[Rorschach112]

do this then

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

[Advertisements]

*Ran TFC then re-booted
*Ran MBAM which didn't find anything - see below log
*Kaspersky: apparently I don't have the right Java player to run this?
Before I did the TFC/ERUNT/MBAM/OTL and began this thread I was trying to update to the latest Java, so maybe something happened then? At any rate, I can't figure out how to get Java installed on my computer now. What I've tried:
In Safe Mode: (1) downloading directly from the Java website (2)transfer Java from a USB drive to the desktop then installing (3) installing Java directly from the USB drive. With all attempts, I'm told I can't install Java in Safe Mode and I should consider a System Restore
In normal mode: (1) downloading directly from Java website (ugh, Mozilla no longer opens in normal mode so I had to go through Internet Explorer)- got a message that IE was not able to open this internet site (2) installing directly from the USB drive- got an error message that the dependency group failed to start.

Any thoughts on how to get this done?
Sorry I haven't been able to produce a meaningful log yet.

Malwarebytes' Anti-Malware 1.44
Database version: 3573
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18865

1/15/2010 6:16:38 PM
mbam-log-2010-01-15 (18-16-38).txt

Scan type: Quick Scan
Objects scanned: 95598
Time elapsed: 4 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[jc27712]

*Ran TFC then re-booted
*Ran MBAM which didn't find anything - see below log
*Kaspersky: apparently I don't have the right Java player to run this?
Before I did the TFC/ERUNT/MBAM/OTL and began this thread I was trying to update to the latest Java, so maybe something happened then? At any rate, I can't figure out how to get Java installed on my computer now. What I've tried:
In Safe Mode: (1) downloading directly from the Java website (2)transfer Java from a USB drive to the desktop then installing (3) installing Java directly from the USB drive. With all attempts, I'm told I can't install Java in Safe Mode and I should consider a System Restore
In normal mode: (1) downloading directly from Java website (ugh, Mozilla no longer opens in normal mode so I had to go through Internet Explorer)- got a message that IE was not able to open this internet site (2) installing directly from the USB drive- got an error message that the dependency group failed to start.

Any thoughts on how to get this done?
Sorry I haven't been able to produce a meaningful log yet.

Malwarebytes' Anti-Malware 1.44
Database version: 3573
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18865

1/15/2010 6:16:38 PM
mbam-log-2010-01-15 (18-16-38).txt

Scan type: Quick Scan
Objects scanned: 95598
Time elapsed: 4 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Rorschach112]

hi

Download TDSSKiller and save it to your Desktop.

• Extract the file and run it.
• Once completed it will create a log in your C:\ drive
• Please post the contents of that log

Please download Dr.Web CureIt . Save it to your desktop:

• Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan.
• This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, select Complete scan.
• Click the green arrow at the right, and the scan will start.
• Click Yes to all if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click File and choose Save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum.
• Please post the Dr.Web.txt report in your next reply
• Close Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.

[jc27712]

I have the Dr.web.txt below. When I was closing, the program didn't seem to think it'd neutralized all the threats and recommended another complete scan. Didn't do that (but did re-boot), let me know if I should repeat.

Unable to run TDSS either before or after DrWeb- the TDSS window pops up but says "Driver load error! Press any key to continue..." and when I press a key, the window closes. As an aside, I'm unable to extract zip files to the desktop- or, when I look in Windows, I can see that the TDSS application is under Desktop, but the icon is missing on the actual desktop. However, I can extract the zip on a different computer, and transfer the TDSS application from a USB drive to the desktop. This is all in safe mode.

Dr.Web.txt

RegUBP2b-Jacqui.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Deleted.;
iaStor.sys.vir;C:\Qoobox\Quarantine\C\Windows\System32\drivers;BackDoor.Tdss.1365;Cured.;
ComboFix.exe\32788R22FWJFW\List-C.bat;C:\Windows\System32\config\systemprofile\Desktop\ComboFix.exe;Probably BATCH.Virus;;
ComboFix.exe;C:\Windows\System32\config\systemprofile\Desktop;Archive contains infected objects;Moved.;
MTSNMOVE.TXT;S:\INOV8LOG;Probably BATCH.Virus;;

[Rorschach112]

can you rename the tdss zip and .exe file to something like svchost.com

it run then ?

[jc27712]

Same problem unfortunately- TDSS window pops up and I get the driver load error message

[Rorschach112]

any redirects ?

