[myleftfoot]

So here is my situation, A colleague of mine claimed that the computer just stopped working through no fault of their own... so I am trying to pick up the pieces. Initially the operating system would not run so I ended up having to repair windows xp to get it to the point where I could log on as an admin.

Immediately upon logging on various messages pop up.

first message show up as a bubble in the lower right coming off of the quickstart menu and reads "windows Security alert Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other securty threats. click here for the scan you computer. Your system might be at risk now." when I click on the bubble it takes me to some phony screen showing what appears to be a program scanning a computer called "Anti-virus system Pro"

second message that will pop up shows whenever I try and run a program with the title Security Warning and reads "application cannot be executed the file (fill in the blank) do you want to activate your anti-virus software now" if i click no nothing happens and the program will not run. if I click yes it redirects me to another website for antivirus system pro (osquard-pro.com/purchase).

third message that will pop up shows in the left hand corner as a gray square with a title in red stating Antivirus system Pro alert with text reading "INFILTRATION ALERT your computer is being attacked by an internet virus. it could be a password-stealing attack, a trojan-dropper or similar. DETAILS attack from: 201.156.151 60, port 15297 attacked port: 16995

I also am getting random pop ups for viagra and websites like adult.com & [bleep].com among others.

I tried initially running AVG antivirus but whenever I have tried running it or any other anti-virus software (like malwarebytes anti-maleware) I get the first message I described above and the program will not run.

I followed the malware and spyware cleaning guide and was able to get through all of the steps except for running malwarebytes anti-malware.

If you have read this far THANK YOU!!! I really appreciate what you all do it is an invaluable resources and I would sincerely appreciate any help you can offer.

Below is the rootrepeal log followed by OTL log files:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/10/24 14:55
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xA904E000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF79CF000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA7E0F000 Size: 49152 File Visible: No Signed: -
Status: -

==EOF==



*********************************OTL LOG.TXT********************

OTL logfile created on: 10/24/2009 2:58:55 PM - Run 1
OTL by OldTimer - Version 3.0.22.1 Folder = C:\Documents and Settings\Jim Helwig\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 129.05 Gb Total Space | 117.47 Gb Free Space | 91.03% Space Free | Partition Type: NTFS
Drive D: | 20.00 Gb Total Space | 17.63 Gb Free Space | 88.13% Space Free | Partition Type: NTFS
Drive E: | 589.14 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ROYALSHOWROOM
Current User Name: Jim Helwig
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/10/24 14:57:48 | 00,521,728 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
PRC - [2009/10/23 16:12:21 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2009/10/23 16:12:18 | 00,502,040 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2009/10/23 16:12:17 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009/10/23 16:12:17 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2009/10/23 15:53:05 | 00,282,880 | ---- | M] (Microsoft Corporation) -- C:\Program Files\yibkyd\niljsysguard.exe
PRC - [2009/09/15 06:56:48 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009/09/15 06:56:43 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009/09/15 06:49:40 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2008/12/30 15:58:28 | 18,082,304 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE
PRC - [2008/04/14 09:42:30 | 01,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2008/04/14 09:00:00 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe
PRC - [2008/04/14 08:00:00 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008/04/14 08:00:00 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2008/04/14 08:00:00 | 00,050,176 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\proquota.exe
PRC - [2008/04/14 08:00:00 | 00,047,616 | ---- | M] (Netopsystems AG) -- C:\WINDOWS\System32\FastNetSrv.exe
PRC - [2008/04/14 08:00:00 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe
PRC - [2008/02/12 22:12:16 | 00,076,272 | ---- | M] () -- c:\Program Files\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe
PRC - [2007/12/19 11:08:12 | 00,159,744 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\hkcmd.exe
PRC - [2007/12/19 11:08:08 | 00,135,168 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxtray.exe
PRC - [2007/12/19 11:07:42 | 00,131,072 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxpers.exe
PRC - [2007/12/19 11:07:30 | 00,249,856 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxsrvc.exe
PRC - [2007/08/27 17:08:18 | 00,909,312 | ---- | M] (New West Technologies) -- C:\Program Files\New West Technologies\Web Integrator 2.3.1\Web Integrator.exe
PRC - [2004/09/16 06:59:54 | 00,512,046 | ---- | M] (Cherry Gmbh, Auerbach Germany, www.cherry.de) -- C:\Program Files\Cherry\CDI\CDI.exe
PRC - [2002/12/17 17:26:22 | 07,520,337 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
PRC - [2002/12/17 17:23:32 | 00,074,308 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

========== Win32 Services (SafeList) ==========

SRV - [2009/10/23 16:12:17 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd [Auto | Running])
SRV - [2009/09/15 06:56:43 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Running])
SRV - [2009/09/15 06:56:28 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Stopped])
SRV - [2009/09/15 06:54:13 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Stopped])
SRV - [2009/09/15 06:49:40 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Running])
SRV - [2008/07/18 08:43:38 | 00,309,744 | ---- | M] (Sonic Solutions) -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe -- (RoxLiveShare10 [Auto | Stopped])
SRV - [2008/07/18 08:43:32 | 00,166,384 | ---- | M] (Sonic Solutions) -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe -- (RoxWatch10 [Auto | Stopped])
SRV - [2008/07/18 08:43:02 | 01,120,752 | ---- | M] (Sonic Solutions) -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10 [On_Demand | Stopped])
SRV - [2008/04/14 09:00:00 | 00,061,440 | ---- | M] () -- C:\WINDOWS\System32\6to4v32.dll -- (6to4 [Auto | Running])
SRV - [2008/04/14 09:00:00 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2008/04/14 08:00:00 | 00,047,616 | ---- | M] (Netopsystems AG) -- C:\WINDOWS\System32\FastNetSrv.exe -- (fastnetsrv [Auto | Running])
SRV - [2008/03/24 07:35:22 | 00,074,384 | R--- | M] (MicroVision Development, Inc.) -- c:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr [On_Demand | Stopped])
SRV - [2008/02/12 22:12:16 | 00,076,272 | ---- | M] () -- c:\Program Files\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe -- (CEEBC40A-FDED-4C59-B354-939132350B01 [Auto | Running])
SRV - [2007/04/13 07:21:18 | 00,068,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2007/04/13 07:20:52 | 00,033,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2007/01/02 17:27:38 | 00,225,280 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08 [On_Demand | Stopped])
SRV - [2006/10/26 19:49:34 | 00,441,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2006/10/19 00:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2004/10/22 03:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2004/09/16 06:59:54 | 00,512,046 | ---- | M] (Cherry Gmbh, Auerbach Germany, www.cherry.de) -- C:\Program Files\Cherry\CDI\CDI.exe -- (Cherry Device Interface [Auto | Running])
SRV - [2002/12/17 17:26:22 | 07,520,337 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -- (MSSQLSERVER [Auto | Running])
SRV - [2002/12/17 17:23:30 | 00,311,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -- (SQLSERVERAGENT [On_Demand | Stopped])
SRV - [2002/12/17 17:23:30 | 00,066,112 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe -- (MSSQLServerADHelper [On_Demand | Stopped])

========== Modules (SafeList) ==========

MOD - [2009/10/24 14:57:48 | 00,521,728 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
MOD - [2009/07/24 13:28:29 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\nunupofa.dll
MOD - [2009/07/24 13:27:55 | 00,091,136 | -HS- | M] () -- C:\WINDOWS\System32\sisazibo.dll
MOD - [2008/04/14 08:00:00 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008/04/14 08:00:00 | 00,014,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\serwvdrv.dll
MOD - [2008/04/14 08:00:00 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\umdmxfrm.dll

