 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\inst.exe
[2008/05/28 10:34:58 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\pcouffin.cat
[2008/05/28 10:34:58 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\pcouffin.inf
[2008/05/26 22:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/05/24 21:11:49 | 000,002,700 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\wklnhst.dat
[2008/05/16 11:58:04 | 000,012,632 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2008/05/12 21:26:14 | 000,000,081 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2008/05/12 13:25:03 | 000,000,155 | ---- | C] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\fusioncache.dat
[2008/04/22 17:19:09 | 000,000,032 | -HS- | C] () -- C:\WINDOWS\{B428AE5B-C578-4C4D-A3C1-2B7DADCDB3FC}.dat
[2008/04/22 17:18:45 | 000,000,032 | -HS- | C] () -- C:\WINDOWS\{7C77F750-C004-4502-9BA4-69637E586D0D}.dat
[2008/04/22 17:17:45 | 000,000,032 | -HS- | C] () -- C:\WINDOWS\{5AD50E0C-E3E6-4899-81DA-24F12F49D8FB}.dat
[2008/04/22 17:16:13 | 000,000,032 | -HS- | C] () -- C:\WINDOWS\{FF57887D-7ED1-4813-9937-0EFBEB0D0E46}.dat
[2008/04/22 17:16:13 | 000,000,032 | -HS- | C] () -- C:\WINDOWS\{2D6F3411-9D88-4E6D-882C-951F8CA27975}.dat
[2008/04/22 17:16:13 | 000,000,032 | -HS- | C] () -- C:\WINDOWS\{10C0BD75-7D1C-4868-9DEA-91555F8C6D0D}.dat
[2008/04/22 17:14:56 | 000,000,032 | -HS- | C] () -- C:\WINDOWS\{E3E8ED82-A6E6-4396-BC0A-8BAACAB5188C}.dat
[2008/03/31 19:22:10 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2008/02/14 17:54:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2008/02/12 22:00:18 | 000,000,392 | ---- | C] () -- C:\WINDOWS\Trpmaker.INI
[2007/10/18 12:58:32 | 000,001,125 | ---- | C] () -- C:\WINDOWS\checkip.dat
[2007/10/18 12:54:15 | 000,001,803 | ---- | C] () -- C:\WINDOWS\ipconfig.dat
[2007/09/27 11:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/08/07 22:03:44 | 000,000,055 | ---- | C] () -- C:\WINDOWS\QRPhotoDVDSlideshow.INI
[2006/09/04 08:36:40 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2006/08/22 12:55:16 | 000,000,300 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/21 00:03:26 | 000,000,026 | ---- | C] () -- C:\WINDOWS\dvdSanta.INI
[2006/07/08 20:06:31 | 000,000,043 | ---- | C] () -- C:\WINDOWS\hpfccopy.INI
[2006/07/03 20:46:59 | 000,000,196 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2006/06/14 20:13:23 | 000,000,016 | ---- | C] () -- C:\WINDOWS\popcinfo.dat
[2006/06/03 16:06:18 | 000,000,227 | ---- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2006/06/03 16:05:53 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2006/06/03 16:03:53 | 000,000,206 | ---- | C] () -- C:\WINDOWS\HPGdiPlus.ini
[2006/06/03 16:02:43 | 000,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2006/05/26 23:29:56 | 000,000,251 | ---- | C] () -- C:\Program Files\wt3d.ini
[2006/05/26 21:03:25 | 000,001,775 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006/02/15 17:20:38 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/02/15 16:57:30 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys
[2006/02/15 16:53:19 | 000,118,842 | R--- | C] () -- C:\WINDOWS\HPCPCUninstaller-6.3.2.116-9972322.exe
[2006/02/15 16:52:32 | 000,014,316 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2006/02/15 16:52:25 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2006/02/15 16:50:12 | 000,000,054 | ---- | C] () -- C:\WINDOWS\Quicken.ini
[2006/02/15 16:47:35 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/02/15 16:38:19 | 000,004,521 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/02/15 16:37:04 | 000,045,929 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/02/15 16:37:04 | 000,000,698 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/02/15 16:31:51 | 000,080,417 | ---- | C] () -- C:\WINDOWS\HPHins08.dat
[2006/02/15 16:31:51 | 000,004,011 | ---- | C] () -- C:\WINDOWS\hphmdl08.dat
[2006/02/15 16:30:59 | 000,072,881 | ---- | C] () -- C:\WINDOWS\hpiins01.dat
[2006/02/15 16:30:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpimdl01.dat
[2006/02/15 16:27:45 | 000,087,276 | ---- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/02/15 16:26:17 | 000,112,873 | ---- | C] () -- C:\WINDOWS\hpoins07.dat
[2006/02/15 16:26:16 | 000,021,124 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat
[2006/02/15 16:23:22 | 000,088,403 | ---- | C] () -- C:\WINDOWS\hpoins06.dat
[2006/02/15 16:23:22 | 000,005,389 | ---- | C] () -- C:\WINDOWS\hpomdl06.dat
[2006/02/15 16:22:22 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2006/02/15 16:18:59 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/02/15 16:18:59 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/02/15 16:18:59 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/02/15 16:18:59 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/02/15 16:18:58 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/02/15 16:18:58 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/02/15 16:18:58 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/02/15 16:18:58 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/02/15 16:18:58 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/02/15 16:18:58 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/02/15 16:18:58 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/02/15 16:17:45 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006/02/15 15:59:40 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll
[2006/02/15 15:59:40 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll
[2006/02/15 15:59:24 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2005/12/09 17:03:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/31 00:17:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/08/31 00:07:46 | 000,465,264 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/08/31 00:07:46 | 000,080,112 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/08/31 00:05:30 | 000,512,176 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/31 00:01:42 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/08/30 23:58:02 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/08/06 01:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/08/03 03:19:16 | 000,050,176 | ---- | C] () -- C:\WINDOWS\armcex.dll
[2005/08/02 17:24:01 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2004/08/10 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 00:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 00:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 00:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 00:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 00:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 00:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 00:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/07/26 10:51:38 | 000,000,537 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2001/08/23 11:12:28 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 11:11:02 | 000,004,490 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/07/07 02:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
[1999/01/22 14:46:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/01/12 04:00:00 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\REGOBJ.DLL

========== LOP Check ==========

[2012/04/22 08:47:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Ad-Aware Antivirus
[2012/04/22 15:09:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Ad-Aware Antivirus
[2013/02/21 14:58:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013/03/28 09:01:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\1Click DVD Copy
[2012/04/22 08:32:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection
[2011/10/19 20:48:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ask
[2013/04/08 16:22:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2009/04/25 19:28:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avery
[2013/01/06 17:12:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/01/15 09:00:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
[2012/11/04 09:12:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon
[2007/11/04 12:18:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web
[2009/02/22 20:26:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2006/05/27 09:44:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2013/03/23 12:09:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
[2011/03/15 08:49:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2006/02/15 16:36:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Digital Interactive Systems Corporation
[2008/12/29 21:17:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EA
[2011/01/13 18:45:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GameTap Web Player
[2012/11/23 19:50:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallMate
[2013/03/24 21:34:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LGSI
[2009/08/09 12:31:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Masque
[2008/01/15 09:25:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2006/06/19 14:51:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2006/09/24 19:45:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Otto
[2011/01/18 23:02:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2011/10/31 20:49:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC1Data
[2012/11/23 19:46:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Premium
[2012/01/13 18:19:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SBT
[2009/08/11 17:46:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2012/08/23 08:29:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2013/01/05 20:06:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/08/13 12:26:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\That Amen Second Book
[2012/09/27 13:16:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TheBflix
[2013/04/09 11:02:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TheBflixUpdater
[2011/11/12 21:46:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2012/11/27 08:46:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VSO
[2009/01/17 11:50:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2006/06/16 19:08:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
[2011/12/30 15:16:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/02/09 21:34:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zylom
[2011/05/07 18:48:27 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012/03/10 21:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/03/27 05:48:00 | 000,000,486 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2013/04/10 19:49:07 | 000,000,580 | -H-- | M] () -- C:\WINDOWS\Tasks\OptimizerProUpdaterTask{169C5ADC-8B17-45CF-A12C-157F7C74B078}.job
[2013/04/05 20:38:00 | 000,000,296 | ---- | M] () -- C:\WINDOWS\Tasks\Reimage Reminder.job
[2013/04/10 19:49:07 | 000,000,556 | -H-- | M] () -- C:\WINDOWS\Tasks\TheBflixUpdaterTask{1B55F978-E9FA-4A15-9048-C4924F55D3A2}.job
[2013/04/10 19:51:30 | 000,000,444 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{BC409505-022D-495D-8DE6-0C2C5BD5125A}.job
[2013/04/10 19:49:07 | 000,000,316 | ---- | M] () -- C:\WINDOWS\Tasks\YourFile Update.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2913008E
@Alternate Data Stream - 96 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:67569BBB
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E49FC3A5
@Alternate Data Stream - 94 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E7EE4FA3
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:FE7A04ADA1209FE4
@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:250711E9
@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69DA000E
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA243C48
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FBE5B8B2
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:26566B27
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ECF54A0E
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:45FE2B4E
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A5135BA4
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3A6F413D
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2881AFC0
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C7F04040
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9549A3BD
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B68494D
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E13861A5
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9B31F16E
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F3239111
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F7872A31
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BAFDD950
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:57DC3B52
< End of report >

