[poisonous.thorns]

Hi, my computer, is infected with so much virus/malware and just can't deal with it anymore. Please if you can help with any information or if there's still any hope with it. i will be forever grateful. I am not tech savy but i hope anything i say makes sense to you guys.

here are the major problems:

• I can't watch anything longer than 5 minutes as something pops up abouts some error and it just crashes my browser both googlechrome and internet explorer including my sound card sometimes. I get the message: "shockwave has crashed googlechrome would you like to restart now?".
• When in the middle of something, it just shuts down showing a blue screen with technical terms I don't really understand about errors of installing or something. and I can't even shut it down properly I have to press the off button and on button again.

I followed the olt instructions on the guide and attached below are my computer log info. I hope it helps.

Thank you very very much ;D  compulog.txt   54.58KB   97 downloads  Extras.Txt   43.25KB   131 downloads
OTL logfile created on: 3/3/2011 2:14:42 PM - Run 1
OTL by OldTimer - Version 3.2.22.2 Folder = C:\Documents and Settings\hp nx6110\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.00 Mb Total Physical Memory | 288.00 Mb Available Physical Memory | 57.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48.80 Gb Total Space | 31.75 Gb Free Space | 65.07% Space Free | Partition Type: NTFS
Drive D: | 62.99 Gb Total Space | 62.85 Gb Free Space | 99.77% Space Free | Partition Type: NTFS

Computer Name: HOME-C8BA426CFB | User Name: hp nx6110 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/03/02 23:33:53 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\hp nx6110\My Documents\Downloads\OTL.exe
PRC - [2011/01/13 08:47:34 | 003,396,624 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/01/13 08:47:33 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/09/08 17:25:52 | 000,096,334 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2009/02/23 13:05:34 | 000,111,856 | ---- | M] (Yahoo! Inc) -- C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
PRC - [2008/11/09 20:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2007/08/10 00:48:40 | 000,528,384 | R--- | M] (VIA Technologies, Inc.) -- C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
PRC - [2005/12/08 21:45:12 | 000,516,182 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe
PRC - [2004/11/05 02:40:08 | 000,098,394 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2004/08/04 11:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/03/02 23:33:53 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\hp nx6110\My Documents\Downloads\OTL.exe
MOD - [2011/01/13 08:47:35 | 000,189,728 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2004/11/05 02:39:58 | 000,069,722 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2004/08/04 11:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Auto | Stopped] -- -- (cdwds)
SRV - [2011/01/13 08:47:33 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/03/29 07:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009/09/08 17:25:52 | 000,096,334 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2008/11/09 20:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


========== Driver Services (SafeList) ==========

DRV - [2011/01/13 08:41:16 | 000,294,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/01/13 08:40:16 | 000,047,440 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/01/13 08:40:04 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/01/13 08:37:30 | 000,023,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/01/13 08:37:11 | 000,029,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/01/13 08:37:09 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/08/04 21:18:42 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF) WinPcap Packet Driver (NPF)
DRV - [2010/05/10 18:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Documents and Settings\Administrator.HOME-C8BA426CFB.000\Local Settings\Temp\SAS_SelfExtract\saskutil.sys -- (SASKUTIL)
DRV - [2010/02/17 18:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Documents and Settings\Administrator.HOME-C8BA426CFB.000\Local Settings\Temp\SAS_SelfExtract\sasdifsv.sys -- (SASDIFSV)
DRV - [2008/03/05 00:40:04 | 000,097,408 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmusbser.sys -- (qcusbser)
DRV - [2007/06/27 23:42:00 | 000,207,488 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vinyl97.sys -- (VIAudio) Vinyl AC'97 Audio Controller (WDM)
DRV - [2007/02/14 22:21:00 | 000,067,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2007/02/14 22:20:58 | 000,868,298 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2007/02/14 22:20:58 | 000,149,123 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2007/02/14 22:20:58 | 000,030,459 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2007/02/14 22:20:56 | 000,530,861 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006/10/12 08:28:42 | 000,604,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2005/08/05 19:32:16 | 000,045,312 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.ph/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522

FF - HKLM\software\mozilla\Firefox\Extensions\\{591FFBB7-FEC9-495B-A49F-61B7E342C021}: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\{591FFBB7-FEC9-495B-A49F-61B7E342C021} [2010/07/08 11:44:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/12/27 20:02:59 | 000,000,000 | ---D | M]