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...p...&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...p...ER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.abacaimports.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: (36 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CherryKeyMan] C:\Program Files\Cherry\KeyMan\KeyMan.exe (Cherry GmbH)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [system tool] C:\Program Files\yibkyd\niljsysguard.exe (Microsoft Corporation)
O4 - HKLM..\Run: [zayupuped] C:\WINDOWS\System32\sisazibo.DLL ()
O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O4 - HKCU..\Run: [system tool] C:\Program Files\yibkyd\niljsysguard.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe File not found
O4 - HKLM..\RunOnce\Setup: [Registering ActiveScan 2.0 Components] C:\Program Files\Panda Security\ActiveScan 2.0\as2guiie.dll (Panda Security)
O4 - HKLM..\RunOnce\Setup: [Registering ActiveScan 2.0 Components.] C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security)
O4 - HKLM..\RunOnce\Setup: [Registering ActiveScan 2.0 Components..] C:\Program Files\Panda Security\ActiveScan 2.0\libcomm.dll (Panda Security, S.L.)
O4 - HKLM..\RunOnce\Setup: [Registering ActiveScan 2.0 Components...] C:\Program Files\Panda Security\ActiveScan 2.0\as2inst.dll (Panda Security)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpzrcv01.LNK = C:\Program Files\HP\Temp\{FA9DF1D1-94FF-49c7-8072-DF96DE1BAC05}\setup\hpzstub.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\Web Integrator.lnk = C:\Program Files\New West Technologies\Web Integrator 2.3.1\Web Integrator.exe (New West Technologies)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableProfileQuota = 1
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send to Keyman - C:\Program Files\Cherry\KeyMan\IEMenuExtKeyman.html ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.mi...b?1209160113562 (WUWebControl Class)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoft...s/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.mac...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\windows\system32\sisazibo.dll) - C:\WINDOWS\System32\sisazibo.dll ()
O20 - AppInit_DLLs: (nunupofa.dll) - C:\WINDOWS\System32\nunupofa.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: hufevugak - {55e8d7b8-a40d-4476-9acc-8fcf205810ce} - C:\WINDOWS\System32\sisazibo.dll ()
O22 - SharedTaskScheduler: {55e8d7b8-a40d-4476-9acc-8fcf205810ce} - kupuhivus - C:\WINDOWS\System32\sisazibo.dll ()
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 20:16:30 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/04/08 16:30:18 | 00,000,048 | -H-- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008/04/14 08:00:00 | 00,000,110 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

NetSvcs: BtwSrv - Service key not found. File not found
NetSvcs: 6to4 - C:\WINDOWS\System32\6to4v32.dll ()
NetSvcs: Ias - Service key not found. File not found
NetSvcs: Iprip - Service key not found. File not found
NetSvcs: Irmon - Service key not found. File not found
NetSvcs: NWCWorkstation - Service key not found. File not found
NetSvcs: Nwsapagent - Service key not found. File not found
NetSvcs: WmdmPmSp - Service key not found. File not found
NetSvcs: helpsvc - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 14 Days ==========

[2009/10/23 16:12:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/10/24 14:37:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/10/24 13:15:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Jim Helwig\Application Data\AVG8
[2009/10/24 14:40:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Jim Helwig\Application Data\Malwarebytes
[2009/10/24 13:37:51 | 00,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2009/10/24 14:33:50 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/10/24 14:46:21 | 00,000,000 | ---D | C] -- C:\Program Files\killit
[2009/10/24 14:37:24 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/10/24 13:19:52 | 00,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2009/10/23 15:53:24 | 00,000,000 | ---D | C] -- C:\Program Files\yibkyd
[2009/10/24 14:57:47 | 00,521,728 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
[2009/10/24 14:53:01 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Jim Helwig\Desktop\RootRepeal.exe
[2009/10/24 14:46:22 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/10/24 14:46:21 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/10/24 14:36:39 | 04,045,536 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Jim Helwig\Desktop\mbam-setup.exe
[2009/10/24 14:34:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/10/24 14:31:36 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\Jim Helwig\Desktop\SysRestorePoint.exe
[2009/10/24 14:23:24 | 00,271,872 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\TFC.exe
[2009/10/24 13:53:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Jim Helwig\Desktop\backups
[2009/10/24 13:38:11 | 00,052,368 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/10/24 13:38:11 | 00,023,152 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/10/24 13:38:10 | 00,027,408 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/10/24 13:38:08 | 00,097,480 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\AvastSS.scr
[2009/10/24 13:38:07 | 00,114,768 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009/10/24 13:38:07 | 00,094,160 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/10/24 13:38:07 | 00,093,424 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009/10/24 13:38:07 | 00,020,560 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/10/24 13:37:53 | 01,279,968 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009/10/24 13:24:00 | 00,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Jim Helwig\Desktop\HijackThis.exe
[2009/10/24 12:57:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2009/10/24 12:55:21 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2009/10/24 12:55:21 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2009/10/24 12:55:21 | 00,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2009/10/24 12:54:32 | 00,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esuimgd.dll
[2009/10/24 12:54:32 | 00,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esunid.dll
[2009/10/24 12:54:32 | 00,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esucmd.dll
[2009/10/24 12:54:18 | 00,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2009/10/23 16:12:38 | 00,000,000 | -H-D | C] -- C:\$AVG
[2009/10/23 16:05:54 | 00,889,840 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Jim Helwig\My Documents\avg_free_stb_all_8_37_cnet.exe
[2009/07/07 14:53:31 | 00,570,128 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Common Files\Dao350.dll

========== Files - Modified Within 14 Days ==========

[1 C:\Documents and Settings\Jim Helwig\My Documents\*.tmp files]
[2009/10/24 14:57:51 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\fanozobu
[2009/10/24 14:57:48 | 00,521,728 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
[2009/10/24 14:54:02 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Desktop\settings.dat
[2009/10/24 14:53:02 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Jim Helwig\Desktop\RootRepeal.exe
[2009/10/24 14:46:24 | 00,000,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/24 14:36:48 | 04,045,536 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Jim Helwig\Desktop\mbam-setup.exe
[2009/10/24 14:34:10 | 00,000,777 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/10/24 14:33:53 | 00,000,621 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Desktop\NTREGOPT.lnk
[2009/10/24 14:33:52 | 00,000,602 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Desktop\ERUNT.lnk
[2009/10/24 14:31:30 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\Jim Helwig\Desktop\SysRestorePoint.exe
[2009/10/24 14:27:24 | 00,012,032 | ---- | M] () -- C:\WINDOWS\System32\iehelper.dll
[2009/10/24 14:26:06 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/24 14:25:26 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/24 14:22:16 | 00,271,872 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\TFC.exe
[2009/10/24 13:53:13 | 00,000,036 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/10/24 13:38:11 | 00,001,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk
[2009/10/24 13:38:07 | 00,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009/10/24 13:37:56 | 01,279,968 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009/10/24 13:24:00 | 00,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Jim Helwig\Desktop\HijackThis.exe
[2009/10/24 13:06:25 | 00,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/24 13:06:25 | 00,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak
[2009/10/24 13:04:56 | 00,503,578 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/10/24 13:04:56 | 00,423,562 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/10/24 13:04:56 | 00,071,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/10/24 12:57:17 | 00,313,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/10/24 12:56:14 | 00,000,288 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2009/10/24 12:53:44 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009/10/24 12:53:43 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2009/10/24 12:53:43 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2009/10/24 12:53:35 | 00,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2009/10/24 12:52:42 | 00,000,488 | RH-- | M] () -- C:\WINDOWS\System32\WindowsLogon.manifest
[2009/10/24 12:52:42 | 00,000,488 | RH-- | M] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\WindowsShell.Manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2009/10/24 12:52:28 | 00,000,705 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/10/24 12:51:47 | 00,023,444 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/10/24 12:50:55 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009/10/24 12:43:06 | 00,004,444 | ---- | M] () -- C:\WINDOWS\System32\pid.PNF
[2009/10/24 12:28:04 | 00,000,231 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/10/23 16:12:32 | 43,648,696 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/10/23 16:12:32 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/10/23 16:12:32 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/10/23 16:12:32 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/10/23 16:12:30 | 00,049,420 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/10/23 16:12:24 | 00,001,517 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/10/23 16:12:23 | 00,113,461 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/10/23 16:12:23 | 00,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2009/10/23 16:05:56 | 00,889,840 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Jim Helwig\My Documents\avg_free_stb_all_8_37_cnet.exe
[2009/10/23 15:53:18 | 00,019,456 | ---- | M] () -- C:\chhite.exe
[2009/10/23 15:53:17 | 00,022,016 | ---- | M] () -- C:\wggam.exe
[2009/10/23 15:53:16 | 00,031,232 | ---- | M] () -- C:\dsiqvib.exe
[2009/10/23 15:53:14 | 00,079,360 | ---- | M] () -- C:\vyiy.exe
[2009/10/23 15:53:05 | 00,399,872 | ---- | M] () -- C:\WINDOWS\System32\~.exe
[2009/10/23 11:27:58 | 00,001,712 | -H-- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Default.rdp
[2009/10/22 17:44:29 | 00,027,348 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\To Do.doc
[2009/10/18 02:36:00 | 00,000,446 | ---- | M] () -- C:\WINDOWS\tasks\Driver Robot.job
[2009/10/17 10:37:36 | 01,870,336 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Staff Schedule - Royal.xls
[2009/10/15 12:27:28 | 00,016,327 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Les Jardins Sales 2009.xlsx
[2009/10/13 15:22:38 | 00,011,512 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Jon Notes.docx