#4
gringo_pr

Posted 10 April 2013 - 07:31 PM

Trusted Helper

Malware Removal
7,268 posts

Hello Twinbird

I would like you to run this custom script for me now and when it is complete please give me the report and a status update for the computer.

Run OTL Script

Double-click OTL.exe to start the program.

Copy and Paste the following code into the Posted Image

text box.

:OTL
O4 - HKLM..\Run: [Hq4RmJqLt] C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe ()
O4 - HKU\HP_Administrator.YOUR-4DACD0EA75_ON_C..\Run: [Hq4RmJqLt] C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe ()
[2013/04/08 19:00:03 | 000,161,109 | ---- | M] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\4e78f2a3-26f0-42fd-ab98-6cbe621bc56e
[2013/04/08 18:59:41 | 000,141,312 | ---- | M] () -- C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe


:Files
ipconfig /flushdns /c

:Commands
[PURITY]
[emptyjava]
[EMPTYFLASH]
[reboot]

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Note** if the report does not popup after the computer reboots you can find it here in this folder - C:\_OTL\MovedFiles

It will be named - mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss - are numbers representing the date and time the fix was run.

Let me know How things are doing

Gringo

#5
Twinbird

Posted 10 April 2013 - 09:06 PM

Member

Topic Starter
Member
59 posts

The Ukash screen doesn't appear, thank you so much!! I've posted the contents of the log file below. I will probably update my AV software and do another scan with it just to be safe.

========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Hq4RmJqLt deleted successfully.
C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe moved successfully.
Registry value HKEY_USERS\HP_Administrator.YOUR-4DACD0EA75_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\Hq4RmJqLt deleted successfully.
File C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe not found.
C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\4e78f2a3-26f0-42fd-ab98-6cbe621bc56e moved successfully.
File C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\~tmp3188514018711230792.exe not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
C:\cmd.bat deleted successfully.
C:\cmd.txt deleted successfully.
========== COMMANDS ==========
Error: Unable to interpret <[emptyjava]> in the current context!

[EMPTYFLASH]

User: Administrator
->Temp folder emptied: 31242 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 31242 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: HP_Administrator
->Temp folder emptied: 694484 bytes
->Temporary Internet Files folder emptied: 154831677 bytes
->Java cache emptied: 45007814 bytes
->Flash cache emptied: 71479 bytes

User: HP_Administrator.YOUR-4DACD0EA75
->Temp folder emptied: 241776242 bytes
->Temporary Internet Files folder emptied: 30892702 bytes
->Java cache emptied: 104001732 bytes
->FireFox cache emptied: 11555973 bytes
->Flash cache emptied: 41747 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 278541598 bytes
->Java cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 78396 bytes
->Temporary Internet Files folder emptied: 86591763 bytes

Total Flash Files Cleaned = 910.00 mb

OTLPE by OldTimer - Version 3.1.48.0 log created on 04112013_000541

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Temp\calibre_0.8.36_tmp_ylvgjs\umayvl_plumber_archive\Catherine Mann - Hudsons of Beverly Hills - Propositioned into a Foreign Affair\Catherine Mann - Hudsons of Beverly Hills - Propositioned into a Foreign Affair.html not found!
File\Folder C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Temp\calibre_0.8.36_tmp_ylvgjs\umayvl_plumber_archive\Catherine Mann - Hudsons of Beverly Hills - Propositioned into a Foreign Affair\Catherine Mann - Hudsons of Beverly Hills - Propositioned into a Foreign Affair.opf not found!
File\Folder C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Temp\calibre_0.8.36_tmp_ylvgjs\pnj2h7\Catherine Mann - Hudsons of Beverly Hills - Propositioned into a Foreign Affair\Catherine Mann - Hudsons of Beverly Hills - Propositioned into a Foreign Affair.opf not found!

Registry entries deleted on Reboot...

#6
gringo_pr

Posted 11 April 2013 - 07:11 AM

Trusted Helper

Malware Removal
7,268 posts

Hello Twinbird

That is only the first step so if you have not done it yet please do not run things on your own yet - These are the programs I would like you to run next, if you have any problems with these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
Quit all programs that you may have started.
Please disconnect any USB or external drives from the computer before you run this scan!
For Vista or Windows 7, right-click and select "Run as Administrator to start"
For Windows XP, double-click to start.
Wait until Prescan has finished ...
Then Click on "Scan" button
Wait until the Status box shows "Scan Finished"
click on "delete"
Wait until the Status box shows "Deleting Finished"
Click on "Report" and copy/paste the content of the Notepad into your next reply.
The log should be found in RKreport[1].txt on your Desktop
Exit/Close RogueKiller+

Gringo

#7
Twinbird

Posted 11 April 2013 - 12:30 PM

Member

Topic Starter
Member
59 posts

Here are the logs:

# AdwCleaner v2.200 - Logfile created 04/11/2013 at 14:18:51
# Updated 02/04/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : HP_Administrator - YOUR-4DACD0EA75
# Boot Mode : Normal
# Running from : C:\Documents and Settings\HP_Administrator\Joan's Documents\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

File Deleted : C:\END
File Deleted : C:\user.js
File Deleted : C:\WINDOWS\system32\conduitEngine.tmp
File Deleted : C:\WINDOWS\Tasks\YourFile Update.job
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Ask
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Babylon
Folder Deleted : C:\Documents and Settings\All Users\Application Data\GameTap Web Player
Folder Deleted : C:\Documents and Settings\All Users\Application Data\InstallMate
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Premium
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Tarma Installer
Folder Deleted : C:\Documents and Settings\All Users\Application Data\TheBflix
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Trymedia
Folder Deleted : C:\Program Files\1ClickDownload
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Freeze.com
Folder Deleted : C:\Program Files\GameTap Web Player
Folder Deleted : C:\Program Files\Mininova-Vuze
Folder Deleted : C:\Program Files\MocaFlix
Folder Deleted : C:\Program Files\OApps
Folder Deleted : C:\Program Files\Smartdl
Folder Deleted : C:\Program Files\Somoto_V.1
Folder Deleted : C:\Program Files\TornTV.com
Folder Deleted : C:\Program Files\vShare