[jc27712]

Just realized-
I do have a TDSS.txt log... in fact, 9 of them since that's how many times I attempted to run the program. I imagine this won't really contain a lot of information, but just in case here's the last one:

12:21:29:728 1556 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25
12:21:29:728 1556 ================================================================================
12:21:29:728 1556 SystemInfo:

12:21:29:728 1556 OS Version: 6.0.6002 ServicePack: 2.0
12:21:29:728 1556 Product type: Workstation
12:21:29:728 1556 ComputerName: JACQUI-PC
12:21:29:728 1556 UserName: Jacqui
12:21:29:728 1556 Windows directory: C:\Windows
12:21:29:728 1556 Processor architecture: Intel x86
12:21:29:728 1556 Number of processors: 2
12:21:29:728 1556 Page size: 0x1000
12:21:29:728 1556 Boot type: Safe boot with network
12:21:29:728 1556 ================================================================================
12:21:29:744 1556 UnloadDriverW: NtUnloadDriver error 2
12:21:29:744 1556 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
12:21:29:775 1556 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmd.sys) returned status 00000000
12:21:29:791 1556 LoadDriverW: NtLoadDriver error 646
12:21:29:791 1556 KLMD_DropNLoadW: LoadDriverW(klmd21) error 646
12:21:29:791 1556 UtilityInit: KLMD drop and load failed, trying to open device
12:21:29:791 1556 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)
12:21:29:791 1556 KLMD_OpenDevice: CreateFileW(KLMD201000) error 2
12:21:29:791 1556 Driver load error!
12:21:29:791 1556 UnloadDriverW: NtUnloadDriver error 2
12:21:29:791 1556 KLMD_Unload: UnloadDriverW(klmd21) error 2
12:21:29:791 1556 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmd.sys) returned status 00000000
12:21:29:791 1556 UtilityDeinit: KLMD(ARK) unloaded successfully

[Rorschach112]

might help the developers, keep them there just in case

hows the pc running

[jc27712]

Think we posted at about the same time. Not sure what you meant by "any redirects"?

Computer's still not working - no desktop in normal mode. I haven't tried to run much in normal mode, but the last time I ran MBAM, I attempted it under normal mode and the computer immediately froze. I can open up the Internet Explorer web browser; however, since I can't turn on windows security and Avast hasn't updated itself in the past week, I've been avoiding accessing the internet (except when I tried to ger the latest Java player in hopes of running the online Kaspersky scan)

Developers?

[Rorschach112]

Use your browser and see if your google searches get redirected


and do this

Please download exeHelper to your desktop.

• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• Post the contents of log.txt ( Will be created in the directory where you ran exeHelper.com )

Note : If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together ( they will both be in the one file ).

[jc27712]

Log.txt below. I only ran once since I didn't see anything about errors. Computer's functioning the same.

The majority of the time on firefox, I'm getting through google searches okay. I'm currently using my workplace's Internet connection, and a couple times I instead got to a page that says "BLOCKED," which is what happens when attempting to access a webpage that is not deemed safe (work has very aggressive security). This makes me suspicious however, since these include websites that I can readily access on my work desktop computer. Also, sometimes if I click the link again I get to the correct website, but my work's security is usually very consistent about which websites it doesn't like.

Not getting redirects on internet explorer, though this was historically more frequent on firefox.


exeHelper by Raktor
Build 20091220
Run at 13:28:57 on 01/17/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

[Rorschach112]

[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[jc27712]

OTL log:

OTL logfile created on: 1/17/2010 6:27:12 PM - Run 2
OTL by OldTimer - Version 3.1.21.0 Folder = C:\Users\Jacqui\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18865)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221.65 Gb Total Space | 147.55 Gb Free Space | 66.57% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 3.73 Gb Total Space | 3.64 Gb Free Space | 97.66% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Q: | 9.77 Gb Total Space | 3.38 Gb Free Space | 34.57% Space Free | Partition Type: NTFS
Drive S: | 1.46 Gb Total Space | 0.69 Gb Free Space | 47.15% Space Free | Partition Type: NTFS

Computer Name: JACQUI-PC
Current User Name: Jacqui
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/01/04 08:39:44 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Users\Jacqui\Desktop\OTL.exe
PRC - [2009/04/11 01:27:36 | 02,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/01/20 21:25:33 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe


========== Modules (SafeList) ==========

MOD - [2010/01/04 08:39:44 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Users\Jacqui\Desktop\OTL.exe
MOD - [2009/04/11 01:21:38 | 01,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (SessionLauncher)
SRV - [2009/12/08 14:25:28 | 00,093,320 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2009/11/24 18:51:35 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009/11/24 18:51:21 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009/11/24 18:48:48 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009/11/24 18:43:56 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Stopped] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009/10/28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) [On_Demand | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/10/22 13:57:44 | 00,070,952 | ---- | M] () [Auto | Stopped] -- C:\Program Files\tbh\monitor\bin\tbhMonitor.exe -- (tbhMonitor.exe)
SRV - [2009/09/24 20:27:04 | 00,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/09/13 19:46:08 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/08/24 06:36:45 | 00,377,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2009/05/29 12:41:26 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/05/27 02:27:04 | 29,262,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Disabled | Stopped] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/11/24 21:31:12 | 00,087,904 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2008/11/24 21:31:08 | 00,239,968 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2008/11/24 21:31:08 | 00,045,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2008/11/04 00:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008/10/20 10:36:40 | 00,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2008/09/25 02:36:00 | 00,066,848 | ---- | M] (Lenovo) [Auto | Stopped] -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE -- (Power Manager DBC Service)
SRV - [2008/09/19 15:28:14 | 00,700,416 | ---- | M] (ATI Technologies Inc.) [Auto | Stopped] -- C:\Windows\System32\Ati2evxx.exe -- (Ati External Event Utility)
SRV - [2008/08/08 15:37:04 | 00,041,248 | ---- | M] (Lenovo) [Disabled | Stopped] -- C:\Windows\System32\ibmpmsvc.exe -- (IBMPMSVC)
SRV - [2008/08/07 14:23:18 | 00,238,880 | ---- | M] (Lenovo) [Auto | Stopped] -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe -- (AcSvc)
SRV - [2008/08/07 14:23:16 | 00,116,000 | ---- | M] (Lenovo) [Disabled | Stopped] -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2008/06/13 19:42:54 | 00,779,576 | ---- | M] (Lenovo) [Disabled | Stopped] -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe -- (TSSCoreService)
SRV - [2008/06/13 19:29:44 | 00,746,808 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- c:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)
SRV - [2008/05/29 03:10:56 | 02,058,776 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe -- (UNS) Intel®
SRV - [2008/05/29 03:10:48 | 00,174,616 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\AMT\LMS.exe -- (LMS) Intel®
SRV - [2008/05/24 18:49:32 | 01,155,072 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler)
SRV - [2008/05/24 18:31:24 | 00,950,272 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe -- (TVT Backup Service)
SRV - [2008/05/24 18:17:54 | 00,520,192 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe -- (TVT Backup Protection Service)
SRV - [2008/05/24 17:28:20 | 00,253,952 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe -- (TVT_UpdateMonitor)
SRV - [2008/05/14 18:21:16 | 00,037,416 | ---- | M] (Lenovo.) [Auto | Stopped] -- C:\Windows\System32\TPHDEXLG.exe -- (TPHDEXLGSVC)
SRV - [2008/05/05 22:35:22 | 00,815,104 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008/05/05 22:06:30 | 00,466,944 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008/04/25 10:15:24 | 01,120,752 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2008/03/26 20:45:12 | 00,058,736 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV - [2008/03/24 09:35:22 | 00,074,384 | R--- | M] (MicroVision Development, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2008/03/17 12:32:08 | 00,518,696 | ---- | M] (Broadcom Corporation.) [Disabled | Stopped] -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe -- (btwdins)
SRV - [2008/01/20 21:23:32 | 00,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/11 19:50:16 | 00,030,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2007/10/18 01:37:04 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) [Disabled | Stopped] -- C:\Windows\System32\drivers\XAudio.exe -- (XAudioService)
SRV - [2007/09/10 23:45:04 | 00,124,832 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0)
SRV - [2007/01/04 21:48:52 | 00,112,152 | R--- | M] (InterVideo) [Disabled | Stopped] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006/11/02 07:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\ehome\ehstart.dll -- (ehstart)
SRV - [2006/10/26 16:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006/10/16 02:17:18 | 00,276,000 | ---- | M] (Pure Networks, Inc.) [Disabled | Stopped] -- C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe -- (nmservice)
SRV - [2004/10/22 05:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4B 18 1F A8 08 85 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{1B50C348-D2A2-4A96-85E2-90BC7E77E01F}: C:\Windows\system32\config\systemprofile\AppData\Local\{1B50C348-D2A2-4A96-85E2-90BC7E77E01F}\ [2009/12/24 17:55:35 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/01/06 21:31:38 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 20:05:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/07 20:05:01 | 00,000,000 | ---D | M]