========== Files - No Company Name ==========
[2009/10/24 14:54:02 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Desktop\settings.dat
[2009/10/24 14:46:24 | 00,000,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/24 14:34:10 | 00,000,777 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/10/24 14:33:53 | 00,000,621 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Desktop\NTREGOPT.lnk
[2009/10/24 14:33:52 | 00,000,602 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Desktop\ERUNT.lnk
[2009/10/24 13:38:11 | 00,001,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk
[2009/10/24 13:37:53 | 00,380,928 | ---- | C] () -- C:\WINDOWS\System32\actskin4.ocx
[2009/10/24 13:06:26 | 00,012,598 | ---- | C] () -- C:\WINDOWS\System32\wpa.bak
[2009/10/24 12:55:42 | 00,028,288 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xjis.nls
[2009/10/24 12:55:17 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prcp.nls
[2009/10/24 12:55:17 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prc.nls
[2009/10/24 12:55:16 | 00,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2009/10/24 12:55:01 | 00,047,066 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ksc.nls
[2009/10/24 12:55:00 | 01,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2009/10/24 12:54:52 | 00,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2009/10/24 12:54:51 | 00,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2009/10/24 12:54:50 | 00,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2009/10/24 12:54:41 | 13,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2009/10/24 12:54:37 | 00,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2009/10/24 12:54:34 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2009/10/24 12:54:20 | 00,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2009/10/24 12:54:17 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20949.nls
[2009/10/24 12:54:17 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_864.nls
[2009/10/24 12:54:17 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_862.nls
[2009/10/24 12:54:17 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_858.nls
[2009/10/24 12:54:17 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_720.nls
[2009/10/24 12:54:17 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_870.nls
[2009/10/24 12:54:17 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_708.nls
[2009/10/24 12:54:17 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28596.nls
[2009/10/24 12:54:17 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21027.nls
[2009/10/24 12:54:17 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21025.nls
[2009/10/24 12:54:16 | 00,180,770 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20932.nls
[2009/10/24 12:54:16 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20936.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20924.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20880.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20871.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20838.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20833.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20424.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20423.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20420.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20297.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20290.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20285.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20284.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20280.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20278.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20277.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20273.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20269.nls
[2009/10/24 12:54:16 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20108.nls
[2009/10/24 12:54:15 | 00,189,986 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1361.nls
[2009/10/24 12:54:15 | 00,187,938 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20005.nls
[2009/10/24 12:54:15 | 00,186,402 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20001.nls
[2009/10/24 12:54:15 | 00,185,378 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20003.nls
[2009/10/24 12:54:15 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20004.nls
[2009/10/24 12:54:15 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20000.nls
[2009/10/24 12:54:15 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20002.nls
[2009/10/24 12:54:15 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20107.nls
[2009/10/24 12:54:15 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20106.nls
[2009/10/24 12:54:15 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20105.nls
[2009/10/24 12:54:15 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1149.nls
[2009/10/24 12:54:15 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1148.nls
[2009/10/24 12:54:15 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1147.nls
[2009/10/24 12:54:15 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1146.nls
[2009/10/24 12:54:14 | 00,195,618 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10002.nls
[2009/10/24 12:54:14 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10003.nls
[2009/10/24 12:54:14 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10008.nls
[2009/10/24 12:54:14 | 00,162,850 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10001.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1145.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1144.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1143.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1142.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1141.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1140.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1047.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10021.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10005.nls
[2009/10/24 12:54:14 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10004.nls
[2009/10/24 12:54:13 | 00,082,172 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bopomofo.nls
[2009/10/24 12:54:13 | 00,066,728 | ---- | C] () -- C:\WINDOWS\System32\dllcache\big5.nls
[2009/10/24 12:52:42 | 00,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\WindowsShell.Manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2009/10/24 12:52:37 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2009/10/24 12:27:51 | 02,144,487 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2009/10/24 12:27:51 | 01,296,669 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP3.CAT
[2009/10/24 12:27:51 | 01,088,840 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NTPRINT.CAT
[2009/10/24 12:27:51 | 00,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2009/10/24 12:27:51 | 00,522,220 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2009/10/24 12:27:51 | 00,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2009/10/24 12:27:51 | 00,144,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2009/10/24 12:27:51 | 00,112,918 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2009/10/24 12:27:51 | 00,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2009/10/24 12:27:51 | 00,034,747 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2009/10/24 12:27:51 | 00,034,063 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2009/10/24 12:27:51 | 00,026,991 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2009/10/24 12:27:51 | 00,016,535 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2009/10/24 12:27:51 | 00,014,433 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2009/10/24 12:27:51 | 00,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2009/10/24 12:27:51 | 00,012,363 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2009/10/24 12:27:51 | 00,010,027 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2009/10/24 12:27:51 | 00,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2009/10/24 12:27:51 | 00,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2009/10/23 16:12:24 | 00,001,517 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/10/23 15:55:26 | 00,012,032 | ---- | C] () -- C:\WINDOWS\System32\iehelper.dll
[2009/10/23 15:53:17 | 00,019,456 | ---- | C] () -- C:\chhite.exe
[2009/10/23 15:53:16 | 00,022,016 | ---- | C] () -- C:\wggam.exe
[2009/10/23 15:53:15 | 00,031,232 | ---- | C] () -- C:\dsiqvib.exe
[2009/10/23 15:53:12 | 00,079,360 | ---- | C] () -- C:\vyiy.exe
[2009/10/23 15:53:03 | 00,399,872 | ---- | C] () -- C:\WINDOWS\System32\~.exe
[2009/10/15 12:27:27 | 00,016,327 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\My Documents\Les Jardins Sales 2009.xlsx
[2009/07/24 13:28:29 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\vuyohasu.dll
[2009/07/24 13:28:29 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\vikikeme.dll
[2009/07/24 13:28:29 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\nunupofa.dll
[2009/07/24 13:27:56 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\namiviko.dll
[2009/07/24 13:27:55 | 00,091,136 | -HS- | C] () -- C:\WINDOWS\System32\sisazibo.dll
[2009/07/24 13:27:55 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\zezosivi.dll
[2009/07/23 15:58:28 | 00,091,648 | -HS- | C] () -- C:\WINDOWS\System32\leyivabi.dll
[2009/07/23 15:58:28 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\giniduna.dll
[2009/07/09 13:59:12 | 00,000,362 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/07/09 13:58:55 | 00,000,442 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2009/07/08 16:03:18 | 00,000,048 | ---- | C] () -- C:\WINDOWS\Designer.INI
[2009/07/07 14:53:38 | 00,438,272 | ---- | C] () -- C:\WINDOWS\System32\tls704d.dll
[2009/07/07 14:53:38 | 00,409,600 | ---- | C] () -- C:\WINDOWS\System32\NOVA_API.dll
[2009/07/07 14:53:38 | 00,080,896 | ---- | C] () -- C:\WINDOWS\System32\cmeparse.dll
[2009/07/07 14:53:33 | 00,006,656 | ---- | C] () -- C:\WINDOWS\System32\ipinplus32.dll
[2009/07/07 14:53:31 | 00,073,184 | ---- | C] () -- C:\Program Files\Common Files\dao2535.tlb
[2009/07/07 13:53:46 | 04,803,150 | -H-- | C] () -- C:\Documents and Settings\Jim Helwig\Local Settings\Application Data\IconCache.db
[2009/07/07 13:53:46 | 00,012,328 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/07/07 13:53:46 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Jim Helwig\Application Data\desktop.ini
[2009/07/01 11:33:09 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/07/17 10:17:30 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2008/04/25 20:11:24 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2008/04/25 20:06:01 | 00,000,502 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2008/04/25 20:05:56 | 00,000,705 | ---- | C] () -- C:\WINDOWS\win.ini
[2008/04/25 20:05:56 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini
[2008/04/25 20:05:52 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\6to4v32.dll
[2008/04/25 20:05:52 | 00,002,304 | ---- | C] () -- C:\WINDOWS\System32\isapeep.sys
[2008/04/14 09:00:00 | 00,000,005 | ---- | C] () -- C:\WINDOWS\System32\FInstall.sys
[2007/12/19 11:40:50 | 00,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4906.dll
[2005/10/28 19:18:37 | 00,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL

========== LOP Check ==========

[2009/10/24 14:37:24 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2009/10/23 16:12:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/07/08 15:56:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cherry
[2009/07/08 14:37:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2009/10/24 14:27:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\New West Technologies
[2009/07/01 10:44:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Roxio
[2009/07/01 10:45:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
[2009/10/24 14:40:29 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Jim Helwig\Application Data
[2009/07/08 16:00:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Jim Helwig\Application Data\Cherry
[2008/04/14 09:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/10/18 02:36:00 | 00,000,446 | ---- | M] () -- C:\WINDOWS\Tasks\Driver Robot.job
[2009/10/24 14:26:06 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2009/10/23 15:53:18 | 00,019,456 | ---- | M] () -- C:\chhite.exe
[2009/10/23 15:53:16 | 00,031,232 | ---- | M] () -- C:\dsiqvib.exe
[2009/10/23 15:53:14 | 00,253,440 | ---- | M] (Microsoft Corporation) -- C:\qsdhs.exe
[2009/10/23 15:53:14 | 00,079,360 | ---- | M] () -- C:\vyiy.exe
[2009/10/23 15:53:17 | 00,022,016 | ---- | M] () -- C:\wggam.exe

< %systemroot%\system32\eventlog.dll >
[2008/04/14 08:00:00 | 00,056,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\eventlog.dll

< %systemroot%\system32\scecli.dll >
[2008/04/14 08:00:00 | 00,181,248 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\netlogon.dll >

< %systemroot%\system32\cngaudit.dll >

< %systemroot%\system32\sceclt.dll >

< %systemroot%\ntelogon.dll >

< %systemroot%\system32\logevent.dll >
[2008/04/14 09:00:00 | 00,056,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\logevent.dll

< %systemroot%\system32\drivers\iaStor.sys >
[2007/09/30 04:03:12 | 00,308,248 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\iaStor.sys

< %systemroot%\System32\drivers\nvstor.sys >

< %systemroot%\system32\drivers\atapi.sys >
[2008/04/14 08:00:00 | 00,096,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\atapi.sys

< %systemroot%\system32\drivers\IdeChnDr.sys >
< End of report >


******************************OTL EXTRAS LOG FILE*******************

OTL Extras logfile created on: 10/24/2009 2:58:55 PM - Run 1
OTL by OldTimer - Version 3.0.22.1 Folder = C:\Documents and Settings\Jim Helwig\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 129.05 Gb Total Space | 117.47 Gb Free Space | 91.03% Space Free | Partition Type: NTFS
Drive D: | 20.00 Gb Total Space | 17.63 Gb Free Space | 88.13% Space Free | Partition Type: NTFS
Drive E: | 589.14 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ROYALSHOWROOM
Current User Name: Jim Helwig
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
chm.file [open] -- "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Program Files\Microsoft Retail Management System\Headquarters Client\HQClient.exe" = C:\Program Files\Microsoft Retail Management System\Headquarters Client\HQClient.exe:*:Enabled:Headquarters Client -- (Microsoft Corporation)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found
"C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe -- File not found
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Explorer -- (Microsoft Corporation)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{0C07BD19-3C06-47F7-BC28-990862AA09B3}" = hppscanCM1017
"{0DB2E633-8B54-11D5-94C8-00A0CC56091E}" = Microsoft Retail Management System Headquarters Client
"{0EEDEE2B-7C9D-4584-B2B5-C28C93678BC1}" = EPSON OPOS ADK Version 2.64
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{1B683082-8791-4D00-8ADE-6C8986FCCC68}" = Roxio CinePlayer
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator XE
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{67CA389E-E759-4181-99FA-CD8B63853FB1}" = Roxio Creator XE
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{738C7D52-D1C9-403D-B132-22DD513731D1}" = Cherry Tools V4.1 Rev.6 Build 2
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{C3B8EECB-8144-4D40-8037-9DC26B9DDDBF}" = Microsoft Retail Management System Store Operations
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F2BD6F-CB1F-4CC5-B13A-263299DF5A75}" = Web Integrator 2.3.1
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems PCI-SV92PP Soft Modem
"avast!" = avast! Antivirus
"AVG9Uninstall" = AVG Free 9.0
"CNXT_MODEM_PCI_HSF" = PCI SoftV92 Modem
"Dell Laser MFP 1600n" = Dell Laser MFP 1600n Software Uninstall
"ERUNT_is1" = ERUNT 1.1j
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{F4F2BD6F-CB1F-4CC5-B13A-263299DF5A75}" = Web Integrator 2.3.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"PCCharge Pro" = PCCharge Pro
"PROHYBRIDR" = 2007 Microsoft Office system
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/21/2009 7:58:36 PM | Computer Name = ROYALSHOWROOM | Source = Application Error | ID = 1000
Description = Faulting application soposuser.exe, version 1.3.0.203, faulting module
, version 0.0.0.0, fault address 0x00000000.

[ System Events ]
Error - 10/24/2009 2:23:47 PM | Computer Name = ROYALSHOWROOM | Source = Service Control Manager | ID = 7034
Description = The Cherry Device Interface service terminated unexpectedly. It has
done this 1 time(s).

Error - 10/24/2009 2:23:47 PM | Computer Name = ROYALSHOWROOM | Source = Service Control Manager | ID = 7034
Description = The MSSQLSERVER service terminated unexpectedly. It has done this
1 time(s).

Error - 10/24/2009 2:23:47 PM | Computer Name = ROYALSHOWROOM | Source = Service Control Manager | ID = 7031
Description = The AVG Free WatchDog service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 10/24/2009 2:23:48 PM | Computer Name = ROYALSHOWROOM | Source = Service Control Manager | ID = 7034
Description = The fastnetsrv Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 10/24/2009 2:48:13 PM | Computer Name = ROYALSHOWROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 10/24/2009 2:48:34 PM | Computer Name = ROYALSHOWROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 10/24/2009 2:48:39 PM | Computer Name = ROYALSHOWROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 10/24/2009 2:48:46 PM | Computer Name = ROYALSHOWROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 10/24/2009 2:49:00 PM | Computer Name = ROYALSHOWROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 10/24/2009 2:51:00 PM | Computer Name = ROYALSHOWROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}


< End of report >

[Advertisements]

Hello! Welcome to GeekstoGo! I'm piano9playa5 and will be assisting you with your malware problems. If you have any questions, ask away! Just a few tips to make things go smoothly:

• Please be patient. There may be delays in between my posts, as I must check everything with a moderator before posting.
• Don't run tools you see being used in another topic. Running tools unsupervised can be dangerous.
• Copy\Paste logs in your replies, rather than attaching them, unless I instruct you to do otherwise. This makes things easier for me, and the moderator looking over this topic.

I'll post back some instructions shortly.

[Onaipian]

Hello! Welcome to GeekstoGo! I'm piano9playa5 and will be assisting you with your malware problems. If you have any questions, ask away! Just a few tips to make things go smoothly:

• Please be patient. There may be delays in between my posts, as I must check everything with a moderator before posting.
• Don't run tools you see being used in another topic. Running tools unsupervised can be dangerous.
• Copy\Paste logs in your replies, rather than attaching them, unless I instruct you to do otherwise. This makes things easier for me, and the moderator looking over this topic.

I'll post back some instructions shortly.

[Onaipian]

Hiya!

STEP 1
It appears that you have more than one anti-virus installed on your computer.
While having more than one anti-virus may seem like a benefit to your security, it is quite the opposite. Having more than one anti-virus can cause slowness, conflicts and even more vulnerability to infection!

Please go to Start > Control Panel > Add\Remove Programs.
Remove one of the following products:

avast! Antivirus
AVG Free 9.0



By the looks of things, you don't have a firewall installed!
A firewall allows wanted traffic, while blocking unwanted traffic (Hackers, Viruses, Trojans...) from getting to or from your computer. While firewalls are great, it is advised not to use two firewalls, as they may conflict with each other and decrease the firewall effectiveness.