[2011/02/23 14:45:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/31 19:12:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009/11/06 16:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/11/06 16:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2010/07/13 21:53:35 | 000,004,058 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 74.82.216.3 www.google.com
O1 - Hosts: 74.82.216.3 google.com
O1 - Hosts: 74.82.216.3 google.com.au
O1 - Hosts: 74.82.216.3 www.google.com.au
O1 - Hosts: 74.82.216.3 google.be
O1 - Hosts: 74.82.216.3 www.google.be
O1 - Hosts: 74.82.216.3 google.com.br
O1 - Hosts: 74.82.216.3 www.google.com.br
O1 - Hosts: 74.82.216.3 google.ca
O1 - Hosts: 85 more lines...
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
O4 - HKLM..\Run: [avast!] File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 159
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game.zylom.co...gamesplayer.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.67,93.188.161.207
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/09 06:20:21 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/02/23 12:01:06 | 000,000,000 | -H-D | M] - C:\AUTORUN.INF -- [ NTFS ]
O32 - AutoRun File - [2011/02/23 12:01:06 | 000,000,000 | -H-D | M] - D:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{47351250-1076-11df-8715-001641204404}\Shell\AutoRun\command - "" = F:\.\ShowModem.exe
O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\AutoRun\command - "" = F:\PRZHI\\\\hladi.exe
O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\explore\command - "" = F:\PRZHI\\\\\hladi.exe
O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\open\command - "" = F:\PRZHI\\\\\hladi.exe
O33 - MountPoints2\{eb5b8303-1116-11df-8718-001641204404}\Shell - "" = AutoRun
O33 - MountPoints2\{eb5b8303-1116-11df-8718-001641204404}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{eb5b8303-1116-11df-8718-001641204404}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{f1ee9eca-24f6-11df-8729-0014a56be63c}\Shell - "" = AutoRun
O33 - MountPoints2\{f1ee9eca-24f6-11df-8729-0014a56be63c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f1ee9eca-24f6-11df-8729-0014a56be63c}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: AppSecDll - (C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Windows Server\bblvsa.dll) - File not found
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/26 10:34:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Start Menu\Programs\Google Chrome
[2011/02/23 12:01:06 | 000,000,000 | -H-D | C] -- C:\AUTORUN.INF
[2011/02/23 10:23:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2011/02/23 10:23:58 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/02/23 10:23:57 | 000,294,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/02/23 10:23:55 | 000,047,440 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/02/23 10:23:55 | 000,023,632 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/02/23 10:23:54 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/02/23 10:23:53 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/02/23 10:23:53 | 000,029,392 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/02/23 10:23:16 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/02/23 10:23:15 | 000,188,216 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/02/22 23:39:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Search Protection
[2011/02/22 23:39:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Start Menu\Programs\BrowserPlus
[2011/02/22 23:39:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Yahoo!
[2011/02/22 23:38:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2011/02/22 23:34:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Messenger
[2011/02/07 18:44:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Desktop\bible
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\hp nx6110\*.tmp files -> C:\Documents and Settings\hp nx6110\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/03 13:29:05 | 000,000,430 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{859BFD2D-6A6F-4FD8-8E5E-D64AF803ABE9}.job
[2011/03/03 11:34:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/02 23:41:52 | 000,000,910 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to OTL.exe.lnk
[2011/03/02 22:18:58 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/01 22:37:06 | 000,833,428 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\tier4applicationform1.pdf
[2011/03/01 15:15:25 | 000,002,316 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\Google Chrome.lnk
[2011/03/01 15:15:25 | 000,002,294 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/01 09:44:35 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/02/23 22:41:39 | 000,000,210 | -HS- | M] () -- C:\boot.ini
[2011/02/23 10:23:59 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/02/23 10:23:54 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/02/22 23:34:09 | 000,000,820 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/02/22 23:34:09 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2011/02/21 10:18:41 | 000,208,138 | ---- | M] () -- C:\WINDOWS\hpoins47.dat
[2011/02/20 18:15:48 | 000,004,566 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/02/20 18:15:43 | 000,461,904 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/02/20 18:15:43 | 000,078,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/02/14 09:33:17 | 000,010,514 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\AppSchedulingInterviewDate.aspx.htm
[2011/02/13 22:48:48 | 000,081,542 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\vaf9.pdf
[2011/02/13 22:43:43 | 000,147,909 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\PBSappendix8generalstudent.pdf
[2011/02/13 09:22:04 | 000,009,768 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\ApplyNow.aspx.htm
[2011/02/05 23:47:39 | 000,001,940 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\hp nx6110\*.tmp files -> C:\Documents and Settings\hp nx6110\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/02 23:41:52 | 000,000,910 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to OTL.exe.lnk
[2011/03/01 22:37:22 | 000,833,428 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\tier4applicationform1.pdf
[2011/02/26 10:35:07 | 000,002,316 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\Google Chrome.lnk
[2011/02/26 10:35:07 | 000,002,294 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/02/23 10:23:59 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/02/22 23:34:09 | 000,000,820 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/02/22 23:34:09 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2011/02/14 09:33:12 | 000,010,514 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\AppSchedulingInterviewDate.aspx.htm
[2011/02/13 22:48:48 | 000,081,542 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\vaf9.pdf
[2011/02/13 22:43:38 | 000,147,909 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\PBSappendix8generalstudent.pdf
[2011/02/13 09:21:59 | 000,009,768 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\ApplyNow.aspx.htm
[2011/01/10 05:56:47 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/01/05 05:50:24 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/05 05:45:13 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/12/27 20:36:06 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl47.dat.temp
[2010/12/27 19:48:52 | 000,208,138 | ---- | C] () -- C:\WINDOWS\hpoins47.dat
[2010/12/27 19:48:51 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl47.dat
[2010/11/29 10:31:50 | 000,301,720 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/11/10 06:40:45 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/10/31 09:11:13 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/09/02 21:23:00 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/09/02 21:23:00 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2010/09/02 21:23:00 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2010/09/02 21:23:00 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2010/09/02 21:23:00 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2010/09/02 21:23:00 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2010/09/02 21:23:00 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2010/09/02 21:23:00 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2010/09/02 21:23:00 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2010/09/02 21:23:00 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2010/09/02 21:23:00 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/09/02 21:23:00 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/09/02 21:23:00 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/09/02 21:23:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/09/02 21:23:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/09/02 21:23:00 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2010/09/02 21:23:00 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2010/09/02 21:23:00 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/07/08 11:44:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Fvahilunuto.bin
[2010/07/08 11:44:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Drove.dat
[2010/03/09 09:50:14 | 000,028,160 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/03 01:06:42 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/02/03 00:51:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/02/03 00:39:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/02/03 00:32:54 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/03 00:29:48 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/02/03 00:29:46 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/02/03 00:29:46 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/02/03 00:29:45 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2010/02/03 00:29:44 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007/02/06 23:20:00 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2007/02/06 22:55:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2004/08/04 11:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 11:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 11:00:00 | 000,461,904 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 11:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 11:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 11:00:00 | 000,078,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 11:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 11:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 11:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 11:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 11:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 11:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/04 11:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/12/31 19:00:00 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 20:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1980/01/14 22:51:43 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[1980/01/14 22:50:09 | 000,244,720 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2010/05/31 08:32:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/09/24 22:12:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/05/09 06:18:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2010/07/03 09:44:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/05/09 06:24:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Seagate
[2010/06/28 15:55:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Toolbar4
[2010/09/02 21:27:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UDL
[2011/03/03 13:29:05 | 000,000,430 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{859BFD2D-6A6F-4FD8-8E5E-D64AF803ABE9}.job