[2010/01/09 01:07:47 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/02/07 20:46:12 | 00,087,360 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\CgpCore.dll
[2008/02/07 20:46:20 | 00,091,448 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\confmgr.dll
[2008/02/07 20:46:16 | 00,021,824 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\ctxlogging.dll
[2007/03/16 16:27:00 | 00,479,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\msvcm80.dll
[2007/03/16 16:27:00 | 00,548,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\msvcp80.dll
[2007/03/16 16:27:00 | 00,626,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\msvcr80.dll
[2008/02/07 20:48:26 | 00,419,136 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npicaN.dll
[2008/02/07 20:46:12 | 00,024,384 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\TcpPServ.dll
[2010/01/07 20:06:48 | 00,002,024 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\McSiteAdvisor.xml

O1 HOSTS File: (806 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O2 - BHO: (IePasswordManagerHelper Class) - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [combofix] C:\ComboFix\CF13750.cfx File not found
O4 - HKLM..\Run: [Samsung Common SM] C:\Windows\Samsung\ComSMMgr\ssmmgr.exe File not found
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\RunOnce: [] File not found
O4 - HKLM..\RunOnce: [combofix] C:\ComboFix\CF13750.cfx File not found
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = [binary data]
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : Lenovo Password Manager... - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/...SetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\puresp.dll (Pure Networks, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/01/16 14:02:06 | 00,000,000 | ---D | C] -- C:\Windows\system32\config\systemprofile\DoctorWeb
[2010/01/15 18:11:57 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/01/15 18:11:55 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/01/15 18:11:55 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/14 19:19:16 | 00,000,000 | ---D | C] -- C:\Windows\temp
[2010/01/14 19:11:42 | 00,000,000 | --SD | C] -- C:\ComboFix
[2010/01/14 19:11:42 | 00,000,000 | --SD | C] -- \ComboFix
[2010/01/14 19:11:23 | 00,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/01/14 19:11:22 | 00,000,000 | ---D | C] -- C:\32788R22FWJFW
[2010/01/14 19:11:22 | 00,000,000 | ---D | C] -- \32788R22FWJFW
[2010/01/14 12:35:51 | 00,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/01/14 12:35:51 | 00,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/01/14 12:35:51 | 00,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/01/10 20:58:55 | 00,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2010/01/10 20:25:19 | 00,000,000 | ---D | C] -- C:\Qoobox
[2010/01/10 20:25:19 | 00,000,000 | ---D | C] -- \Qoobox
[2010/01/08 20:45:51 | 00,000,000 | ---D | C] -- C:\_OTL
[2010/01/08 20:45:51 | 00,000,000 | ---D | C] -- \_OTL
[2010/01/07 23:12:04 | 00,000,000 | ---D | C] -- C:\Windows\Minidump
[2010/01/06 22:28:08 | 00,000,000 | ---D | C] -- C:\Program Files\FileHippo.com
[2010/01/06 21:31:36 | 00,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010/01/06 21:29:48 | 00,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/01/06 21:28:02 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2010/01/06 21:26:32 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\McAfee
[2010/01/06 21:26:23 | 00,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2010/01/06 21:26:23 | 00,000,000 | ---D | C] -- C:\Program Files\McAfee
[2010/01/06 20:53:03 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/01/06 20:51:47 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/01/06 20:51:22 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT

========== Files - Modified Within 14 Days ==========

[2010/01/17 18:16:33 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/01/17 13:33:04 | 00,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010/01/17 13:32:04 | 00,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/01/17 13:32:04 | 00,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/01/17 13:31:47 | 00,425,416 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/01/17 12:18:01 | 00,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/01/17 12:18:01 | 00,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/01/16 14:15:57 | 00,000,806 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/01/15 18:11:59 | 00,000,828 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/08 20:53:31 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/01/08 20:53:00 | 00,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{FB23E694-9CD4-4248-8A1C-0C173EFDD2D6}.job
[2010/01/08 20:48:16 | 00,000,256 | ---- | M] () -- C:\Windows\tasks\Check Updates for Windows Live Toolbar.job
[2010/01/07 23:23:34 | 31,721,4718 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/01/07 22:43:00 | 00,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 2).job
[2010/01/07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/01/07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/01/06 21:29:52 | 00,000,912 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