Some good free firewalls are:

• Comodo - Choose only the Firewall during installation!
• Online Armor FREE
• Sunbelt-Kerio

STEP 2
Run OTL (Double click to run)

• Under the Custom Scans/Fixes box at the bottom, paste in the following:
  
  

  :OTL
  NetSvcs: 6to4 - C:\WINDOWS\System32\6to4v32.dll ()
  MOD - [2009/07/24 13:28:29 | 00,053,760 | -HS- | M] () -- C:\WINDOWS\System32\nunupofa.dll
  MOD - [2009/07/24 13:27:55 | 00,091,136 | -HS- | M] () -- C:\WINDOWS\System32\sisazibo.dl
  O4 - HKLM..\Run: [system tool] C:\Program Files\yibkyd\niljsysguard.exe (Microsoft Corporation)
  O4 - HKLM..\Run: [zayupuped] C:\WINDOWS\System32\sisazibo.DLL ()
  O4 - HKCU..\Run: [system tool] C:\Program Files\yibkyd\niljsysguard.exe (Microsoft Corporation)
  O20 - AppInit_DLLs: (c:\windows\system32\sisazibo.dll) - C:\WINDOWS\System32\sisazibo.dll ()
  O20 - AppInit_DLLs: (nunupofa.dll) - C:\WINDOWS\System32\nunupofa.dll ()
  O21 - SSODL: hufevugak - {55e8d7b8-a40d-4476-9acc-8fcf205810ce} - C:\WINDOWS\System32\sisazibo.dll ()
  O22 - SharedTaskScheduler: {55e8d7b8-a40d-4476-9acc-8fcf205810ce} - kupuhivus - C:\WINDOWS\System32\sisazibo.dll ()
  [2009/10/23 15:53:24 | 00,000,000 | ---D | C] -- C:\Program Files\yibkyd
  [2009/10/24 14:57:51 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\fanozobu
  [2009/10/23 15:53:05 | 00,399,872 | ---- | M] () -- C:\WINDOWS\System32\~.exe
  [2009/10/23 15:53:18 | 00,019,456 | ---- | M] () -- C:\chhite.exe
  [2009/10/23 15:53:16 | 00,031,232 | ---- | M] () -- C:\dsiqvib.exe
  [2009/10/23 15:53:14 | 00,253,440 | ---- | M] (Microsoft Corporation) -- C:\qsdhs.exe
  [2009/10/23 15:53:14 | 00,079,360 | ---- | M] () -- C:\vyiy.exe
  [2009/10/23 15:53:17 | 00,022,016 | ---- | M] () -- C:\wggam.exe
  [2009/07/24 13:28:29 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\vuyohasu.dll
  [2009/07/24 13:28:29 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\vikikeme.dll
  [2009/07/24 13:27:56 | 00,053,760 | -HS- | C] () -- C:\WINDOWS\System32\namiviko.dll
  [2009/07/24 13:27:55 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\zezosivi.dll
  [2009/07/23 15:58:28 | 00,091,648 | -HS- | C] () -- C:\WINDOWS\System32\leyivabi.dll
  [2009/07/23 15:58:28 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\giniduna.dll
  [2009/10/23 15:55:26 | 00,012,032 | ---- | C] () -- C:\WINDOWS\System32\iehelper.dll
  
  :Services
  
  :Reg
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, and accept to reboot your computer when done.
• Upon logging in, a log will open with the results of the last fix. Copy\Paste that back here.

=================================================

Run OTL again.

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

  %systemroot%\*.* /s /r

• Then click the Quick Scan button at the top. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open OTListIt.Txt.
• Please Copy\Paste that log (and the one from above) back here.

STEP 3
You must use Internet Explorer to download this!

Please download Combofix from any of the links below. You must rename it before saving.
Please rename it to svchost.com before saving it to your desktop.

Download Link #1
Download Link #2

=================================
You can refer to this diagram of the Save As... dialogue if necessary:



You will need to change the "Save as type:" to All Files.

==================================


Double click on svchost and follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt so we can continue cleaning the system.

LOGS REQUIRED
Could you please post back the following logs:
Fix Results from OTL
OTListIt.Txt
C:\ComboFix.txt

[myleftfoot]

Here are the logs in order:

All processes killed
========== OTL ==========
6to4 removed from NetSvcs value successfully!
Service\Driver 6to4 stopped successfully.
Service\Driver 6to4 deleted successfully.
LoadLibrary failed for C:\WINDOWS\System32\6to4v32.dll
C:\WINDOWS\System32\6to4v32.dll NOT unregistered.
C:\WINDOWS\System32\6to4v32.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\nunupofa.dll
C:\WINDOWS\System32\nunupofa.dll NOT unregistered.
C:\WINDOWS\System32\nunupofa.dll moved successfully.
Releasing module C:\WINDOWS\system32\nunupofa.dll
No active module named C:\WINDOWS\System32\sisazibo.dl was found!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\system tool deleted successfully.
C:\Program Files\yibkyd\niljsysguard.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\zayupuped deleted successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\sisazibo.DLL
C:\WINDOWS\System32\sisazibo.DLL NOT unregistered.
C:\WINDOWS\System32\sisazibo.DLL moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\system tool deleted successfully.
File C:\Program Files\yibkyd\niljsysguard.exe not found.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\sisazibo.dll scheduled to be deleted on reboot.
File C:\WINDOWS\System32\sisazibo.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:nunupofa.dll deleted successfully.
File C:\WINDOWS\System32\nunupofa.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\hufevugak not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55e8d7b8-a40d-4476-9acc-8fcf205810ce}\ not found.
File C:\WINDOWS\System32\sisazibo.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{55e8d7b8-a40d-4476-9acc-8fcf205810ce} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55e8d7b8-a40d-4476-9acc-8fcf205810ce}\ not found.
File C:\WINDOWS\System32\sisazibo.dll not found.
C:\Program Files\yibkyd moved successfully.
C:\WINDOWS\System32\fanozobu moved successfully.
C:\WINDOWS\system32\~.exe moved successfully.
C:\chhite.exe moved successfully.
C:\dsiqvib.exe moved successfully.
C:\qsdhs.exe moved successfully.
C:\vyiy.exe moved successfully.
C:\wggam.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\vuyohasu.dll
C:\WINDOWS\System32\vuyohasu.dll NOT unregistered.
C:\WINDOWS\System32\vuyohasu.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\vikikeme.dll
C:\WINDOWS\System32\vikikeme.dll NOT unregistered.
C:\WINDOWS\System32\vikikeme.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\namiviko.dll
C:\WINDOWS\System32\namiviko.dll NOT unregistered.
C:\WINDOWS\System32\namiviko.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\zezosivi.dll
C:\WINDOWS\System32\zezosivi.dll NOT unregistered.
C:\WINDOWS\System32\zezosivi.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\leyivabi.dll
C:\WINDOWS\System32\leyivabi.dll NOT unregistered.
C:\WINDOWS\System32\leyivabi.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\giniduna.dll
C:\WINDOWS\System32\giniduna.dll NOT unregistered.
C:\WINDOWS\System32\giniduna.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\System32\iehelper.dll
C:\WINDOWS\System32\iehelper.dll NOT unregistered.
C:\WINDOWS\System32\iehelper.dll moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Jim Helwig
->Temp folder emptied: 60448373 bytes
File delete failed. C:\Documents and Settings\Jim Helwig\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 5273749 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 166637 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I1KLMN6P\w[1].bin scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 121234 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2402044 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mta13187.dll scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_4a0.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_654.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\x1c72338.dll scheduled to be deleted on reboot.
Windows Temp folder emptied: 1582796 bytes
RecycleBin emptied: 1585505 bytes

Total Files Cleaned = 68.36 mb


OTL by OldTimer - Version 3.0.22.1 log created on 10252009_120132

Files\Folders moved on Reboot...
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I1KLMN6P\w[1].bin moved successfully.
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS\temp\mta13187.dll unregistered successfully.
C:\WINDOWS\temp\mta13187.dll moved successfully.
C:\WINDOWS\temp\Perflib_Perfdata_4a0.dat moved successfully.
C:\WINDOWS\temp\Perflib_Perfdata_654.dat moved successfully.
C:\WINDOWS\temp\x1c72338.dll unregistered successfully.
C:\WINDOWS\temp\x1c72338.dll moved successfully.

Registry entries deleted on Reboot...
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\sisazibo.dll scheduled to be deleted on reboot.