========== Purity Check ==========



< End of report >

[Advertisements]

Hi there I should imagine that you are getting a lot of redirects as well

First download to your desktop the latest version of Avast (V6.1)
And the Avast uninstall utility

Then

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.67,93.188.161.207
  O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\AutoRun\command - "" = F:\PRZHI\\\\hladi.exe
  O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\explore\command - "" = F:\PRZHI\\\\\hladi.exe
  O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\open\command - "" = F:\PRZHI\\\\\hladi.exe
  O33 - MountPoints2\{eb5b8303-1116-11df-8718-001641204404}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
  O33 - MountPoints2\{f1ee9eca-24f6-11df-8729-0014a56be63c}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
  O36 - AppCertDlls: AppSecDll - (C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Windows Server\bblvsa.dll) - File not found
  [2010/07/08 11:44:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Fvahilunuto.bin
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Next

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it


Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

Finally

Whilst you wait for my reply

Go to add/remove and Uninstall Avast
Reboot
Run the ASWClear tool
Reboot
Install Avast V6.1

[Essexboy]

Hi there I should imagine that you are getting a lot of redirects as well

First download to your desktop the latest version of Avast (V6.1)
And the Avast uninstall utility

Then

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.67,93.188.161.207
  O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\AutoRun\command - "" = F:\PRZHI\\\\hladi.exe
  O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\explore\command - "" = F:\PRZHI\\\\\hladi.exe
  O33 - MountPoints2\{723ffb5e-c89a-11df-8839-0014a56be63c}\Shell\open\command - "" = F:\PRZHI\\\\\hladi.exe
  O33 - MountPoints2\{eb5b8303-1116-11df-8718-001641204404}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
  O33 - MountPoints2\{f1ee9eca-24f6-11df-8729-0014a56be63c}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
  O36 - AppCertDlls: AppSecDll - (C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Windows Server\bblvsa.dll) - File not found
  [2010/07/08 11:44:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Fvahilunuto.bin
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Next

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it


Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

Finally

Whilst you wait for my reply

Go to add/remove and Uninstall Avast
Reboot
Run the ASWClear tool
Reboot
Install Avast V6.1

[poisonous.thorns]

Thanks for the reply I've had a difficulty installing Avast but it has already in my computer I hope it's not gonna be a problem.. here's the new otl log.

OTL logfile created on: 3/19/2011 6:02:09 PM - Run 2
OTL by OldTimer - Version 3.2.22.2 Folder = C:\Documents and Settings\hp nx6110\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.00 Mb Total Physical Memory | 178.00 Mb Available Physical Memory | 35.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48.80 Gb Total Space | 32.80 Gb Free Space | 67.21% Space Free | Partition Type: NTFS
Drive D: | 62.99 Gb Total Space | 62.85 Gb Free Space | 99.77% Space Free | Partition Type: NTFS

Computer Name: HOME-C8BA426CFB | User Name: hp nx6110 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/03/02 23:33:53 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\hp nx6110\My Documents\Downloads\OTL.exe
PRC - [2011/01/13 08:47:34 | 003,396,624 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/01/13 08:47:33 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/06/19 19:41:01 | 000,015,800 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
PRC - [2009/09/08 17:25:52 | 000,096,334 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2009/02/23 13:05:34 | 000,111,856 | ---- | M] (Yahoo! Inc) -- C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
PRC - [2008/11/09 20:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2007/08/10 00:48:40 | 000,528,384 | R--- | M] (VIA Technologies, Inc.) -- C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
PRC - [2005/12/08 21:45:12 | 000,516,182 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe
PRC - [2004/11/05 02:40:08 | 000,098,394 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2004/08/04 11:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/03/02 23:33:53 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\hp nx6110\My Documents\Downloads\OTL.exe
MOD - [2011/01/13 08:47:35 | 000,189,728 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2004/11/05 02:39:58 | 000,069,722 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2004/08/04 11:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (getPlusHelper) getPlus®
SRV - File not found [Auto | Stopped] -- -- (cdwds)
SRV - [2011/01/13 08:47:33 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/09/08 17:25:52 | 000,096,334 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2008/11/09 20:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


========== Driver Services (SafeList) ==========

DRV - [2011/01/13 08:41:16 | 000,294,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/01/13 08:40:16 | 000,047,440 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/01/13 08:40:04 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/01/13 08:37:30 | 000,023,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/01/13 08:37:11 | 000,029,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/01/13 08:37:09 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/08/04 21:18:42 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF) WinPcap Packet Driver (NPF)
DRV - [2008/03/05 00:40:04 | 000,097,408 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmusbser.sys -- (qcusbser)
DRV - [2007/06/27 23:42:00 | 000,207,488 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vinyl97.sys -- (VIAudio) Vinyl AC'97 Audio Controller (WDM)
DRV - [2007/02/14 22:21:00 | 000,067,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2007/02/14 22:20:58 | 000,868,298 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2007/02/14 22:20:58 | 000,149,123 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2007/02/14 22:20:58 | 000,030,459 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2007/02/14 22:20:56 | 000,530,861 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006/10/12 08:28:42 | 000,604,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2005/08/05 19:32:16 | 000,045,312 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.ph/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