========== Files Created - No Company Name ==========

[2010/01/17 12:21:29 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_17.01.2010_12.21.29_log.txt
[2010/01/17 12:20:12 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_17.01.2010_12.20.12_log.txt
[2010/01/17 12:18:01 | 00,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2010/01/17 12:18:01 | 00,000,000 | RHS- | C] () -- \MSDOS.SYS
[2010/01/17 12:18:01 | 00,000,000 | RHS- | C] () -- C:\IO.SYS
[2010/01/17 12:18:01 | 00,000,000 | RHS- | C] () -- \IO.SYS
[2010/01/16 18:10:02 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_16.01.2010_18.10.02_log.txt
[2010/01/16 18:09:17 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_16.01.2010_18.09.17_log.txt
[2010/01/16 18:09:01 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_16.01.2010_18.09.01_log.txt
[2010/01/16 18:05:52 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_16.01.2010_18.05.52_log.txt
[2010/01/16 18:04:15 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_16.01.2010_18.04.15_log.txt
[2010/01/16 14:00:50 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_16.01.2010_14.00.50_log.txt
[2010/01/16 14:00:38 | 00,003,298 | ---- | C] () -- \TDSSKiller.2.2.2_16.01.2010_14.00.38_log.txt
[2010/01/15 18:11:59 | 00,000,828 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/14 12:35:51 | 00,261,632 | ---- | C] () -- C:\Windows\PEV.exe
[2010/01/14 12:35:51 | 00,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/01/14 12:35:51 | 00,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/01/14 12:35:51 | 00,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/01/14 12:35:51 | 00,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/01/07 23:11:51 | 31,721,4718 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/01/06 21:29:52 | 00,000,912 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2009/12/28 17:52:20 | 00,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009/12/14 23:25:09 | 00,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/12/13 17:49:41 | 00,012,700 | ---- | C] () -- \aaw7boot.log
[2009/12/03 20:45:21 | 00,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009/12/03 20:45:21 | 00,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009/11/11 01:07:35 | 00,010,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/11/11 01:07:35 | 00,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2009/11/11 01:06:23 | 00,000,036 | -H-- | C] () -- C:\Windows\System32\swk.ini
[2009/10/31 12:08:28 | 00,010,798 | ---- | C] () -- \Ask & Record Toolbar Setup Log.txt
[2009/09/17 19:00:24 | 00,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 14:07:42 | 00,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2008/12/11 22:33:30 | 00,006,786 | ---- | C] () -- \WirelessDiagLog.csv
[2008/10/26 16:54:10 | 00,037,400 | ---- | C] () -- \sysiclog.txt
[2008/10/26 16:52:46 | 00,012,080 | ---- | C] () -- C:\Windows\System32\drivers\tppwr32v.sys
[2008/10/26 16:49:28 | 00,056,056 | ---- | C] () -- C:\Windows\System32\DLAAPI_W.DLL
[2008/10/26 16:49:28 | 00,000,120 | ---- | C] () -- C:\Windows\wininit.ini
[2008/10/26 16:46:30 | 00,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008/10/26 16:46:30 | 00,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008/10/26 16:46:30 | 00,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008/10/26 16:46:30 | 00,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008/10/26 16:46:30 | 00,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008/10/26 16:46:30 | 00,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2008/10/26 16:34:42 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/10/26 16:31:13 | 00,000,211 | ---- | C] () -- \setup.log
[2008/10/26 16:18:01 | 29,394,28864 | -HS- | C] () --
[2008/04/11 02:59:06 | 01,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2006/11/02 07:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:23:09 | 00,000,024 | ---- | C] () -- \autoexec.bat
[2006/11/02 02:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:08 | 00,000,010 | ---- | C] () -- \config.sys
[2001/11/14 15:56:00 | 01,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2009/12/28 21:44:25 | 00,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 1).job
[2010/01/07 22:43:00 | 00,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 2).job
[2009/12/28 21:44:25 | 00,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 3).job
[2009/12/28 21:44:25 | 00,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 4).job
[2009/12/28 21:44:25 | 00,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2010/01/08 20:48:16 | 00,000,256 | ---- | M] () -- C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job
[2010/01/08 20:53:31 | 00,032,536 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/01/08 20:53:00 | 00,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{FB23E694-9CD4-4248-8A1C-0C173EFDD2D6}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >

[Rorschach112]

Your logs are clean


Follow these steps to uninstall Combofix and tools used in the removal of malware

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  
• Please follow the prompts to uninstall Combofix.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

• Download OTC to your desktop and run it
• Click Yes to beginning the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• TFC - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
  
• Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
  secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
  blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
  Here
  
  
  If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
  • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  
  
• Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
  
  
• Please read my guide on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.