OTL logfile created on: 10/25/2009 12:47:47 PM - Run 2
OTL by OldTimer - Version 3.0.22.1 Folder = C:\Documents and Settings\Jim Helwig\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 129.05 Gb Total Space | 118.01 Gb Free Space | 91.45% Space Free | Partition Type: NTFS
Drive D: | 20.00 Gb Total Space | 17.63 Gb Free Space | 88.13% Space Free | Partition Type: NTFS
Drive E: | 589.14 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 7.47 Gb Total Space | 1.86 Gb Free Space | 24.82% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ROYALSHOWROOM
Current User Name: Jim Helwig
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/10/24 13:57:48 | 00,521,728 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
PRC - [2009/09/15 05:56:43 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2008/12/30 14:58:28 | 18,082,304 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE
PRC - [2008/04/14 08:42:30 | 01,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
PRC - [2008/04/14 07:00:00 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008/04/14 07:00:00 | 00,069,120 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\notepad.exe
PRC - [2008/04/14 07:00:00 | 00,050,176 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\proquota.exe
PRC - [2008/04/14 07:00:00 | 00,047,616 | ---- | M] (Netopsystems AG) -- C:\WINDOWS\System32\FastNetSrv.exe
PRC - [2008/04/14 07:00:00 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe
PRC - [2008/02/12 21:12:16 | 00,076,272 | ---- | M] () -- c:\Program Files\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe
PRC - [2007/12/19 10:08:12 | 00,159,744 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\hkcmd.exe
PRC - [2007/12/19 10:08:08 | 00,135,168 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxtray.exe
PRC - [2007/12/19 10:07:42 | 00,131,072 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxpers.exe
PRC - [2007/12/19 10:07:30 | 00,249,856 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxsrvc.exe
PRC - [2007/08/27 16:08:18 | 00,909,312 | ---- | M] (New West Technologies) -- C:\Program Files\New West Technologies\Web Integrator 2.3.1\Web Integrator.exe
PRC - [2004/09/16 05:59:54 | 00,512,046 | ---- | M] (Cherry Gmbh, Auerbach Germany, www.cherry.de) -- C:\Program Files\Cherry\CDI\CDI.exe
PRC - [2002/12/17 16:26:22 | 07,520,337 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
PRC - [2002/12/17 16:23:32 | 00,074,308 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

========== Win32 Services (SafeList) ==========

SRV - [2009/09/15 05:56:43 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Disabled | Running])
SRV - [2008/07/18 07:43:38 | 00,309,744 | ---- | M] (Sonic Solutions) -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe -- (RoxLiveShare10 [Auto | Stopped])
SRV - [2008/07/18 07:43:32 | 00,166,384 | ---- | M] (Sonic Solutions) -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe -- (RoxWatch10 [Auto | Stopped])
SRV - [2008/07/18 07:43:02 | 01,120,752 | ---- | M] (Sonic Solutions) -- c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10 [On_Demand | Stopped])
SRV - [2008/04/14 08:00:00 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2008/04/14 07:00:00 | 00,047,616 | ---- | M] (Netopsystems AG) -- C:\WINDOWS\System32\FastNetSrv.exe -- (fastnetsrv [Auto | Running])
SRV - [2008/04/14 07:00:00 | 00,046,592 | ---- | M] (FTD2XX Software Technology) -- C:\WINDOWS\System32\BtwSrv.dll -- (BtwSrv [Auto | Running])
SRV - [2008/03/24 06:35:22 | 00,074,384 | R--- | M] (MicroVision Development, Inc.) -- c:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr [On_Demand | Stopped])
SRV - [2008/02/12 21:12:16 | 00,076,272 | ---- | M] () -- c:\Program Files\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe -- (CEEBC40A-FDED-4C59-B354-939132350B01 [Auto | Running])
SRV - [2007/04/13 06:21:18 | 00,068,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2007/04/13 06:20:52 | 00,033,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2007/01/02 16:27:38 | 00,225,280 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08 [On_Demand | Stopped])
SRV - [2006/10/26 18:49:34 | 00,441,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2006/10/26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2006/10/18 23:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2004/10/22 02:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2004/09/16 05:59:54 | 00,512,046 | ---- | M] (Cherry Gmbh, Auerbach Germany, www.cherry.de) -- C:\Program Files\Cherry\CDI\CDI.exe -- (Cherry Device Interface [Auto | Running])
SRV - [2002/12/17 16:26:22 | 07,520,337 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -- (MSSQLSERVER [Auto | Running])
SRV - [2002/12/17 16:23:30 | 00,311,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -- (SQLSERVERAGENT [On_Demand | Stopped])
SRV - [2002/12/17 16:23:30 | 00,066,112 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe -- (MSSQLServerADHelper [On_Demand | Stopped])

========== Modules (SafeList) ==========

MOD - [2009/10/24 13:57:48 | 00,521,728 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
MOD - [2009/07/25 12:02:08 | 00,092,160 | -HS- | M] () -- C:\WINDOWS\System32\piyadayi.dll
MOD - [2008/04/14 07:00:00 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
MOD - [2008/04/14 07:00:00 | 00,014,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\serwvdrv.dll
MOD - [2008/04/14 07:00:00 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\umdmxfrm.dll

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...p...&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...p...ER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.abacaimports.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: (146 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.226 osguard-pro.microsoft.com
O1 - Hosts: 91.212.127.226 osguard-pro.com
O1 - Hosts: 91.212.127.226 www.osguard-pro.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [CherryKeyMan] C:\Program Files\Cherry\KeyMan\KeyMan.exe (Cherry GmbH)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [zayupuped] C:\WINDOWS\System32\piyadayi.DLL ()
O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [OTL] C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe (OldTimer Tools)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpzrcv01.LNK = C:\Program Files\HP\Temp\{FA9DF1D1-94FF-49c7-8072-DF96DE1BAC05}\setup\hpzstub.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\Web Integrator.lnk = C:\Program Files\New West Technologies\Web Integrator 2.3.1\Web Integrator.exe (New West Technologies)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableProfileQuota = 1
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send to Keyman - C:\Program Files\Cherry\KeyMan\IEMenuExtKeyman.html ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.mi...b?1209160113562 (WUWebControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - Reg Error: Key error. File not found
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (nunupofa.dll) - File not found
O20 - AppInit_DLLs: (c:\windows\system32\piyadayi.dll) - C:\WINDOWS\System32\piyadayi.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: masogonis - {342ae05c-c74a-4da8-9350-5aada6513dde} - C:\WINDOWS\System32\piyadayi.dll ()
O22 - SharedTaskScheduler: {342ae05c-c74a-4da8-9350-5aada6513dde} - tokatiluy - C:\WINDOWS\System32\piyadayi.dll ()
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 19:16:30 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/04/08 15:30:18 | 00,000,048 | -H-- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008/04/14 07:00:00 | 00,000,110 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 14 Days ==========

[2009/10/24 13:37:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/10/24 13:40:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Jim Helwig\Application Data\Malwarebytes
[2009/10/24 12:37:51 | 00,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2009/10/24 13:33:50 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/10/24 12:19:52 | 00,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2009/10/25 12:01:32 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/10/25 11:16:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2009/10/25 11:13:49 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2009/10/25 11:13:49 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2009/10/25 11:13:49 | 00,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2009/10/25 11:12:59 | 00,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esunid.dll
[2009/10/25 11:12:58 | 00,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esuimgd.dll
[2009/10/25 11:12:58 | 00,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esucmd.dll
[2009/10/25 11:12:47 | 00,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2009/10/24 13:57:47 | 00,521,728 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
[2009/10/24 13:53:01 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Jim Helwig\Desktop\RootRepeal.exe
[2009/10/24 13:36:39 | 04,045,536 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Jim Helwig\Desktop\mbam-setup.exe
[2009/10/24 13:34:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2009/10/24 13:31:36 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\Jim Helwig\Desktop\SysRestorePoint.exe
[2009/10/24 13:23:24 | 00,271,872 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\TFC.exe
[2009/10/24 12:53:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Jim Helwig\Desktop\backups
[2009/10/24 12:24:00 | 00,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Jim Helwig\Desktop\HijackThis.exe
[2009/10/23 15:05:54 | 00,889,840 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Jim Helwig\My Documents\avg_free_stb_all_8_37_cnet.exe
[2009/07/07 13:53:31 | 00,570,128 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Common Files\Dao350.dll