FF - HKLM\software\mozilla\Firefox\Extensions\\{591FFBB7-FEC9-495B-A49F-61B7E342C021}: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\{591FFBB7-FEC9-495B-A49F-61B7E342C021} [2010/07/08 11:44:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/12/27 20:02:59 | 000,000,000 | ---D | M]

[2011/02/23 14:45:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/31 19:12:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009/11/06 16:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/11/06 16:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2011/03/19 17:53:32 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
O4 - HKLM..\Run: [avast!] File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 159
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game.zylom.co...gamesplayer.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/09 06:20:21 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/02/23 12:01:06 | 000,000,000 | -H-D | M] - C:\AUTORUN.INF -- [ NTFS ]
O32 - AutoRun File - [2011/02/23 12:01:06 | 000,000,000 | -H-D | M] - D:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{47351250-1076-11df-8715-001641204404}\Shell\AutoRun\command - "" = F:\.\ShowModem.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: AppSecDll - (c:\documents and settings\hp nx6110\local settings\application data\windows server\bblvsa.dll) - File not found
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/19 17:53:21 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/03/19 10:58:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2011/03/16 19:35:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PopCap Games
[2011/03/16 19:35:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PopCap Games
[2011/03/16 19:35:32 | 000,000,000 | ---D | C] -- C:\Program Files\PopCap Games
[2011/03/12 09:28:54 | 000,000,000 | ---D | C] -- C:\Program Files\Graboid
[2011/02/26 10:34:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Start Menu\Programs\Google Chrome
[2011/02/23 12:01:06 | 000,000,000 | -H-D | C] -- C:\AUTORUN.INF
[2011/02/23 10:23:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2011/02/23 10:23:58 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/02/23 10:23:57 | 000,294,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/02/23 10:23:55 | 000,047,440 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/02/23 10:23:55 | 000,023,632 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/02/23 10:23:54 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/02/23 10:23:53 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/02/23 10:23:53 | 000,029,392 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/02/23 10:23:16 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/02/23 10:23:15 | 000,188,216 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/02/22 23:39:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Search Protection
[2011/02/22 23:39:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Start Menu\Programs\BrowserPlus
[2011/02/22 23:39:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Yahoo!
[2011/02/22 23:38:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2011/02/22 23:34:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Messenger
[1 C:\Documents and Settings\hp nx6110\*.tmp files -> C:\Documents and Settings\hp nx6110\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/19 18:00:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/19 17:53:32 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/03/19 17:49:28 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/03/19 17:49:24 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/03/19 09:35:36 | 000,002,316 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\Google Chrome.lnk
[2011/03/19 09:35:36 | 000,002,294 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/18 10:41:41 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/03/16 19:35:42 | 000,000,840 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Zuma Deluxe.lnk
[2011/03/16 19:35:42 | 000,000,194 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play More Great Games!.url
[2011/03/16 19:35:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\popcreg.dat
[2011/03/16 19:35:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\popcinfot.dat
[2011/03/16 19:07:34 | 000,000,210 | -HS- | M] () -- C:\boot.ini
[2011/03/12 12:39:37 | 000,110,696 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D942CB4000005DC-756_634x400.jpg
[2011/03/12 12:38:53 | 000,089,193 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D940A72000005DC-776_634x456.jpg
[2011/03/02 23:41:52 | 000,000,910 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to OTL.exe.lnk
[2011/03/02 22:18:58 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/01 22:37:06 | 000,833,428 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\tier4applicationform1.pdf
[2011/02/22 23:34:09 | 000,000,820 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/02/22 23:34:09 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2011/02/21 10:18:41 | 000,208,138 | ---- | M] () -- C:\WINDOWS\hpoins47.dat
[2011/02/20 18:15:48 | 000,004,566 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/02/20 18:15:43 | 000,461,904 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/02/20 18:15:43 | 000,078,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[1 C:\Documents and Settings\hp nx6110\*.tmp files -> C:\Documents and Settings\hp nx6110\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/16 19:35:42 | 000,000,840 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Zuma Deluxe.lnk
[2011/03/16 19:35:42 | 000,000,194 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play More Great Games!.url
[2011/03/16 19:35:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\popcreg.dat
[2011/03/16 19:35:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2011/03/12 12:39:40 | 000,110,696 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D942CB4000005DC-756_634x400.jpg
[2011/03/12 12:39:03 | 000,089,193 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D940A72000005DC-776_634x456.jpg
[2011/03/02 23:41:52 | 000,000,910 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to OTL.exe.lnk
[2011/03/01 22:37:22 | 000,833,428 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\tier4applicationform1.pdf
[2011/02/26 10:35:07 | 000,002,316 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\Google Chrome.lnk
[2011/02/26 10:35:07 | 000,002,294 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/02/23 10:23:59 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/02/22 23:34:09 | 000,000,820 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/02/22 23:34:09 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2011/01/10 05:56:47 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/01/05 05:50:24 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/05 05:45:13 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/12/27 20:36:06 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl47.dat.temp
[2010/12/27 19:48:52 | 000,208,138 | ---- | C] () -- C:\WINDOWS\hpoins47.dat
[2010/12/27 19:48:51 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl47.dat
[2010/11/29 10:31:50 | 000,301,720 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/11/10 06:40:45 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/10/31 09:11:13 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/09/02 21:23:00 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/09/02 21:23:00 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2010/09/02 21:23:00 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2010/09/02 21:23:00 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2010/09/02 21:23:00 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2010/09/02 21:23:00 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2010/09/02 21:23:00 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2010/09/02 21:23:00 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2010/09/02 21:23:00 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2010/09/02 21:23:00 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2010/09/02 21:23:00 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/09/02 21:23:00 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/09/02 21:23:00 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/09/02 21:23:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/09/02 21:23:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/09/02 21:23:00 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2010/09/02 21:23:00 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2010/09/02 21:23:00 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/07/08 11:44:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Drove.dat
[2010/03/09 09:50:14 | 000,028,160 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/03 01:06:42 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/02/03 00:51:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/02/03 00:39:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/02/03 00:32:54 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/03 00:29:48 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/02/03 00:29:46 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/02/03 00:29:46 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/02/03 00:29:45 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2010/02/03 00:29:44 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007/02/06 23:20:00 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2007/02/06 22:55:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2004/08/04 11:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 11:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 11:00:00 | 000,461,904 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 11:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 11:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 11:00:00 | 000,078,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 11:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 11:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 11:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 11:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 11:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 11:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/04 11:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/12/31 19:00:00 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 20:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1980/01/14 22:51:43 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[1980/01/14 22:50:09 | 000,244,720 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2010/05/31 08:32:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/09/24 22:12:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/05/09 06:18:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2010/07/03 09:44:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2011/03/16 19:35:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap Games
[2010/05/09 06:24:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Seagate
[2010/06/28 15:55:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Toolbar4
[2010/09/02 21:27:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UDL