***** [Registry] *****

Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\5b5da8de73be949
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\SProtector
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\RewardsArcade
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D51D388B-F5DC-471A-A1CE-5E2D671091C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D51D388B-F5DC-471A-A1CE-5E2D671091C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E306AAA2-3B4F-4802-9FAF-0C10AB78B589}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F72841F0-4EF1-4DF5-BCE5-B3AC8ACF5478}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Mininova-Vuze
Key Deleted : HKCU\Software\PriceGong
Key Deleted : HKCU\Software\RewardsArcade
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKCU\Software\Somoto_V.1
Key Deleted : HKCU\Software\vShare
Key Deleted : HKCU\Software\YourFileDownloader
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\SOFTWARE\5b5da8de73be949
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D51D388B-F5DC-471A-A1CE-5E2D671091C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\oneclick
Key Deleted : HKLM\SOFTWARE\Classes\oneclickmg
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3E315C81-442B-431C-AEC8-ED189699EC24}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B00FE392-639D-4688-976E-A1BFF368CB96}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol
Key Deleted : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol.1
Key Deleted : HKLM\SOFTWARE\Classes\vShare.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\vShare.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers
Key Deleted : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers.1
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pmlghpafmmnmmkjdhacccolfgnkiboco
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04A3F119-A9CF-4708-8F9B-3F51593E6C42}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E82291D-7C83-4529-8CCE-B2BF6B119F6F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{16726771-C380-4280-BAF9-1223B3838786}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Mininova-Vuze Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Somoto_V.1 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\vShare
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{043C5167-00BB-4324-AF7E-62013FAEDACF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D51D388B-F5DC-471A-A1CE-5E2D671091C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E306AAA2-3B4F-4802-9FAF-0C10AB78B589}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mininova-Vuze Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Somoto_V.1 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vShare
Key Deleted : HKLM\Software\Mininova-Vuze
Key Deleted : HKLM\Software\Somoto_V.1
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\Software\YourFileDownloader
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D51D388B-F5DC-471A-A1CE-5E2D671091C0}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D51D388B-F5DC-471A-A1CE-5E2D671091C0}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E306AAA2-3B4F-4802-9FAF-0C10AB78B589}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D51D388B-F5DC-471A-A1CE-5E2D671091C0}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E306AAA2-3B4F-4802-9FAF-0C10AB78B589}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://websearch.mocaflix.com/ --> hxxp://www.google.com

-\\ Mozilla Firefox v [Unable to get version]

*************************

AdwCleaner[S1].txt - [13523 octets] - [11/04/2013 14:18:51]

########## EOF - C:\AdwCleaner[S1].txt - [13584 octets] ##########

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : HP_Administrator [Admin rights]
Mode : Remove -- Date : 04/11/2013 14:29:09
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] arservice.exe -- C:\WINDOWS\arservice.exe [7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 8 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : QuickCet ("C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\QuickCet\QuickCet\QuickCet.exe") [x] -> DELETED
[TASK][SUSP PATH] TheBflixUpdaterTask{1B55F978-E9FA-4A15-9048-C4924F55D3A2}.job : C:\Documents and Settings\All Users\Application Data\TheBflixUpdater\ix_updater.exe /schedule /profilepath "C:\Documents and Settings\All Users\Application Data\TheBflixUpdater\profile.ini" [-] -> DELETED
[TASK][BLPATH] OptimizerProUpdaterTask{169C5ADC-8B17-45CF-A12C-157F7C74B078}.job : C:\Documents and Settings\All Users\Application Data\Premium\OptimizerPro\OptimizerPro.exe /schedule /profilepath "C:\Documents and Settings\All Users\Application Data\Premium\OptimizerPro\profile.ini" [x] -> DELETED
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-21-1972439474-2229743540-1109621959-1008\$ff24043d55f85ce9a20a8337d9b4b888\n.) [x] -> REPLACED (C:\WINDOWS\system32\shell32.dll)
[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-18\$ff24043d55f85ce9a20a8337d9b4b888\n.) [x] -> REPLACED (C:\WINDOWS\system32\wbem\fastprox.dll)

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] ROOT : C:\RECYCLER\S-1-5-18\$ff24043d55f85ce9a20a8337d9b4b888\U --> REMOVED
[ZeroAccess][FOLDER] ROOT : C:\RECYCLER\S-1-5-18\$ff24043d55f85ce9a20a8337d9b4b888\L --> REMOVED
[ZeroAccess][JUNCTION] C:\WINDOWS\$NtUninstallKB3255$ >> \systemroot\system32\config --> REMOVED
[Del.Parent][FILE] @ : C:\WINDOWS\$NtUninstallKB3255$\485945278\@ [-] --> REMOVED
[Del.Parent][FILE] aqaeidou : C:\WINDOWS\$NtUninstallKB3255$\485945278\L\aqaeidou [-] --> REMOVED
[Del.Parent][FOLDER] ROOT : C:\WINDOWS\$NtUninstallKB3255$\485945278\L --> REMOVED
[Del.Parent][FILE] loader.tlb : C:\WINDOWS\$NtUninstallKB3255$\485945278\loader.tlb [-] --> REMOVED
[Del.Parent][FILE] @00000001 : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@00000001 [-] --> REMOVED
[Del.Parent][FILE] @000000c0 : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@000000c0 [-] --> REMOVED
[Del.Parent][FILE] @000000cb : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@000000cb [-] --> REMOVED
[Del.Parent][FILE] @000000cf : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@000000cf [-] --> REMOVED
[Del.Parent][FILE] @80000000 : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@80000000 [-] --> REMOVED
[Del.Parent][FILE] @800000c0 : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@800000c0 [-] --> REMOVED
[Del.Parent][FILE] @800000cb : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@800000cb [-] --> REMOVED
[Del.Parent][FILE] @800000cf : C:\WINDOWS\$NtUninstallKB3255$\485945278\U\@800000cf [-] --> REMOVED
[Del.Parent][FOLDER] ROOT : C:\WINDOWS\$NtUninstallKB3255$\485945278\U --> REMOVED
[Del.Parent][FOLDER] ROOT : C:\WINDOWS\$NtUninstallKB3255$\485945278 --> REMOVED
[Del.Parent][FILE] 728975594 : C:\WINDOWS\$NtUninstallKB3255$\728975594 [-] --> REMOVED
[ZeroAccess][FOLDER] ROOT : C:\WINDOWS\$NtUninstallKB3255$ --> REMOVED

¤¤¤ Driver : [LOADED] ¤¤¤
IRP[IRP_MJ_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] \SystemRoot\System32\Drivers\AnyDVD.sys @ 0xB8FD1F44)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] \SystemRoot\System32\Drivers\AnyDVD.sys @ 0xB8FD3118)

¤¤¤ Infection : ZeroAccess|Rogue.ProgFiles ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3250823AS +++++
--- User ---
[MBR] c9705441b317505d25bc587641b1b1d3
[BSP] 02be4e29c13ca98116e57d99b53da0e6 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 229765 Mo
1 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 470575980 | Size: 8699 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2]_D_04112013_02d1429.txt >>
RKreport[1]_S_04112013_02d1426.txt ; RKreport[2]_D_04112013_02d1429.txt

#8
gringo_pr

Posted 11 April 2013 - 01:59 PM

Trusted Helper

Malware Removal
7,268 posts

Hello Twinbird

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

#9
Twinbird

Posted 11 April 2013 - 04:12 PM

Member

Topic Starter
Member
59 posts

Here is the log from combofix. The computer is running well. Thank you so much for all your help!