========== Files - Modified Within 14 Days ==========

[1 C:\Documents and Settings\Jim Helwig\My Documents\*.tmp files]
[2009/10/25 12:46:05 | 00,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009/10/25 12:04:22 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/25 12:04:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/25 11:18:58 | 00,423,562 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/10/25 11:18:58 | 00,071,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/10/25 11:18:55 | 00,503,578 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/10/25 11:16:12 | 00,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/25 11:14:47 | 00,000,288 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2009/10/25 11:12:12 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009/10/25 11:12:11 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2009/10/25 11:12:11 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2009/10/25 11:12:01 | 00,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2009/10/25 11:11:10 | 00,000,488 | RH-- | M] () -- C:\WINDOWS\System32\WindowsLogon.manifest
[2009/10/25 11:11:10 | 00,000,488 | RH-- | M] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\WindowsShell.Manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2009/10/25 11:10:55 | 00,000,705 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/10/25 11:10:16 | 00,023,428 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/10/25 11:09:21 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009/10/25 11:04:12 | 00,000,231 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/10/24 14:59:23 | 00,000,146 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009/10/24 13:57:48 | 00,521,728 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\OTL.exe
[2009/10/24 13:54:02 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Desktop\settings.dat
[2009/10/24 13:53:02 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Jim Helwig\Desktop\RootRepeal.exe
[2009/10/24 13:36:48 | 04,045,536 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Jim Helwig\Desktop\mbam-setup.exe
[2009/10/24 13:34:10 | 00,000,777 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/10/24 13:33:53 | 00,000,621 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Desktop\NTREGOPT.lnk
[2009/10/24 13:33:52 | 00,000,602 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\Desktop\ERUNT.lnk
[2009/10/24 13:31:30 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\Jim Helwig\Desktop\SysRestorePoint.exe
[2009/10/24 13:22:16 | 00,271,872 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jim Helwig\Desktop\TFC.exe
[2009/10/24 12:24:00 | 00,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Jim Helwig\Desktop\HijackThis.exe
[2009/10/24 12:19:57 | 00,334,474 | ---- | M] () -- C:\WINDOWS\setupapi.old
[2009/10/24 12:06:25 | 00,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak
[2009/10/24 11:57:17 | 00,313,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/10/24 11:56:37 | 00,004,438 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/10/24 11:43:06 | 00,004,444 | ---- | M] () -- C:\WINDOWS\System32\pid.PNF
[2009/10/23 15:12:23 | 00,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll.install_backup
[2009/10/23 15:05:56 | 00,889,840 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Jim Helwig\My Documents\avg_free_stb_all_8_37_cnet.exe
[2009/10/23 10:27:58 | 00,001,712 | -H-- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Default.rdp
[2009/10/22 16:44:29 | 00,027,348 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\To Do.doc
[2009/10/18 01:36:00 | 00,000,446 | ---- | M] () -- C:\WINDOWS\tasks\Driver Robot.job
[2009/10/17 09:37:36 | 01,870,336 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Staff Schedule - Royal.xls
[2009/10/15 11:27:28 | 00,016,327 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Les Jardins Sales 2009.xlsx
[2009/10/13 14:22:38 | 00,011,512 | ---- | M] () -- C:\Documents and Settings\Jim Helwig\My Documents\Jon Notes.docx

========== Files - No Company Name ==========
[2009/10/25 11:14:11 | 00,028,288 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xjis.nls
[2009/10/25 11:13:44 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prcp.nls
[2009/10/25 11:13:44 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prc.nls
[2009/10/25 11:13:43 | 00,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2009/10/25 11:13:26 | 01,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2009/10/25 11:13:26 | 00,047,066 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ksc.nls
[2009/10/25 11:13:19 | 00,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2009/10/25 11:13:18 | 00,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2009/10/25 11:13:17 | 00,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2009/10/25 11:13:09 | 13,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2009/10/25 11:13:06 | 00,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2009/10/25 11:13:00 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2009/10/25 11:12:49 | 00,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2009/10/25 11:12:47 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_864.nls
[2009/10/25 11:12:47 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_862.nls
[2009/10/25 11:12:47 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_870.nls
[2009/10/25 11:12:46 | 00,180,770 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20932.nls
[2009/10/25 11:12:46 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20949.nls
[2009/10/25 11:12:46 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20936.nls
[2009/10/25 11:12:46 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_858.nls
[2009/10/25 11:12:46 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_720.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_708.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28596.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21027.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21025.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20924.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20880.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20871.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20838.nls
[2009/10/25 11:12:46 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20833.nls
[2009/10/25 11:12:45 | 00,187,938 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20005.nls
[2009/10/25 11:12:45 | 00,185,378 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20003.nls
[2009/10/25 11:12:45 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20004.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20424.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20423.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20420.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20297.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20290.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20285.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20284.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20280.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20278.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20277.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20273.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20269.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20108.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20107.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20106.nls
[2009/10/25 11:12:45 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20105.nls
[2009/10/25 11:12:44 | 00,189,986 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1361.nls
[2009/10/25 11:12:44 | 00,186,402 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20001.nls
[2009/10/25 11:12:44 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20000.nls
[2009/10/25 11:12:44 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20002.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1149.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1148.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1147.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1146.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1145.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1144.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1143.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1142.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1141.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1140.nls
[2009/10/25 11:12:44 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1047.nls
[2009/10/25 11:12:43 | 00,195,618 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10002.nls
[2009/10/25 11:12:43 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10003.nls
[2009/10/25 11:12:43 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10008.nls
[2009/10/25 11:12:43 | 00,162,850 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10001.nls
[2009/10/25 11:12:43 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10021.nls
[2009/10/25 11:12:43 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10005.nls
[2009/10/25 11:12:43 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10004.nls
[2009/10/25 11:12:42 | 00,082,172 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bopomofo.nls
[2009/10/25 11:12:42 | 00,066,728 | ---- | C] () -- C:\WINDOWS\System32\dllcache\big5.nls
[2009/10/25 11:11:10 | 00,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\WindowsShell.Manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2009/10/25 11:11:05 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2009/10/25 11:04:00 | 02,144,487 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2009/10/25 11:04:00 | 01,296,669 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP3.CAT
[2009/10/25 11:04:00 | 01,088,840 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NTPRINT.CAT
[2009/10/25 11:04:00 | 00,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2009/10/25 11:04:00 | 00,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2009/10/25 11:04:00 | 00,144,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2009/10/25 11:04:00 | 00,112,918 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2009/10/25 11:04:00 | 00,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2009/10/25 11:04:00 | 00,034,747 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2009/10/25 11:04:00 | 00,034,063 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2009/10/25 11:04:00 | 00,026,991 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2009/10/25 11:04:00 | 00,016,535 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2009/10/25 11:04:00 | 00,014,433 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2009/10/25 11:04:00 | 00,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2009/10/25 11:04:00 | 00,012,363 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2009/10/25 11:04:00 | 00,010,027 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2009/10/25 11:04:00 | 00,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2009/10/25 11:04:00 | 00,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2009/10/25 11:03:59 | 00,522,220 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2009/10/24 13:54:02 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Desktop\settings.dat
[2009/10/24 13:34:10 | 00,000,777 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2009/10/24 13:33:53 | 00,000,621 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Desktop\NTREGOPT.lnk
[2009/10/24 13:33:52 | 00,000,602 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Desktop\ERUNT.lnk
[2009/10/24 12:06:26 | 00,012,598 | ---- | C] () -- C:\WINDOWS\System32\wpa.bak
[2009/10/15 11:27:27 | 00,016,327 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\My Documents\Les Jardins Sales 2009.xlsx
[2009/07/25 12:02:08 | 00,092,160 | -HS- | C] () -- C:\WINDOWS\System32\piyadayi.dll
[2009/07/25 12:02:08 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\rahobofo.dll
[2009/07/25 11:30:02 | 00,039,424 | -HS- | C] () -- C:\WINDOWS\System32\fawedevi.dll
[2009/07/09 12:59:12 | 00,000,362 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/07/09 12:58:55 | 00,000,442 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2009/07/08 15:03:18 | 00,000,048 | ---- | C] () -- C:\WINDOWS\Designer.INI
[2009/07/07 13:53:38 | 00,438,272 | ---- | C] () -- C:\WINDOWS\System32\tls704d.dll
[2009/07/07 13:53:38 | 00,409,600 | ---- | C] () -- C:\WINDOWS\System32\NOVA_API.dll
[2009/07/07 13:53:38 | 00,080,896 | ---- | C] () -- C:\WINDOWS\System32\cmeparse.dll
[2009/07/07 13:53:33 | 00,006,656 | ---- | C] () -- C:\WINDOWS\System32\ipinplus32.dll
[2009/07/07 13:53:31 | 00,073,184 | ---- | C] () -- C:\Program Files\Common Files\dao2535.tlb
[2009/07/07 12:53:46 | 04,803,150 | -H-- | C] () -- C:\Documents and Settings\Jim Helwig\Local Settings\Application Data\IconCache.db
[2009/07/07 12:53:46 | 00,012,328 | ---- | C] () -- C:\Documents and Settings\Jim Helwig\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/07/07 12:53:46 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Jim Helwig\Application Data\desktop.ini
[2009/07/01 10:33:09 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/07/17 09:17:30 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2008/04/25 19:11:24 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2008/04/25 19:06:01 | 00,000,502 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2008/04/25 19:05:56 | 00,000,705 | ---- | C] () -- C:\WINDOWS\win.ini
[2008/04/25 19:05:56 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini
[2008/04/25 19:05:52 | 00,002,304 | ---- | C] () -- C:\WINDOWS\System32\isapeep.sys
[2008/04/14 08:00:00 | 00,000,005 | ---- | C] () -- C:\WINDOWS\System32\FInstall.sys
[2007/12/19 10:40:50 | 00,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4906.dll
[2005/10/28 18:18:37 | 00,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL

========== LOP Check ==========

[2009/10/25 11:30:33 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2009/07/08 14:56:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cherry
[2009/07/08 13:37:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2009/10/25 12:13:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\New West Technologies
[2009/07/01 09:44:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Roxio
[2009/07/01 09:45:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
[2009/10/25 11:30:22 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Jim Helwig\Application Data
[2009/07/08 15:00:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Jim Helwig\Application Data\Cherry
[2008/04/14 08:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/10/18 01:36:00 | 00,000,446 | ---- | M] () -- C:\WINDOWS\Tasks\Driver Robot.job
[2009/10/25 12:04:22 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========



========== Custom Scans ==========


< %systemroot%\*.* /s /r >
[1 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files]
[2 C:\WINDOWS\inf\*.tmp files]
[1 C:\WINDOWS\Temp\*.tmp files]
[1 C:\WINDOWS\twain_32\*.tmp files]
< End of report >


















ComboFix 09-10-25.01 - Jim Helwig 10/25/2009 15:36.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2531 [GMT -5:00]
Running from: f:\directions anti virus\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1906720710-17957331-2045719416-500
c:\recycler\S-1-5-21-2151571880-3930729355-4174180938-500
c:\windows\Install.txt
c:\windows\system32\certstore.dat
c:\windows\system32\FInstall.sys
c:\windows\system32\Install.txt
c:\windows\system32\isapeep.sys
c:\windows\system32\piyadayi.dll
c:\windows\system32\tumazuba.exe
c:\windows\system32\vuyugije.exe
c:\windows\system32\wbem\proquota.exe
c:\windows\system32\yiyigini.exe
c:\windows\system32\yulumebe.exe
c:\windows\TEMP\mta13187.dll
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_isapeep
-------\Service_isapeep


((((((((((((((((((((((((( Files Created from 2009-09-25 to 2009-10-25 )))))))))))))))))))))))))))))))
.

2009-10-25 16:14 . 2008-04-14 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-10-25 16:13 . 2008-04-14 12:00 21896 -c--a-w- c:\windows\system32\dllcache\tdipx.sys
2009-10-25 16:12 . 2008-04-14 12:00 92160 -c--a-w- c:\windows\system32\dllcache\evntwin.exe
2009-10-25 16:04 . 2008-04-14 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-10-25 16:04 . 2008-04-14 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-10-25 16:04 . 2008-04-14 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-10-25 16:04 . 2008-04-14 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-10-24 18:40 . 2009-10-24 18:40 -------- d-----w- c:\documents and settings\Jim Helwig\Application Data\Malwarebytes
2009-10-24 18:37 . 2009-10-24 18:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-24 18:33 . 2009-10-24 18:34 -------- d-----w- c:\program files\ERUNT
2009-10-24 17:37 . 2009-10-24 17:37 -------- d-----w- c:\program files\Alwil Software
2009-10-24 17:19 . 2009-10-25 17:46 -------- d-----w- c:\program files\Panda Security
2009-10-24 16:27 . 2009-10-24 16:27 -------- d-s---w- c:\windows\system32\config\systemprofile\History
2009-10-03 18:56 . 2009-10-03 18:56 -------- d-----w- c:\documents and settings\Jim Helwig\Local Settings\Application Data\WMTools Downloaded Files

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-25 18:36 . 2009-07-16 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\New West Technologies
2009-10-25 16:10 . 2008-04-26 00:14 23428 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-23 20:16 . 2009-07-07 18:53 -------- d-----w- c:\program files\PCCW
2009-10-23 20:12 . 2009-07-22 18:24 -------- d-----w- c:\program files\AVG
1998-05-15 04:00 . 2009-07-07 18:53 73184 ----a-w- c:\program files\Common Files\dao2535.tlb
1998-04-27 04:00 . 2009-07-07 18:53 570128 ----a-w- c:\program files\Common Files\Dao350.dll
2009-07-25 16:30 . 2009-07-25 16:30 39424 --sha-w- c:\windows\system32\fawedevi.dll
2009-07-23 19:58 . 2009-07-23 19:58 1051682 --sha-w- c:\windows\system32\pehohume.exe
2009-07-25 17:02 . 2009-07-25 17:02 39424 --sha-w- c:\windows\system32\rahobofo.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"CherryKeyMan"="c:\program files\Cherry\KeyMan\KeyMan.exe" [2004-05-07 176180]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-12-30 18082304]

c:\documents and settings\Jim Helwig\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Web Integrator.lnk - c:\program files\New West Technologies\Web Integrator 2.3.1\Web Integrator.exe [2007-8-27 909312]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Retail Management System\\Headquarters Client\\HQClient.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [4/28/2008 1:05 PM 120832]
R2 CEEBC40A-FDED-4C59-B354-939132350B01;Roxio File Backup Service;c:\program files\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe [2/12/2008 9:12 PM 76272]
R2 Cherry Device Interface;Cherry Device Interface;c:\program files\Cherry\CDI\CDI.exe [9/16/2004 5:59 AM 512046]
R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [4/14/2008 7:00 AM 47616]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys --> c:\windows\system32\drivers\pavboot.sys [?]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?]
S2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [4/14/2008 7:00 AM 14336]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [7/18/2008 7:43 AM 309744]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [7/18/2008 7:43 AM 166384]
S3 Ch2kPS2;Cherry PS/2 Keyboard Driver (CDI);c:\windows\system32\drivers\Ch2kPS2.sys [4/22/2004 2:28 PM 121870]
S3 MagEpNt;MagEpNt;c:\windows\system32\drivers\magepnt.sys [7/7/2009 1:53 PM 26304]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [7/18/2008 7:43 AM 1120752]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
btwsrv
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.abacaimports.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Send to Keyman - c:\program files\Cherry\KeyMan\IEMenuExtKeyman.html
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-zayupuped - c:\windows\system32\piyadayi.dll
SharedTaskScheduler-{342ae05c-c74a-4da8-9350-5aada6513dde} - c:\windows\system32\piyadayi.dll
SSODL-masogonis-{342ae05c-c74a-4da8-9350-5aada6513dde} - c:\windows\system32\piyadayi.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-25 15:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(456)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wmdtc.exe
c:\windows\system32\wscntfy.exe
c:\combofix\CF27884.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
c:\windows\system32\lsm32.sys
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-25 15:42 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-25 20:42

Pre-Run: 126,665,199,616 bytes free
Post-Run: 126,558,322,688 bytes free

- - End Of File - - B97C4787F3E8E0F94D048957C99079C0




Thank you again for your help

[Onaipian]

Are there any questions, comments or concerns? At this point, how is the computer running?

Step One
Run OTL (Double click to run)

• Under the Custom Scans/Fixes box at the bottom, paste in the following:
  
  

  :OTL
  O4 - HKLM..\Run: [] File not found
  
  :Reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLs"=""
  
  :Files
  C:\WINDOWS\System32\rahobofo.dll
  C:\WINDOWS\System32\fawedevi.dll
  c:\windows\system32\pehohume.exe
  
  :Commands
  [purity]
  [emptytemp]
  [resethosts]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, and accept to reboot when it's finished.
• During start-up, a log will open. Paste the contents of it back here.

Step Two
Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:

• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on to insert the attachment into your post

Step Three
Please re-open Malwarebytes' Anti-Malware.

• Click the Update tab, and then click Check for Updates.
• After updating, click the Scanner tab.
• Select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.





Step Four
It looks like you don't have Java installed! Java is required to do all kinds of things on the Internet. Online games, Online virusscans, etc.

Upgrading Java:

• Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 15.
• Click the "Download" button to the right.
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
• Click on Continue.
• Click on the link to download Windows Offline Installation (jre-6u15-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u15-windows-i586.exe and select "Run as an Administrator.")

Step Five
Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report... at the bottom.
• Click the Save report... button.
  
  
  
  
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Logs&Info
Remember to post back the following logs:

• OTL Fix Results
• DDS.txt
• Attach.txt (Attached)
• MalwareBytes' Most Recent Log
• Kaspersky Report

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.