========== Purity Check ==========



< End of report >

Attached Files

•  OTL.Txt   48.91KB   118 downloads

[poisonous.thorns]

btw the link to download aswMBR.exe doesn't work... any alternatives? I tried it on another laptop and the link worked. on my laptop it didn't just one of the perks.... I gues

[Essexboy]

Here you go download this zip file and unzip to your desktop - it will be aswMBR


I will look at the log now whilst you run this - it will take less than one minute to scan

[Essexboy]

As for Avast we will look at the update once we can remove this beast

[poisonous.thorns]

sorry the machine just decided to shut down... here's the log rep

Attached Files

•  aswMBR.txt   2.93KB   121 downloads

[Essexboy]

OK that shows the TDL3 rootkit - so lets go kill

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[poisonous.thorns]

ok here it goes... fingers crossed

ComboFix 11-03-18.05 - hp nx6110 03/19/2011 19:14:32.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.274 [GMT 0:00]
Running from: c:\documents and settings\hp nx6110\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Application Data\Toolbar4
c:\documents and settings\All Users\Favorites\_favdata.dat
c:\documents and settings\hp nx6110\Application Data\Movier
c:\documents and settings\hp nx6110\Application Data\Movier\movier.xml
c:\documents and settings\hp nx6110\Application Data\Movier\tasks.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\1.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\a.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\b.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\c.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\d.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\e.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\f.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\g.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\h.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\i.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\J.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\k.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\l.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\m.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\n.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\o.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\p.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\q.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\r.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\s.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\t.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\u.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\v.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\w.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\x.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\y.xml
c:\documents and settings\hp nx6110\Application Data\PriceGong\Data\z.xml
c:\documents and settings\hp nx6110\Recent\ANTIGEN.sys
c:\documents and settings\hp nx6110\Recent\cb.dll
c:\documents and settings\hp nx6110\Recent\cb.tmp
c:\documents and settings\hp nx6110\Recent\DBOLE.tmp
c:\documents and settings\hp nx6110\Recent\ddv.sys
c:\documents and settings\hp nx6110\Recent\delfile.sys
c:\documents and settings\hp nx6110\Recent\eb.tmp
c:\documents and settings\hp nx6110\Recent\exec.sys
c:\documents and settings\hp nx6110\Recent\fix.drv
c:\documents and settings\hp nx6110\Recent\kernel32.tmp
c:\documents and settings\hp nx6110\Recent\PE.drv
c:\documents and settings\hp nx6110\Recent\ppal.tmp
c:\documents and settings\hp nx6110\Recent\SICKBOY.tmp
c:\documents and settings\hp nx6110\Recent\sld.tmp
c:\documents and settings\hp nx6110\Recent\SM.tmp
c:\documents and settings\hp nx6110\Recent\snl2w.drv
c:\documents and settings\hp nx6110\Recent\tjd.tmp
c:\windows\system32\drivers\npf.sys
c:\windows\system32\l0wsec
c:\windows\system32\l0wsec\l0cal.ds
c:\windows\system32\l0wsec\us3r.ds
c:\windows\system32\Packet.dll
c:\windows\system32\wpcap.dll
.
----- BITS: Possible infected sites -----
.
hxxp://buy-download.norton.com
Infected copy of c:\windows\system32\drivers\i8042prt.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2011-02-19 to 2011-03-19 )))))))))))))))))))))))))))))))
.
.
2011-03-19 19:22 . 2011-03-19 19:22 63115 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2011-03-19 19:22 . 2011-03-19 19:22 9310 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2011-03-19 19:22 . 2011-03-19 19:22 8646 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2011-03-19 19:22 . 2011-03-19 19:22 6429 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2011-03-19 19:22 . 2011-03-19 19:22 5927 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2011-03-19 19:22 . 2011-03-19 19:22 4599 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2011-03-19 19:21 . 2011-03-19 19:21 8613 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2011-03-19 19:21 . 2011-03-19 19:21 6910 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2011-03-19 19:21 . 2011-03-19 19:21 1651 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2011-03-19 19:21 . 2011-03-19 19:21 8288 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2011-03-19 19:21 . 2011-03-19 19:21 6208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2011-03-19 19:21 . 2011-03-19 19:21 18541 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2011-03-19 19:21 . 2011-03-19 19:21 7271 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2011-03-19 19:21 . 2011-03-19 19:21 51852 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2011-03-19 19:21 . 2011-03-19 19:21 23327 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2011-03-19 19:21 . 2011-03-19 19:21 20719 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2011-03-19 19:21 . 2011-03-19 19:21 8782 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2011-03-19 17:53 . 2011-03-19 17:53 -------- d-----w- C:\_OTL
2011-03-19 10:58 . 2011-03-19 10:58 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-03-16 19:35 . 2011-03-16 19:35 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