ComboFix 13-04-11.01 - HP_Administrator 11/04/2013 17:54:21.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1328 [GMT -4:00]
Running from: c:\documents and settings\HP_Administrator\Joan's Documents\Desktop\ComboFix.exe
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgfinst.dat
c:\documents and settings\All Users\Application Data\TEMP\AVG\avi7.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\crt_x64.msi
c:\documents and settings\All Users\Application Data\TEMP\AVG\files.dat
c:\documents and settings\All Users\Application Data\TEMP\AVG\incavi.avm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_cz.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_da.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_fr.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ge.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_hu.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_id.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_in.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_it.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_jp.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ko.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ms.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_nl.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pb.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pl.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pt.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ru.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sc.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sk.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sp.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_tr.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_us.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zh.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zt.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\microavi.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\miniavi.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.dat
c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.ini
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupcz.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupda.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupfr.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupge.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setuphu.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupid.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupin.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupit.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupjp.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupko.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupms.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupnl.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setuppb.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setuppl.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setuppt.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupru.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupsc.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupsk.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupsp.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setuptr.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupus.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupzh.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\setupzt.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\vcredis1.cab
c:\documents and settings\All Users\Application Data\TEMP\AVG\vcredist.msi
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\HPSU_48BitScanUpdate.log
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\inst.exe
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Mozilla\Firefox\Profiles\1zu3u0kx.default\extensions\[email protected]
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Mozilla\Firefox\Profiles\1zu3u0kx.default\extensions\[email protected]\chrome.manifest
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Mozilla\Firefox\Profiles\1zu3u0kx.default\extensions\[email protected]\chrome\64ffxtbr.jar
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Mozilla\Firefox\Profiles\1zu3u0kx.default\extensions\[email protected]\install.rdf
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\Mozilla\Firefox\Profiles\1zu3u0kx.default\extensions\[email protected]\installKeys.js
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\1.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\1.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\16961.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\17781.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\1858.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\2256.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\4489.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\450.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\946.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\a.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\a.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\b.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\b.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\c.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\c.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\d.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\d.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\e.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\e.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\f.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\f.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\g.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\g.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\h.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\h.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\i.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\i.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\j.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\J.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\k.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\k.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\l.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\l.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\m.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\m.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\n.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\n.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\o.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\o.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\p.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\p.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\q.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\q.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\r.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\r.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\s.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\s.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\t.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\t.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\u.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\u.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\v.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\v.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\w.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\w.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\x.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\x.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\y.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\y.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\z.txt
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\PriceGong\Data\z.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Application Data\vso_ts_preview.xml
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\esjgyzywya.tmp
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\My Documents\iexplore.exe
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\WINDOWS
c:\documents and settings\LocalService\Application Data\34dc7581068S.manifest
c:\documents and settings\NetworkService\Application Data\34dc7581068C.manifest
c:\documents and settings\NetworkService\Application Data\34dc7581068O.manifest
c:\documents and settings\NetworkService\Application Data\34dc7581068S.manifest
c:\documents and settings\NetworkService\Application Data\34dc7581069C.manifest
c:\documents and settings\NetworkService\Application Data\34dc7581069O.manifest
c:\documents and settings\NetworkService\Application Data\34dc7581069S.manifest
c:\program files\TelevisionFanatic
c:\program files\TelevisionFanatic\bar\Cache\00C81CF1
c:\program files\TelevisionFanatic\bar\Cache\00C81F81
c:\program files\TelevisionFanatic\bar\Cache\00C8207B.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C821C3.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C82388.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C825EA.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C82722.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C827AF.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C8286A.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C82907.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C829B3.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C82A6E.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C82AEB.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C82B68.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C82BE5.bmp
c:\program files\TelevisionFanatic\bar\Cache\00C83720.jhtml
c:\program files\TelevisionFanatic\bar\Cache\00C85E20
c:\program files\TelevisionFanatic\bar\Cache\00C87AB1.bmp
c:\program files\TelevisionFanatic\bar\Cache\files.ini
c:\program files\TelevisionFanatic\bar\History\search3
c:\program files\TelevisionFanatic\bar\IE9Mesg\COMMON.T8S
c:\program files\TelevisionFanatic\bar\Message\COMMON.T8S
c:\program files\TelevisionFanatic\bar\Message\COMMON\8_step1.gif
c:\program files\TelevisionFanatic\bar\Message\COMMON\index.htm
c:\program files\TelevisionFanatic\bar\Message\COMMON\rebut4b.htm
c:\program files\TelevisionFanatic\bar\Message\COMMON\shield.png
c:\program files\TelevisionFanatic\bar\Settings\prevcfg2.htm
c:\program files\TelevisionFanatic\bar\Settings\s_pid.dat
c:\program files\TelevisionFanatic\bar\Settings\s_w1.dat
c:\program files\TelevisionFanatic\bar\Settings\s_w2.dat
c:\program files\TelevisionFanatic\bar\Settings\setting3.htm
c:\program files\TelevisionFanatic\TelevisionFanatic\Cache\PopupProperties100016728.html
c:\program files\TelevisionFanatic\TelevisionFanatic\Cache\PopupProperties100016730.html
c:\program files\TelevisionFanatic\TelevisionFanatic\Cache\PopupProperties100065028.html
c:\program files\TelevisionFanatic\TelevisionFanatic\Cache\PopupProperties200821787.html
c:\program files\TelevisionFanatic\TelevisionFanatic\Cache\Radio.html
c:\program files\TelevisionFanatic\TelevisionFanatic\Cache\VideosAffinityBtn.html
c:\program files\TelevisionFanaticEI
C:\Thumbs.db
c:\windows\SET6EB.tmp
c:\windows\system32\830447679
c:\windows\system32\830447679\new.i0
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\dds_log_trash.cmd
c:\windows\system32\ps2.bat
c:\windows\system32\regobj.dll
c:\windows\system32\roboot.exe
c:\windows\system32\tmp.reg
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\system32\uxt55.tmp
c:\windows\wininit.ini
.
c:\windows\system32\drivers\netbt.sys was missing
Restored copy from - c:\windows\system32\dllcache\netbt.sys
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_TELEVISIONFANATICSERVICE
.
.
((((((((((((((((((((((((( Files Created from 2013-03-11 to 2013-04-11 )))))))))))))))))))))))))))))))
.
.
2013-04-11 22:00 . 2008-04-13 19:21 162816 ----a-w- c:\windows\system32\drivers\netbt.sys
2013-04-11 22:00 . 2008-04-13 19:21 162816 ----a-w- c:\windows\system32\dllcache\netbt.sys
2013-04-11 04:08 . 2011-07-13 02:55 2237440 ----a-r- C:\OTLPE.exe
2013-04-11 04:05 . 2013-04-11 04:05 -------- d-----w- C:\_OTL
2013-04-10 22:50 . 2013-04-10 22:50 -------- d---a-w- C:\$Anvi Rescue Disk$
2013-04-10 10:54 . 2013-04-10 14:36 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0
2013-04-10 04:19 . 2013-04-10 04:19 -------- d-----w- c:\windows\Microsoft Antimalware
2013-04-07 13:00 . 2013-03-06 22:32 228600 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-05 12:10 . 2013-04-05 12:10 -------- d-----w- c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\Somoto_V.1
2013-04-05 12:10 . 2013-04-05 12:10 -------- d-----w- c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\QuickCet
2013-03-20 20:28 . 2013-02-12 00:32 12928 ------w- c:\windows\system32\dllcache\usb8023.sys
2013-03-20 20:28 . 2013-02-12 00:32 12928 ------w- c:\windows\system32\dllcache\usb8023x.sys
2013-03-18 07:28 . 2013-03-18 07:28 124504 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-04 18:50 . 2012-01-25 12:34 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-13 13:15 . 2012-04-05 11:12 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-13 13:15 . 2011-05-20 11:39 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-09 12:48 . 2013-03-09 12:48 97176 ----a-w- c:\windows\system32\ElbyCDIO.dll
2013-03-08 08:36 . 2004-08-10 04:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32 . 2004-08-10 11:00 2149888 ------w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50 . 2004-08-10 11:00 2028544 ------w- c:\windows\system32\ntkrnlpa.exe
2013-03-04 09:25 . 2013-03-04 09:25 30616 ----a-w- c:\windows\system32\drivers\ElbyCDIO.sys
2013-03-02 02:06 . 2004-08-10 04:00 916480 ----a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06 . 2004-08-10 04:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06 . 2004-08-10 04:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25 . 2004-08-10 04:00 1867264 ----a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08 . 2004-08-10 04:00 385024 ----a-w- c:\windows\system32\html.iec
2013-02-27 07:56 . 2004-08-10 04:00 2067456 ------w- c:\windows\system32\mstscax.dll
2013-02-12 00:32 . 2008-08-18 12:30 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2004-08-10 04:00 12928 ------w- c:\windows\system32\drivers\usb8023.sys
2013-01-26 03:55 . 2004-08-10 04:00 552448 ------w- c:\windows\system32\oleaut32.dll
2013-01-15 23:50 . 2010-11-10 09:30 226016 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2013-01-15 21:56 . 2012-10-02 12:03 477616 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-01-15 21:56 . 2010-06-03 17:26 473520 ----a-w- c:\windows\system32\deployJava1.dll
2013-01-15 20:14 . 2012-10-02 12:03 73728 ----a-w- c:\windows\system32\javacpl.cpl
2009-01-20 00:34 . 2009-01-20 00:34 3292312 -c--a-w- c:\program files\1clickdvdcopysetupnt5.6.0.0.exe
2010-09-16 19:21 203776 --sh--w- c:\windows\system32\unrar.exe
2010-11-09 12:18 203776 -csh--w- c:\windows\system32\C3DFF7200C46D5344F821A221A7CAFD3\unrar.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnyDVD"="c:\docume~1\HP_ADM~1.YOU\MYDOCU~1\AnyDVD\AnyDVDtray.exe" [2013-03-22 6983768]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-09-20 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"nwiz"="nwiz.exe" [2006-05-10 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 221184]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-10 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"DMAScheduler"="c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe" [2005-11-01 90112]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2012-01-26 2077536]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-10-07 296096]
"Share-to-Web Namespace Daemon"="c:\program files\HP\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-2-15 27136]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoAdminPage"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeStartMenu"= 00000000
"MaxRecentDocs"= 0 (0x0)
"NoWinKey"= 0 (0x0)
"NoNetConnextDisconnect"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoControlPanle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2011-01-31 18:40 12536 ----a-w- c:\windows\system32\avgrsstx.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]
backup=c:\windows\pss\Updates From HP.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Joan's Documents^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Aware Browsing Protection]
2011-10-21 09:09 198032 ----a-w- c:\documents and settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-02-20 17:35 152392 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-09-20 17:02 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2013-04-07 12:31 801112 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AlwaysReady Power Message APP"=ARPWRMSG.EXE
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
.
R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [10/11/2010 5:30 AM 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [10/11/2010 5:30 AM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/11/2010 5:30 AM 226016]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/11/2010 5:30 AM 243152]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [22/04/2012 8:32 AM 332248]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [31/01/2011 2:40 PM 921952]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [31/01/2011 2:40 PM 308136]
R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [10/11/2010 5:29 AM 122448]
R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [10/11/2010 5:29 AM 30288]
R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [10/11/2010 5:29 AM 26192]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S1 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [31/01/2011 2:40 PM 5897808]
S2 SENS32;System Event Notification ; [x]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02/08/2005 5:10 PM 32512]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [28/05/2008 10:34 AM 47360]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
nvrd32
incdsrv
blueletscoaudio
cvsnt
z800bus
TPPWRIF
s117nd5
HFACSVC
rtport
hotspotshieldservice
MagicTune
pwisvc
vmnetuserif
tmtdi
pvservice
forcewarewebinterface
maxbackserviceint
pnmsrv
PGPwded
rupsmon
marvinbus
MR97310_USB_DUAL_CAMERA
cpucoolserver
pnarp
licensemanagersocket
crystaloutputfileserver
AVerBDA
fetnd5bv
tdcmdpst
ooclevercacheagent
KS0108
PSSdk21
SaiU040B
sscdserd
ozoneinstallerservice
webrootenterpriseclientservice
ZTEusbnmea
se58mdm
C-Dilla
usbsermptxp
MKEMUSB
cxusb
ipassconnectengine
xfactorae1
nmwcdcm
knobserv
smsmdd
tcsd_win32.exe
mindretrieve
lvprcsrv
FileDisk
logmein
bb-run
cdr4_2k
egathdrv
ZDPNDIS5
oraclewebassistant
atitool
atimpab
tvald
toddsrv
nhcDriverDevice
wanusb
AmdIde
MRESP50a64
cvslock
pcscnsrv
DLH5X
TPECioCtl
zendcoreapache
sysenforce
wlancig
vnxservice
amdagp
symappcore
mirrorv3
zebrmdm
SndTDriverV32
a016bus
p2pgasvc
pinnaclesys.mediaserver
ovmsmaccessmanager
pdlndtdl
ppmoucls
harmony
hpci
PBADRV
WaveFDE
lemsgt
dladresn
GoToAssist
_iomega_active_disk_service_
trcboot
epsonbidirectionalagent
oracleorahomeclientcache
tbiosdrv
symproxysvc
pnrouter
nmservice
nsm1mdm
nv_agp
mpfirewl
Memctl
rspndr
bltrust
hcwPVRP2
pdlnafac
snpstd
NSNDIS5
modemcsa
SE2Emdm
lxdj_device
VRcore
roxliveshare
awhost32
deltafw
NETw5x32
websenseuserservice
AmdLLD
mediamaxxlservice
savrt
s125mdfl
pcandis5
pcidrv
LXARScan
ipcsvc
issimon
hap16v2k
sfusvc
s116mdfl
nscirda
CXAVXBAR
avipbb
Ndismeetro
ggsemc
qbcfmonitorservice
db2das00
foldersize
ATIBTCAP
dcpflics
s217mgmt
es1371
ASMMAP
rtl8185
PcdrNt
rtl8023
MtxDma0
U81xmgmt
meraksmtp
oracleorahomemanagementserver
MegaSR
{834170a7-af3b-4d34-a757-e05eb29ee96d}
dns4meclient
si3114r
SMCB000
s116unic
lp6nds35
stylexphelper
wlancfg
cdr4_xp
mrvw245
s117mdm
MSMQ
int15.sys
cwafeventrouter
avg7updsvc
atiavaiw
nabtsfec
addfiltr
omnidrv
cfsvcs
rfcomm
tosrfsnd
Fd16_700
automate5
trayman
navex15
epstnt01
EL2000
LUsbKbd
acedrv07
amon
sisidex
slave
zunenetworksvc
blueservice
lvselsus
atkkeyboardservice
viamraid
rwbackupsrv
hmonitor
tmesbs32
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
wscsvc
xmlprov
MHN
BITS
wuauserv
ShellHWDetection
helpsvc
WmdmPmSN
napagent
hkmsvc
.
Rebuilding ... You need to reboot your machine for this to take effect.
.
uploadmgr
TermService
ip6fwhlp
sacsvr
trksvr
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 13:15]
.
2013-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2013-04-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-09-20 23:56]
.
2013-04-01 c:\windows\Tasks\HPCeeSchedule.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2005-09-09 03:22]
.
2013-04-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1972439474-2229743540-1109621959-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]
.
2013-04-11 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1972439474-2229743540-1109621959-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]
.
2013-04-10 c:\windows\Tasks\User_Feed_Synchronization-{BC409505-022D-495D-8DE6-0C2C5BD5125A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 64.71.255.204 64.71.255.198
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
AddRemove-SP_56ec1d15 - c:\program files\MocaFlix\uninstall.exe
AddRemove-vfd-ob - c:\program files\OApps\vfd-ob_uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-11 18:05
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
"value"="?\09\05\17\17\15$?"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3784)
c:\windows\system32\WININET.dll
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\My Documents\AnyDVD\ADvdDiscHlp.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\windows\eHome\ehmsas.exe
c:\program files\HP\HP Share-to-Web\hpgs2wnf.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2013-04-11 18:08:28 - machine was rebooted
ComboFix-quarantined-files.txt 2013-04-11 22:08
.
Pre-Run: 161,409,355,776 bytes free
Post-Run: 162,860,371,968 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 65846872452FFB187AF1E358795E667E

#10
gringo_pr

Posted 11 April 2013 - 05:05 PM

Trusted Helper

Malware Removal
7,268 posts

Hello Twinbird

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

#11
Twinbird

Posted 11 April 2013 - 06:11 PM

Member

Topic Starter
Member
59 posts

Here is the log. The computer is running well.

ComboFix 13-04-11.01 - HP_Administrator 11/04/2013 19:43:07.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1323 [GMT -4:00]
Running from: F:\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Joan's Documents\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2013-03-11 to 2013-04-11 )))))))))))))))))))))))))))))))
.
.
2013-04-11 23:35 . 2008-04-14 00:12 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2013-04-11 23:35 . 2001-08-18 02:36 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2013-04-11 23:35 . 2008-04-14 00:12 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll
2013-04-11 23:35 . 2001-08-18 02:37 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe
2013-04-11 23:35 . 2001-08-18 02:37 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe
2013-04-11 23:35 . 2001-08-18 02:37 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe
2013-04-11 23:35 . 2001-08-17 16:11 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys
2013-04-11 23:35 . 2004-08-04 02:29 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys
2013-04-11 23:35 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2013-04-11 23:35 . 2004-08-04 02:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys
2013-04-11 23:35 . 2008-04-14 00:12 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll
2013-04-11 23:35 . 2004-08-10 04:00 221184 -c--a-w- c:\windows\system32\dllcache\OLD83C.tmp
2013-04-11 23:33 . 2001-08-17 17:28 397502 ----a-w- c:\windows\system32\dllcache\vpctcom.sys
2013-04-11 23:32 . 2001-08-18 02:36 69632 ----a-w- c:\windows\system32\dllcache\umaxu12.dll
2013-04-11 23:31 . 2001-08-18 02:36 31744 ----a-w- c:\windows\system32\dllcache\tp4.dll
2013-04-11 23:30 . 2001-08-17 18:07 28384 ----a-w- c:\windows\system32\dllcache\sym_hi.sys
2013-04-11 23:29 . 2001-08-17 17:56 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys
2013-04-11 23:28 . 2001-08-17 16:12 94698 ----a-w- c:\windows\system32\dllcache\sk98xwin.sys
2013-04-11 23:27 . 2001-08-18 04:36 57856 -c--a-w- c:\windows\system32\dllcache\OLD69E.tmp
2013-04-11 23:26 . 2001-08-17 16:12 19017 ----a-w- c:\windows\system32\dllcache\rtl8029.sys
2013-04-11 23:25 . 2001-08-17 17:28 130942 ----a-w- c:\windows\system32\dllcache\ptserlv.sys
2013-04-11 23:24 . 2001-08-18 02:36 86016 ----a-w- c:\windows\system32\dllcache\pctspk.exe
2013-04-11 23:23 . 2001-08-17 16:50 198144 ----a-w- c:\windows\system32\dllcache\nv3.sys
2013-04-11 23:22 . 2001-08-17 16:50 33088 ----a-w- c:\windows\system32\dllcache\n9i128v2.sys
2013-04-11 23:21 . 2001-08-17 17:48 6016 ----a-w- c:\windows\system32\dllcache\msfsio.sys
2013-04-11 23:20 . 2008-04-13 18:40 7040 ----a-w- c:\windows\system32\dllcache\ltotape.sys
2013-04-11 23:19 . 2004-08-10 04:00 9216 -c--a-w- c:\windows\system32\dllcache\OLD4C6.tmp
2013-04-11 23:18 . 2001-08-17 18:06 38528 ----a-w- c:\windows\system32\dllcache\ibmvcap.sys
2013-04-11 23:17 . 2001-08-17 18:07 25952 ----a-w- c:\windows\system32\dllcache\hpn.sys
2013-04-11 23:16 . 2001-08-17 16:15 442240 ----a-w- c:\windows\system32\dllcache\fpnpbase.sys
2013-04-11 23:15 . 2001-08-17 16:12 18503 ----a-w- c:\windows\system32\dllcache\epro4.sys
2013-04-11 23:14 . 2001-08-18 02:36 614429 ----a-w- c:\windows\system32\dllcache\digiview.exe
2013-04-11 23:13 . 2001-08-17 16:11 39936 ----a-w- c:\windows\system32\dllcache\cnxt1803.sys
2013-04-11 23:12 . 2001-08-17 17:28 871388 ----a-w- c:\windows\system32\dllcache\bcmdm.sys
2013-04-11 23:11 . 2008-04-14 00:12 4639 -c--a-w- c:\windows\system32\dllcache\OLDB4.tmp
2013-04-11 22:19 . 2008-04-14 00:11 46592 ----a-w- c:\windows\system32\dllcache\OLD26.tmp
2013-04-11 22:19 . 2008-04-14 00:09 76288 ----a-w- c:\windows\system32\dllcache\OLD23.tmp
2013-04-11 22:19 . 2008-04-14 00:12 188480 ----a-w- c:\windows\system32\dllcache\OLD20.tmp
2013-04-11 22:19 . 2008-04-14 00:09 275968 ----a-w- c:\windows\system32\dllcache\OLD1D.tmp
2013-04-11 22:19 . 2004-08-09 21:00 94720 ----a-w- c:\windows\system32\dllcache\OLD1A.tmp
2013-04-11 22:19 . 2008-04-14 00:12 16439 ----a-w- c:\windows\system32\dllcache\OLD17.tmp
2013-04-11 22:19 . 2008-04-14 00:11 20540 ----a-w- c:\windows\system32\dllcache\OLD14.tmp
2013-04-11 22:19 . 2008-04-14 00:11 43520 ----a-w- c:\windows\system32\dllcache\OLDE.tmp
2013-04-11 22:19 . 2008-04-14 00:11 290816 ----a-w- c:\windows\system32\dllcache\OLD11.tmp
2013-04-11 22:19 . 2013-04-11 23:35 -------- d-----w- c:\windows\LastGood
2013-04-11 22:19 . 2008-04-14 00:12 16439 ----a-w- c:\windows\system32\dllcache\OLDB.tmp
2013-04-11 22:19 . 2008-04-14 00:11 20540 ----a-w- c:\windows\system32\dllcache\OLD8.tmp
2013-04-11 22:00 . 2008-04-13 19:21 162816 ----a-w- c:\windows\system32\drivers\netbt.sys
2013-04-11 22:00 . 2008-04-13 19:21 162816 ----a-w- c:\windows\system32\dllcache\netbt.sys
2013-04-11 04:05 . 2013-04-11 04:05 -------- d-----w- C:\_OTL
2013-04-10 22:50 . 2013-04-10 22:50 -------- d---a-w- C:\$Anvi Rescue Disk$
2013-04-10 10:54 . 2013-04-10 14:36 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0
2013-04-10 04:19 . 2013-04-10 04:19 -------- d-----w- c:\windows\Microsoft Antimalware
2013-04-07 13:00 . 2013-03-06 22:32 228600 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-05 12:10 . 2013-04-05 12:10 -------- d-----w- c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\Somoto_V.1
2013-04-05 12:10 . 2013-04-05 12:10 -------- d-----w- c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\Local Settings\Application Data\QuickCet
2013-03-18 07:28 . 2013-03-18 07:28 124504 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-04 18:50 . 2012-01-25 12:34 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-13 13:15 . 2012-04-05 11:12 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-13 13:15 . 2011-05-20 11:39 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-09 12:48 . 2013-03-09 12:48 97176 ----a-w- c:\windows\system32\ElbyCDIO.dll
2013-03-08 08:36 . 2004-08-10 04:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32 . 2004-08-10 11:00 2149888 ------w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50 . 2004-08-10 11:00 2028544 ------w- c:\windows\system32\ntkrnlpa.exe
2013-03-04 09:25 . 2013-03-04 09:25 30616 ----a-w- c:\windows\system32\drivers\ElbyCDIO.sys
2013-03-02 02:06 . 2004-08-10 04:00 916480 ----a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06 . 2004-08-10 04:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06 . 2004-08-10 04:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25 . 2004-08-10 04:00 1867264 ----a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08 . 2004-08-10 04:00 385024 ----a-w- c:\windows\system32\html.iec
2013-02-27 07:56 . 2004-08-10 04:00 2067456 ------w- c:\windows\system32\mstscax.dll
2013-02-12 00:32 . 2008-08-18 12:30 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2004-08-10 04:00 12928 ------w- c:\windows\system32\drivers\usb8023.sys
2013-01-26 03:55 . 2004-08-10 04:00 552448 ------w- c:\windows\system32\oleaut32.dll
2013-01-15 23:50 . 2010-11-10 09:30 226016 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2013-01-15 21:56 . 2012-10-02 12:03 477616 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-01-15 21:56 . 2010-06-03 17:26 473520 ----a-w- c:\windows\system32\deployJava1.dll
2013-01-15 20:14 . 2012-10-02 12:03 73728 ----a-w- c:\windows\system32\javacpl.cpl
2009-01-20 00:34 . 2009-01-20 00:34 3292312 -c--a-w- c:\program files\1clickdvdcopysetupnt5.6.0.0.exe
2010-09-16 19:21 203776 --sh--w- c:\windows\system32\unrar.exe
2010-11-09 12:18 203776 -csh--w- c:\windows\system32\C3DFF7200C46D5344F821A221A7CAFD3\unrar.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnyDVD"="c:\docume~1\HP_ADM~1.YOU\MYDOCU~1\AnyDVD\AnyDVDtray.exe" [2013-03-22 6983768]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-09-20 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"nwiz"="nwiz.exe" [2006-05-10 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 221184]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-10 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"DMAScheduler"="c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe" [2005-11-01 90112]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2012-01-26 2077536]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-10-07 296096]
"Share-to-Web Namespace Daemon"="c:\program files\HP\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-2-15 27136]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoAdminPage"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeStartMenu"= 00000000
"MaxRecentDocs"= 0 (0x0)
"NoWinKey"= 0 (0x0)
"NoNetConnextDisconnect"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoControlPanle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2011-01-31 18:40 12536 ----a-w- c:\windows\system32\avgrsstx.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]
backup=c:\windows\pss\Updates From HP.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Joan's Documents^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Aware Browsing Protection]
2011-10-21 09:09 198032 ----a-w- c:\documents and settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-02-20 17:35 152392 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-09-20 17:02 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2013-04-07 12:31 801112 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AlwaysReady Power Message APP"=ARPWRMSG.EXE
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
.
R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [10/11/2010 5:30 AM 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [10/11/2010 5:30 AM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/11/2010 5:30 AM 226016]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/11/2010 5:30 AM 243152]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [22/04/2012 8:32 AM 332248]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [31/01/2011 2:40 PM 921952]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [31/01/2011 2:40 PM 308136]
R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [10/11/2010 5:29 AM 122448]
R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [10/11/2010 5:29 AM 30288]
R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [10/11/2010 5:29 AM 26192]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S1 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [31/01/2011 2:40 PM 5897808]
S2 SENS32;System Event Notification ; [x]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [02/08/2005 5:10 PM 32512]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [28/05/2008 10:34 AM 47360]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
nvrd32
incdsrv
blueletscoaudio
cvsnt
z800bus
TPPWRIF
s117nd5
HFACSVC
rtport
hotspotshieldservice
MagicTune
pwisvc
vmnetuserif
tmtdi
pvservice
forcewarewebinterface
maxbackserviceint
pnmsrv
PGPwded
rupsmon
marvinbus
MR97310_USB_DUAL_CAMERA
cpucoolserver
pnarp
licensemanagersocket
crystaloutputfileserver
AVerBDA
fetnd5bv
tdcmdpst
ooclevercacheagent
KS0108
PSSdk21
SaiU040B
sscdserd
ozoneinstallerservice
webrootenterpriseclientservice
ZTEusbnmea
se58mdm
C-Dilla
usbsermptxp
MKEMUSB
cxusb
ipassconnectengine
xfactorae1
nmwcdcm
knobserv
smsmdd
tcsd_win32.exe
mindretrieve
lvprcsrv
FileDisk
logmein
bb-run
cdr4_2k
egathdrv
ZDPNDIS5
oraclewebassistant
atitool
atimpab
tvald
toddsrv
nhcDriverDevice
wanusb
AmdIde
MRESP50a64
cvslock
pcscnsrv
DLH5X
TPECioCtl
zendcoreapache
sysenforce
wlancig
vnxservice
amdagp
symappcore
mirrorv3
zebrmdm
SndTDriverV32
a016bus
p2pgasvc
pinnaclesys.mediaserver
ovmsmaccessmanager
pdlndtdl
ppmoucls
harmony
hpci
PBADRV
WaveFDE
lemsgt
dladresn
GoToAssist
_iomega_active_disk_service_
trcboot
epsonbidirectionalagent
oracleorahomeclientcache
tbiosdrv
symproxysvc
pnrouter
nmservice
nsm1mdm
nv_agp
mpfirewl
Memctl
rspndr
bltrust
hcwPVRP2
pdlnafac
snpstd
NSNDIS5
modemcsa
SE2Emdm
lxdj_device
VRcore
roxliveshare
awhost32
deltafw
NETw5x32
websenseuserservice
AmdLLD
mediamaxxlservice
savrt
s125mdfl
pcandis5
pcidrv
LXARScan
ipcsvc
issimon
hap16v2k
sfusvc
s116mdfl
nscirda
CXAVXBAR
avipbb
Ndismeetro
ggsemc
qbcfmonitorservice
db2das00
foldersize
ATIBTCAP
dcpflics
s217mgmt
es1371
ASMMAP
rtl8185
PcdrNt
rtl8023
MtxDma0
U81xmgmt
meraksmtp
oracleorahomemanagementserver
MegaSR
{834170a7-af3b-4d34-a757-e05eb29ee96d}
dns4meclient
si3114r
SMCB000
s116unic
lp6nds35
stylexphelper
wlancfg
cdr4_xp
mrvw245
s117mdm
MSMQ
int15.sys
cwafeventrouter
avg7updsvc
atiavaiw
nabtsfec
addfiltr
omnidrv
cfsvcs
rfcomm
tosrfsnd
Fd16_700
automate5
trayman
navex15
epstnt01
EL2000
LUsbKbd
acedrv07
amon
sisidex
slave
zunenetworksvc
blueservice
lvselsus
atkkeyboardservice
viamraid
rwbackupsrv
hmonitor
tmesbs32
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
wscsvc
xmlprov
MHN
BITS
wuauserv
ShellHWDetection
helpsvc
WmdmPmSN
napagent
hkmsvc
uploadmgr
TermService
ip6fwhlp
sacsvr
trksvr
.
Rebuilding ... You need to reboot your machine for this to take effect.
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 13:15]
.
2013-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2013-04-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-09-20 23:56]
.
2013-04-01 c:\windows\Tasks\HPCeeSchedule.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2005-09-09 03:22]
.
2013-04-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1972439474-2229743540-1109621959-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]
.
2013-04-11 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1972439474-2229743540-1109621959-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]
.
2013-04-11 c:\windows\Tasks\User_Feed_Synchronization-{BC409505-022D-495D-8DE6-0C2C5BD5125A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 64.71.255.204 64.71.255.198
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-11 19:55
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
"value"="?\09\05\17\17\15$?"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3888)
c:\windows\system32\WININET.dll
c:\documents and settings\HP_Administrator.YOUR-4DACD0EA75\My Documents\AnyDVD\ADvdDiscHlp.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-04-11 20:01:00
ComboFix-quarantined-files.txt 2013-04-12 00:00
.
Pre-Run: 162,128,953,344 bytes free
Post-Run: 162,109,816,832 bytes free
.
- - End Of File - - 98A24FA3AC542FE7528A2EB24D62DF8E

#12
gringo_pr

Posted 11 April 2013 - 07:52 PM

Trusted Helper

Malware Removal
7,268 posts

Hello Twinbird

I would like to see a report that combofix makes.

extra combofix report

push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
please copy and past the following into the box

C:\Qoobox\Add-Remove Programs.txt

click ok

copy and paste the report into this topic for me to review

Gringo

#13
Twinbird

Posted 11 April 2013 - 09:06 PM

Member

Topic Starter
Member
59 posts

µTorrent
1Click DVD Copy 5.9.7.5
Acrobat.com
Ad-Aware Browsing Protection
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Reader 9.1.3
Adobe Reader X (10.1.6)
Adobe Shockwave Player 11.5
AiO_Scan
AiO_Scan_CDA
AiOSoftware
AiOSoftwareNPI
AnyDVD
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AVG 9.0
Bejeweled Twist 1.0.3
BufferChm
calibre
CameraDrivers
Canon iP1800 series
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PrintToolBox
Casino Madness 2002 4.0.1
CloneCD
Compatibility Pack for the 2007 Office system
ConvertXtoDVD 4.1.19.365
CP_AtenaShokunin1Config
CP_CalendarTemplates1
cp_LightScribeConfig
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
CP_Panorama1Config
cp_PosterPrintConfig
cp_UpdateProjectsConfig
CueTour
Customer Experience Enhancement
D-Link DHP-300 Utility
Destinations
DivX Setup
DocProc
DocumentViewer
DocumentViewerQFolder
Easy Internet Sign-up
Enhanced Multimedia Keyboard Solution
Fax
Fax_CDA
Freeze.com NetAssistant
FullDPAppQFolder
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB2779562)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
HP Boot Optimizer
HP Deskjet Printer Preload
HP DigitalMedia Archive
HP Document Viewer 5.3
HP DVD Play 1.0
HP Game Console and games
HP Imaging Device Functions 6.0
HP Memories Disc
HP Photo and Imaging 2.0 - Scanners
HP Photosmart 330,380,420,470,7800,8000,8200 Series
HP Photosmart Cameras 5.0
HP Photosmart for Media Center PC
HP Photosmart Premier Software 6.0
HP Product Assistant
HP PSC & OfficeJet 5.3.A
HP PSC & OfficeJet 5.3.B
HP Rhapsody
HP Solution Center & Imaging Support Tools 5.3
HP Update
HP Web Helper
HPProductAssistant
HpSdpAppCoreApp
InstantShareAlert
InstantShareDevices
Internet Explorer (Enable DEP)
iTunes
J2SE Runtime Environment 5.0 Update 3
Jackpot Super Slots 2002 4.0.1
Java Jive
Java™ 6 Update 39
LightScribe 1.4.62.1
Malwarebytes Anti-Malware version 1.75.0.1300
Masque IGT Slots Wolf Run
Masque Slots WMS Double Pack
Microsoft .NET Framework 1.0 Hotfix (KB2604042)
Microsoft .NET Framework 1.0 Hotfix (KB2656378)
Microsoft .NET Framework 1.0 Security Update (KB2698035)
Microsoft .NET Framework 1.0 Security Update (KB2742607)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Away Mode
Microsoft Office 2000 SR-1 Disc 2
Microsoft Office 2000 SR-1 Professional
Microsoft Silverlight
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Web Publishing Wizard 1.52
Microsoft Works
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 4.5
muvee autoProducer unPlugged 1.2
NetAssistant
NewCopy
NewCopy_CDA
NVIDIA Drivers
OptionalContentQFolder
PanoStandAlone
PC-Doctor 5 for Windows
Photo Story 3 for Windows
PhotoGallery
PIXMA Extended Survey Program
PS2
PSPrinters08
PSTAPlugin
Python 2.2 pywin32 extensions (build 203)
Python 2.2.3
QuickCet
Quicken 2006
QuickTime
RandMap
Readme
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Safari
Scan
ScannerCopy
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB2761465)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2799329)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2753842)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2761226)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2778344)
Security Update for Windows XP (KB2779030)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2799494)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820917)
SkinsHP1
Slingo Deluxe
Slingo Quest
Slingo Quest Hawaii [h33t] [oi812heet]
SolutionCenter
Sonic Express Labeler
Sonic MyDVD Plus
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Sonic_PrimoSDK
Status
StreamDirect TV
SunPlus PMP Transcoding
Super Collapse! Puzzle Gallery 4
Syncios version 2.0.3
Tradewinds from HP Media Center (remove only)
TrayApp
TuneUp Utilities Language Pack (en-US)
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2598845)
Update for Windows Internet Explorer 8 (KB2632503)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2492386)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB961503)
Update Rollup 2 for Windows XP Media Center Edition 2005
Updates from HP (remove only)
VC80CRTRedist - 8.0.50727.6195
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
VSO ConvertXToDVD
VSO CopyToDVD 4
Vuze
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
WinPcap 3.1
WinRAR 4.01 (32-bit)
Woodsy Winnings
Xvid 1.2.2 final uninstall
Yahtzee

#14
gringo_pr

Posted 11 April 2013 - 09:14 PM

Trusted Helper

Malware Removal
7,268 posts

Hello

:P2P Warning!:

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur
Once upon a time, P2P file sharing was fairly safe. That is no longer true. P2P programs form a direct conduit on to your computer, their security measures are easily circumvented and malware writers are increasingly exploiting them to spread their wares on to your computer. Further to that, if your P2P program is not configured correctly, your computer may be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to a file sharing network by a badly configured program.

Please read these short reports on the dangers of peer-2-peer programs and file sharing.

FBI Cyber Education Letter
File sharing infects 500,000 computers
USAToday
infoworld

These logs are looking allot better. But we still have some work to do.

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (it does allot better of a job

Programs to remove

µTorrent
Adobe Reader 9.1.3
Adobe Reader X (10.1.6)
J2SE Runtime Environment 5.0 Update 3
Java™ 6 Update 39
Vuze

[/list]

Please download and install Revo Uninstaller Free
Double click Revo Uninstaller to run it.
From the list of programs double click on The Program to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
when prompted click on Yes and then on next.
put a check on any folders that are found and select delete
when prompted select yes then on next
Once done click Finish.

.

Update Adobe reader

Recently there have been vulnerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.

You can download it from http://www.adobe.com.../readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

If you don't like Adobe Reader (53 MB), you can download Foxit PDF Reader(7 MB) from here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.

Note: When installing FoxitReader, be careful not to install anything to do with AskBar.
[/list]

Clean Out Temp Files

This small application you may want to keep and use once a week to keep the computer clean.

Download CCleaner from here http://www.ccleaner.com/
Run the installer to install the application.
When it gives you the option to install Yahoo toolbar uncheck the box next to it.
Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
Click Run Cleaner.
Close CCleaner.

: Malwarebytes' Anti-Malware :

I see you have MBAM installed - I think this is a great program and would like you to run a quick scan at this time

Double-click mbam icon
go to the update tab at the top
click on check for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If you accidentally close it, the log file is saved here and will be named like this:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

Go Here to download HijackThis program
Save HijackThis to your desktop.
Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)
Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)
copy and paste hijackthis report into the topic

"information and logs"

In your next post I need the following

Log From MBAM
report from Hijackthis
let me know of any problems you may have had
How is the computer doing now?

Gringo

#15
Twinbird

Posted 12 April 2013 - 08:20 AM

Member

Topic Starter
Member
59 posts

The computer is running well.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.04.12.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
HP_Administrator :: YOUR-4DACD0EA75 [administrator]

12/04/2013 12:15:41 AM
mbam-log-2013-04-12 (00-15-41).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 266141
Time elapsed: 15 minute(s), 56 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCR\AppID\{186E19A3-B909-4F48-B687-BB81EB8BC7CE} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:11:52 AM, on 12/04/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
c:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\HP_ADM~1.YOU\MYDOCU~1\AnyDVD\AnyDVDtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\msiexec.exe
F:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/w...0"&"ver=9.0.894
O4 - HKCU\..\Run: [AnyDVD] C:\DOCUME~1\HP_ADM~1.YOU\MYDOCU~1\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 9733 bytes

Edited by Twinbird, 12 April 2013 - 08:20 AM.