2011-03-16 19:35 . 2011-03-16 19:35 -------- d-----w- c:\program files\PopCap Games
2011-03-12 09:28 . 2011-03-12 09:29 -------- d-----w- c:\program files\Graboid
2011-02-24 12:19 . 2011-02-24 12:23 -------- d-----w- c:\documents and settings\aibietot
2011-02-23 10:23 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-02-23 10:23 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-02-23 10:23 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-02-23 10:23 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-02-23 10:23 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-02-23 10:23 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-02-23 10:23 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-02-23 10:23 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr
2011-02-23 10:23 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-02-22 23:39 . 2011-02-22 23:39 -------- d-----w- c:\documents and settings\hp nx6110\Local Settings\Application Data\Yahoo!
2011-02-22 23:38 . 2011-02-23 08:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
------- Sigcheck -------
.
[-] 2010-07-20 . EBEAB4C47642CD68D7FD23187EECA1B0 . 359040 . . [5.1.2600.2180] . . c:\windows\system32\backup\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2004-08-04 . 3BB4B08619C111C7BE8BDA07AA0DE6A2 . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2010-09-25 . C56C4E13F11AFB8B674F698C0C972622 . 502272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe
[-] 2010-09-25 . C56C4E13F11AFB8B674F698C0C972622 . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
.
[-] 2008-11-27 . 32272BF10467C8ACF1F83138C61D541E . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
[7] 2009-03-08 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702] . . c:\windows\system32\dllcache\iexplore.exe
[7] 2004-08-04 . E7484514C0464642BE7B4DC2689354C8 . 93184 . . [6.00.2900.2180] . . c:\windows\ie8\iexplore.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\hp nx6110\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-06-28 136176]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2007-06-20 101144]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-06-20 84760]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2007-06-20 125720]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-14 507904]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"AudioDeck"="c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe" [2007-08-10 528384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-11-16 22:12 88209 ----a-w- c:\windows\AGRSMMSG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 10:17 5252408 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Nla"=3 (0x3)
"NIS"=2 (0x2)
"SamSs"=2 (0x2)
"MDM"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\{59C83C08-63F4-4AEC-81D6-392C5E23B843}\\setup\\hpznui01.exe"=
"c:\\Documents and Settings\\hp nx6110\\My Documents\\Downloads\\msgr10ph.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3613:TCP"= 3613:TCP:effbcnsg
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2/23/2011 10:23 AM 294608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/23/2011 10:23 AM 17744]
S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\ADMINI~1.000\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\ADMINI~1.000\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\ADMINI~1.000\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS --> c:\docume~1\ADMINI~1.000\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS [?]
S2 cdwds;Monitor Network;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 11:00 AM 14336]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/9/2010 10:32 PM 136176]
S3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\cmusbser.sys [2/3/2010 3:44 AM 97408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
cdwds
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com.ph/
uInternet Settings,ProxyOverride = <local>
uSearchAssistant =
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
MSConfigStartUp-cxmqyivo - c:\documents and settings\hp nx6110\Local Settings\Application Data\leoyhekrh\fsnjchqtssd.exe
MSConfigStartUp-Error Expert - c:\program files\Error Expert\ErrorExpert.exe
MSConfigStartUp-Lboxepetero - c:\windows\imaks16.dll
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-sniffer - c:\windows\Temp\_ex-08.exe
MSConfigStartUp-tauqtqjf - c:\documents and settings\hp nx6110\Local Settings\Application Data\ccusxifbw\gripwwyshdw.exe
MSConfigStartUp-Vfosubukukase - c:\windows\agimevoc.dll
MSConfigStartUp-{10B009C8-1EDF-95D7-D0D3-55B99AD1E10A} - c:\documents and settings\hp nx6110\Application Data\Dusone\ocopn.exe
MSConfigStartUp-{15109C5B-D81D-5DB1-AFB4-FBA996AB1B3F} - c:\documents and settings\hp nx6110\Application Data\Myow\ycne.exe
MSConfigStartUp-{8E782246-BF7B-66EB-808E-C737E4CF792C} - c:\documents and settings\hp nx6110\Application Data\Teosa\guyll.exe
MSConfigStartUp-{DFE3082E-0856-DC05-C99F-4A31D2B4FF37} - c:\documents and settings\hp nx6110\Application Data\Idewsi\goihh.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-19 19:22
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3708)
c:\windows\system32\SynTPFcs.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\progra~1\hpq\Shared\HPQTOA~1.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2011-03-19 19:26:17 - machine was rebooted
ComboFix-quarantined-files.txt 2011-03-19 19:26
.
Pre-Run: 35,132,620,800 bytes free
Post-Run: 34,918,887,424 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 56D65CA2EA160E1D221A3AFDD3BB149D

Attached Files

•  ComboFix.txt   19.13KB   145 downloads

[Essexboy]

Infected copy of c:\windows\system32\drivers\i8042prt.sys was found and disinfected
Restored copy from - Kitty had a snack

Dead

Once you have completed this run could you do the Avast update to version 6 please. And then let me know what problems remain

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Fcopy::
c:\windows\system32\dllcache\tcpip.sys|c:\windows\system32\drivers\tcpip.sys

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3613:TCP"=-

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new OTL log.

[poisonous.thorns]

ok...

OTL logfile created on: 3/19/2011 8:19:23 PM - Run 3
OTL by OldTimer - Version 3.2.22.2 Folder = C:\Documents and Settings\hp nx6110\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.00 Mb Total Physical Memory | 253.00 Mb Available Physical Memory | 50.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48.80 Gb Total Space | 32.58 Gb Free Space | 66.76% Space Free | Partition Type: NTFS
Drive D: | 62.99 Gb Total Space | 62.85 Gb Free Space | 99.77% Space Free | Partition Type: NTFS

Computer Name: HOME-C8BA426CFB | User Name: hp nx6110 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/03/02 23:33:53 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\hp nx6110\My Documents\Downloads\OTL.exe
PRC - [2011/01/13 08:47:34 | 003,396,624 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/01/13 08:47:33 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/09/08 17:25:52 | 000,096,334 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2009/02/23 13:05:34 | 000,111,856 | ---- | M] (Yahoo! Inc) -- C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
PRC - [2008/11/09 20:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2007/08/10 00:48:40 | 000,528,384 | R--- | M] (VIA Technologies, Inc.) -- C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
PRC - [2005/12/08 21:45:12 | 000,516,182 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe
PRC - [2004/11/05 02:40:08 | 000,098,394 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2004/08/04 11:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/03/02 23:33:53 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\hp nx6110\My Documents\Downloads\OTL.exe
MOD - [2011/01/13 08:47:35 | 000,189,728 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2004/11/05 02:39:58 | 000,069,722 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2004/08/04 11:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (getPlusHelper) getPlus®
SRV - File not found [Auto | Stopped] -- -- (cdwds)
SRV - [2011/01/13 08:47:33 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/09/08 17:25:52 | 000,096,334 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2008/11/09 20:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2011/01/13 08:41:16 | 000,294,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/01/13 08:40:16 | 000,047,440 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/01/13 08:40:04 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/01/13 08:37:30 | 000,023,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/01/13 08:37:11 | 000,029,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/01/13 08:37:09 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2008/03/05 00:40:04 | 000,097,408 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cmusbser.sys -- (qcusbser)
DRV - [2007/06/27 23:42:00 | 000,207,488 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vinyl97.sys -- (VIAudio) Vinyl AC'97 Audio Controller (WDM)
DRV - [2007/02/14 22:21:00 | 000,067,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2007/02/14 22:20:58 | 000,868,298 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2007/02/14 22:20:58 | 000,149,123 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2007/02/14 22:20:58 | 000,030,459 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2007/02/14 22:20:56 | 000,530,861 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2006/10/12 08:28:42 | 000,604,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2005/08/05 19:32:16 | 000,045,312 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.ph/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

FF - HKLM\software\mozilla\Firefox\Extensions\\{591FFBB7-FEC9-495B-A49F-61B7E342C021}: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\{591FFBB7-FEC9-495B-A49F-61B7E342C021} [2010/07/08 11:44:49 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/12/27 20:02:59 | 000,000,000 | ---D | M]

[2011/02/23 14:45:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/31 19:12:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009/11/06 16:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/11/06 16:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2011/03/19 19:21:40 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game.zylom.co...gamesplayer.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/09 06:20:21 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/02/23 12:01:06 | 000,000,000 | ---D | M] - C:\AUTORUN.INF -- [ NTFS ]
O32 - AutoRun File - [2011/02/23 12:01:06 | 000,000,000 | ---D | M] - D:\AUTORUN.INF -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/19 19:24:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2011/03/19 19:24:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2011/03/19 19:04:20 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/03/19 18:56:13 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/03/19 18:56:13 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/03/19 18:56:13 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/03/19 18:56:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/03/19 18:53:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/03/19 17:53:21 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/03/19 10:58:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2011/03/16 19:35:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PopCap Games
[2011/03/16 19:35:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PopCap Games
[2011/03/16 19:35:32 | 000,000,000 | ---D | C] -- C:\Program Files\PopCap Games
[2011/03/12 09:28:54 | 000,000,000 | ---D | C] -- C:\Program Files\Graboid
[2011/02/26 10:34:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Start Menu\Programs\Google Chrome
[2011/02/23 12:01:06 | 000,000,000 | ---D | C] -- C:\AUTORUN.INF
[2011/02/23 10:23:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2011/02/23 10:23:58 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/02/23 10:23:57 | 000,294,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/02/23 10:23:55 | 000,047,440 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/02/23 10:23:55 | 000,023,632 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/02/23 10:23:54 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/02/23 10:23:53 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/02/23 10:23:53 | 000,029,392 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/02/23 10:23:16 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/02/23 10:23:15 | 000,188,216 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/02/22 23:39:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Search Protection
[2011/02/22 23:39:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Start Menu\Programs\BrowserPlus
[2011/02/22 23:39:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\Yahoo!
[2011/02/22 23:38:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2011/02/22 23:34:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Messenger
[1 C:\Documents and Settings\hp nx6110\*.tmp files -> C:\Documents and Settings\hp nx6110\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/19 20:08:41 | 000,000,786 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to ComboFix.exe.lnk
[2011/03/19 19:21:40 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/03/19 19:21:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/19 19:04:28 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/03/19 18:34:54 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\MBR.dat
[2011/03/19 17:49:28 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/03/19 17:49:24 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/03/19 09:35:36 | 000,002,316 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\Google Chrome.lnk
[2011/03/19 09:35:36 | 000,002,294 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/18 10:41:41 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/03/16 19:35:42 | 000,000,840 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Zuma Deluxe.lnk
[2011/03/16 19:35:42 | 000,000,194 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play More Great Games!.url
[2011/03/16 19:35:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\popcreg.dat
[2011/03/16 19:35:32 | 000,000,000 | ---- | M] () -- C:\WINDOWS\popcinfot.dat
[2011/03/16 19:07:34 | 000,000,210 | ---- | M] () -- C:\Boot.bak
[2011/03/12 12:39:37 | 000,110,696 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D942CB4000005DC-756_634x400.jpg
[2011/03/12 12:38:53 | 000,089,193 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D940A72000005DC-776_634x456.jpg
[2011/03/02 23:41:52 | 000,000,910 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to OTL.exe.lnk
[2011/03/02 22:18:58 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/01 22:37:06 | 000,833,428 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Desktop\tier4applicationform1.pdf
[2011/02/22 23:34:09 | 000,000,820 | ---- | M] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/02/22 23:34:09 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2011/02/21 10:18:41 | 000,208,138 | ---- | M] () -- C:\WINDOWS\hpoins47.dat
[2011/02/20 18:15:48 | 000,004,566 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/02/20 18:15:43 | 000,461,904 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/02/20 18:15:43 | 000,078,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[1 C:\Documents and Settings\hp nx6110\*.tmp files -> C:\Documents and Settings\hp nx6110\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/19 20:08:41 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to ComboFix.exe.lnk
[2011/03/19 19:04:27 | 000,000,210 | ---- | C] () -- C:\Boot.bak
[2011/03/19 19:04:23 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/03/19 18:56:13 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/03/19 18:56:13 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/03/19 18:56:13 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/03/19 18:56:13 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/03/19 18:56:13 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/03/19 18:29:57 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\MBR.dat
[2011/03/16 19:35:42 | 000,000,840 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Zuma Deluxe.lnk
[2011/03/16 19:35:42 | 000,000,194 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play More Great Games!.url
[2011/03/16 19:35:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\popcreg.dat
[2011/03/16 19:35:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2011/03/12 12:39:40 | 000,110,696 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D942CB4000005DC-756_634x400.jpg
[2011/03/12 12:39:03 | 000,089,193 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\article-1365538-0D940A72000005DC-776_634x456.jpg
[2011/03/02 23:41:52 | 000,000,910 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\Shortcut to OTL.exe.lnk
[2011/03/01 22:37:22 | 000,833,428 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\tier4applicationform1.pdf
[2011/02/26 10:35:07 | 000,002,316 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Desktop\Google Chrome.lnk
[2011/02/26 10:35:07 | 000,002,294 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/02/23 10:23:59 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/02/22 23:34:09 | 000,000,820 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/02/22 23:34:09 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2011/01/10 05:56:47 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/01/05 05:50:24 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/05 05:45:13 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/12/27 20:36:06 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl47.dat.temp
[2010/12/27 19:48:52 | 000,208,138 | ---- | C] () -- C:\WINDOWS\hpoins47.dat
[2010/12/27 19:48:51 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl47.dat
[2010/11/29 10:31:50 | 000,301,720 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/11/10 06:40:45 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/10/31 09:11:13 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/09/02 21:23:00 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/09/02 21:23:00 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2010/09/02 21:23:00 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2010/09/02 21:23:00 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2010/09/02 21:23:00 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2010/09/02 21:23:00 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2010/09/02 21:23:00 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2010/09/02 21:23:00 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2010/09/02 21:23:00 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2010/09/02 21:23:00 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2010/09/02 21:23:00 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/09/02 21:23:00 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/09/02 21:23:00 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/09/02 21:23:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/09/02 21:23:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/09/02 21:23:00 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2010/09/02 21:23:00 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2010/09/02 21:23:00 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/07/08 11:44:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Drove.dat
[2010/03/09 09:50:14 | 000,028,160 | ---- | C] () -- C:\Documents and Settings\hp nx6110\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/03 01:06:42 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/02/03 00:51:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/02/03 00:39:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/02/03 00:32:54 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/03 00:29:48 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/02/03 00:29:46 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/02/03 00:29:46 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/02/03 00:29:45 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2010/02/03 00:29:44 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007/02/06 23:20:00 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2007/02/06 22:55:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2004/08/04 11:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 11:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 11:00:00 | 000,461,904 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 11:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 11:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 11:00:00 | 000,078,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 11:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 11:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 11:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 11:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 11:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 11:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/04 11:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/12/31 19:00:00 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 20:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1980/01/14 22:51:43 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[1980/01/14 22:50:09 | 000,244,720 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2010/05/31 08:32:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/09/24 22:12:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/05/09 06:18:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2010/07/03 09:44:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2011/03/16 19:35:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap Games
[2010/05/09 06:24:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Seagate
[2010/09/02 21:27:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UDL

========== Purity Check ==========



< End of report >

Attached Files

•  OTL.Txt   51.41KB   94 downloads
•  ComboFix.txt   14.78KB   140 downloads

[Essexboy]

That looks a lot better now - I will do a sweep for orphans next

How is the computer running now - what problems are you experiencing ?

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

[poisonous.thorns]

Thank you so very very much... my computer seems to be working better now... so far, i haven't had any of the dreaded error dialog boxes and it hasn't shut down by itself so that's a very big inprovement ..here's the log thing..

Attached Files

•  mbam-log-2011-03-19 (20-58-29).txt   1.06KB   107 downloads

[poisonous.thorns]

oh by the way...successfully updated my avast to the latest version...

[Essexboy]

Looking at that I am a happy bunny

Avast 6 is much better than the 5.0 version. I would recommend that you now update to Windows service pack 3 as that will block some security loopholes

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

Run OTL again and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

SPRING CLEAN

Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check




Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe