Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

start menu and windows xp recovery virus

Started by dropdeadhomer , Jun 06 2011 10:26 AM

  • This topic is locked This topic is locked

#1
dropdeadhomer
Posted 06 June 2011 - 10:26 AM

dropdeadhomer

    Member

  • Member
  • PipPip
  • 13 posts
Good evening all,

I had an issue with the Windows XP Recovery virus

I ran MBAM and STOPZILLA and think the virus itself has gone, ie, i dont get any of the associated screenshots.

However, i am now unable to locate the administrator icon when i try to switch user. Also, all the folders in my start menu are empty.

I do not know if i have fully removed the virus or if more serious damage has been done.

Hope someone can please help?

Many thanks
Bob

OTL logfile created on: 06/06/2011 17:27:45 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Keeley Bebb\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.04 Mb Total Physical Memory | 475.49 Mb Available Physical Memory | 46.89% Memory free
2.38 Gb Paging File | 2.03 Gb Available in Paging File | 85.33% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 84.63 Gb Total Space | 68.51 Gb Free Space | 80.95% Space Free | Partition Type: NTFS
Drive D: | 7.50 Gb Total Space | 1.21 Gb Free Space | 16.10% Space Free | Partition Type: FAT32

Computer Name: PC157215695224 | User Name: Keeley Bebb | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
PRC - [2011/04/19 17:39:06 | 000,177,616 | R--- | M] (iS3, Inc.) -- c:\Program Files\STOPzilla!\STOPzilla.exe
PRC - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
PRC - [2010/12/08 20:07:16 | 000,539,408 | ---- | M] (http://www.speedingupmypc.com/) -- C:\Program Files\SpeedingUpMyPC\SPMTray.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2005/12/24 05:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe


========== Modules (SafeList) ==========

MOD - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
MOD - [2010/08/23 17:12:02 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) [Auto | Running] -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe -- (szserver)
SRV - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)


========== Driver Services (SafeList) ==========

DRV - [2010/09/16 13:49:08 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/12 18:01:06 | 000,059,280 | RH-- | M] (iS3, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\szkgfs.sys -- (szkgfs)
DRV - [2009/12/07 17:59:32 | 000,061,328 | RH-- | M] (iS3 Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\szkg.sys -- (szkg5)
DRV - [2009/12/07 17:59:32 | 000,061,328 | RH-- | M] (iS3 Inc.) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\is3srv.sys -- (is3srv)
DRV - [2007/03/22 15:59:46 | 000,625,664 | -H-- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2006/08/20 20:08:43 | 000,010,344 | -H-- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2006/03/14 19:02:54 | 001,428,480 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2006/03/01 17:54:48 | 000,003,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SP39371\winphlash\FLASH1.sys -- (Flash1)
DRV - [2005/12/22 17:02:22 | 000,051,840 | -H-- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 20:28:32 | 000,028,928 | -H-- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005/11/01 18:08:00 | 000,308,992 | -H-- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/09/19 14:24:20 | 000,005,760 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/09/19 14:24:10 | 000,009,344 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2005/09/19 14:23:52 | 000,007,808 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2005/08/22 16:07:00 | 001,035,008 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/08/22 16:06:16 | 000,201,600 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/08/22 16:06:10 | 000,718,464 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/08/04 07:31:34 | 000,020,992 | -H-- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/ig?hl=en"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 51152
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"


FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/04/05 21:00:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 18:24:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/01 18:24:08 | 000,000,000 | ---D | M]

[2008/12/18 11:37:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Extensions
[2011/06/03 17:18:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions
[2009/09/11 06:46:15 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/05/01 18:24:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\KEELEY BEBB\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\RL2WEBJE.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2009/01/04 18:00:06 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/04/14 17:41:09 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 09:00:00 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/01/01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2004/08/04 22:00:00 | 000,000,734 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - c:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKCU..\Run: [ascanavetool] File not found
O4 - HKCU..\Run: [SPMTray] C:\Program Files\SpeedingUpMyPC\SPMTray.exe (http://www.speedingupmypc.com/)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_19.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.mac...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://flashcasino....en/FlashAX2.cab (Flash Casino Helper Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\TPSvc: DllName - TPSvc.dll - File not found
O24 - Desktop WallPaper: C:\WINDOWS\Wave.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Wave.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 14:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004/04/30 06:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/06/06 17:20:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:56:30 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Keeley Bebb\Recent
[2011/06/06 14:42:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/06 14:42:28 | 000,000,000 | ---D | C] -- C:\Program Files\bebb1
[2011/06/06 14:41:25 | 009,435,312 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\bebb1.exe
[2011/06/06 14:38:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Start Menu\Programs\Windows XP Recovery
[2011/06/06 11:39:01 | 000,000,000 | -H-D | C] -- C:\WINDOWS\pss
[2011/06/06 11:32:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Desktop\blobby
[2011/06/06 11:19:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Application Data\SpeedingUpMyPC
[2011/06/06 11:19:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2011/06/06 11:19:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SpeedingUpMyPC
[2011/06/06 11:19:09 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedingUpMyPC
[2011/06/06 11:18:32 | 001,401,648 | ---- | C] (SpeedingUpMyPC ) -- C:\Documents and Settings\Keeley Bebb\Desktop\speedingupmypc.exe
[2011/05/28 08:37:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2009/09/08 07:19:52 | 008,060,048 | ---- | C] (PC Tools ) -- C:\Program Files\rminstall.exe
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[37 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 17:08:37 | 000,606,105 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\unhide.exe
[2011/06/06 17:01:50 | 000,000,240 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/06 17:01:47 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/06 17:01:40 | 000,001,663 | -H-- | M] () -- C:\hpqp.ini
[2011/06/06 17:01:33 | 000,000,041 | -H-- | M] () -- C:\XP_TV.ini
[2011/06/06 17:01:32 | 000,000,892 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/06 17:01:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/06 17:01:27 | 1063,374,848 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/06 17:00:43 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2011/06/06 16:44:00 | 000,000,896 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/06 16:40:35 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Shortcut to firefox.exe.lnk
[2011/06/06 14:48:18 | 000,000,284 | -H-- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/06 14:42:33 | 000,000,633 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/06 14:41:34 | 009,435,312 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\bebb1.exe
[2011/06/06 14:38:42 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Windows XP Recovery.lnk
[2011/06/06 11:19:11 | 000,000,754 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\SpeedingUpMyPC.lnk
[2011/06/06 11:18:45 | 001,401,648 | ---- | M] (SpeedingUpMyPC ) -- C:\Documents and Settings\Keeley Bebb\Desktop\speedingupmypc.exe
[2011/06/06 10:48:31 | 000,000,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~16441124r
[2011/06/06 10:48:31 | 000,000,136 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~16441124
[2011/06/06 10:48:24 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\16441124
[2011/06/06 10:28:34 | 000,000,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~17489700r
[2011/06/06 10:28:34 | 000,000,136 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~17489700
[2011/06/06 10:28:10 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\17489700
[2011/06/06 07:25:58 | 000,381,560 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/06 07:25:58 | 000,053,616 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/05/29 09:11:30 | 000,039,984 | -H-- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/19 16:25:35 | 000,011,168 | -HS- | M] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
[2011/05/19 16:25:35 | 000,011,168 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[37 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/06 17:08:41 | 000,606,105 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\unhide.exe
[2011/06/06 17:01:50 | 000,000,240 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/06 17:01:27 | 1063,374,848 | -HS- | C] () -- C:\hiberfil.sys
[2011/06/06 16:40:35 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Shortcut to firefox.exe.lnk
[2011/06/06 14:42:33 | 000,000,633 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/06 14:38:42 | 000,000,819 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Windows XP Recovery.lnk
[2011/06/06 11:19:11 | 000,000,754 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\SpeedingUpMyPC.lnk
[2011/06/06 10:48:31 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~16441124r
[2011/06/06 10:48:31 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~16441124
[2011/06/06 10:48:24 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\16441124
[2011/06/06 10:28:34 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~17489700r
[2011/06/06 10:28:34 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~17489700
[2011/06/06 10:28:10 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\17489700
[2011/05/19 16:23:29 | 000,011,168 | -HS- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
[2011/05/19 16:23:29 | 000,011,168 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
[2011/03/26 14:15:53 | 000,012,574 | -HS- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\wpjr38s40b7by47dqdymyn0by7e11rvcp
[2011/03/26 14:15:53 | 000,012,574 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\wpjr38s40b7by47dqdymyn0by7e11rvcp
[2011/01/15 14:01:00 | 000,005,734 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\4A14.F18
[2010/04/05 20:59:36 | 000,023,088 | -H-- | C] () -- C:\WINDOWS\hpqins15.dat
[2010/03/09 19:10:18 | 000,767,952 | -H-- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010/03/08 14:24:14 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 18:24:57 | 000,050,576 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/12/31 15:05:16 | 000,139,775 | -H-- | C] () -- C:\WINDOWS\hpoins15.dat
[2008/12/31 15:05:16 | 000,001,039 | -H-- | C] () -- C:\WINDOWS\hpomdl15.dat
[2008/01/17 10:16:24 | 000,001,158 | -H-- | C] () -- C:\WINDOWS\mozver.dat
[2008/01/17 10:00:36 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2007/05/17 21:54:07 | 000,215,144 | RH-- | C] () -- C:\WINDOWS\patchw32.dll
[2007/05/17 21:53:39 | 000,215,144 | RH-- | C] () -- C:\WINDOWS\pw32a.dll
[2006/08/21 17:51:26 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/08/21 17:47:54 | 000,007,680 | -H-- | C] () -- C:\WINDOWS\System32\CNMVS71.DLL
[2006/08/21 00:24:41 | 000,000,134 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\fusioncache.dat
[2006/08/20 20:14:33 | 000,003,142 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2006/08/20 19:16:51 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\WSBar.dll
[2006/08/20 19:16:27 | 000,122,631 | -H-- | C] () -- C:\WINDOWS\Uninstall.exe
[2006/07/26 19:48:20 | 000,028,836 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006/03/27 18:00:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/03/27 18:00:36 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/27 17:24:48 | 000,087,268 | -H-- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/03/27 17:20:24 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\WININIT.INI
[2006/03/27 17:07:26 | 000,381,560 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/27 17:07:26 | 000,053,616 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/27 17:03:30 | 000,251,880 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/03/27 16:59:32 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/03/27 16:56:52 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/12/02 19:09:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/26 14:28:34 | 000,143,360 | -H-- | C] () -- C:\WINDOWS\unzip.exe
[2005/08/26 14:27:58 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\devenum.exe
[2005/05/06 03:06:32 | 000,016,480 | -H-- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2004/08/04 22:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 22:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 22:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 22:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 22:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 22:00:00 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 22:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 22:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/05/28 22:55:42 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 22:54:40 | 000,004,605 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2008/01/14 20:04:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FirstClass
[2011/03/28 07:29:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\nHgCiOfPgPm28601
[2010/10/31 09:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SITEguard
[2011/06/06 17:28:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2007/08/28 18:39:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/01/15 17:29:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/08/23 18:55:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/25 11:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/09/08 08:09:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/06 11:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2011/06/06 11:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\SpeedingUpMyPC
[2006/08/21 18:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\Template

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 142 bytes -> C:\WINDOWS\System32\Üý:@^pctlsp.log
@Alternate Data Stream - 142 bytes -> C:\þ:@_pctlsp.log
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >

Edited by dropdeadhomer, 06 June 2011 - 10:33 AM.

  • 0

Advertisements

#2
Essexboy
Posted 07 June 2011 - 09:06 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there once this run is complete let me know if your folders/files have returned

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
    O4 - HKCU..\Run: [ascanavetool] File not found
    O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
    [2011/06/06 14:38:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Start Menu\Programs\Windows XP Recovery
    [2011/06/06 14:38:42 | 000,000,819 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Windows XP Recovery.lnk
    [2011/06/06 10:48:31 | 000,000,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~16441124r
    [2011/06/06 10:48:31 | 000,000,136 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~16441124
    [2011/06/06 10:48:24 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\16441124
    [2011/06/06 10:28:34 | 000,000,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~17489700r
    [2011/06/06 10:28:34 | 000,000,136 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~17489700
    [2011/06/06 10:28:10 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\17489700
    [2011/05/19 16:25:35 | 000,011,168 | -HS- | M] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
    [2011/05/19 16:25:35 | 000,011,168 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
    [2011/06/06 14:38:42 | 000,000,819 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Windows XP Recovery.lnk
    [2011/06/06 11:19:11 | 000,000,754 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\SpeedingUpMyPC.lnk
    [2011/06/06 10:48:31 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~16441124r
    [2011/06/06 10:48:31 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~16441124
    [2011/06/06 10:48:24 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\16441124
    [2011/06/06 10:28:34 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~17489700r
    [2011/06/06 10:28:34 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~17489700
    [2011/06/06 10:28:10 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\17489700
    [2011/05/19 16:23:29 | 000,011,168 | -HS- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
    [2011/05/19 16:23:29 | 000,011,168 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
    [2011/03/26 14:15:53 | 000,012,574 | -HS- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\wpjr38s40b7by47dqdymyn0by7e11rvcp
    [2011/03/26 14:15:53 | 000,012,574 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\wpjr38s40b7by47dqdymyn0by7e11rvcp
    [2011/01/15 14:01:00 | 000,005,734 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\4A14.F18
    [2011/03/28 07:29:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\nHgCiOfPgPm28601

    :files
    attrib -H c:\*.* /s /d /c
    C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
    C:\Documents and Settings\All Users\Application Data\3572q817521g0wy5u7bosv41hubmkdr15
    C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\wpjr38s40b7by47dqdymyn0by7e11rvcp
    C:\Documents and Settings\All Users\Application Data\wpjr38s40b7by47dqdymyn0by7e11rvcp
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

  • 0

#3
dropdeadhomer
Posted 07 June 2011 - 12:43 PM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Hiya,

Script has been run and computer re-booted. No joy with the start menu i'm afraid.

Also, parts of the virus re=appeared before i ran the script, so i ran RKill, then stopzilla and then malwarebytes and removed everything they found.

OTL script as follows
OTL logfile created on: 07/06/2011 19:36:43 - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Keeley Bebb\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.04 Mb Total Physical Memory | 547.22 Mb Available Physical Memory | 53.96% Memory free
2.38 Gb Paging File | 2.11 Gb Available in Paging File | 88.56% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 84.63 Gb Total Space | 68.35 Gb Free Space | 80.76% Space Free | Partition Type: NTFS
Drive D: | 7.50 Gb Total Space | 1.21 Gb Free Space | 16.10% Space Free | Partition Type: FAT32

Computer Name: PC157215695224 | User Name: Keeley Bebb | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
PRC - [2011/04/19 17:39:06 | 000,177,616 | R--- | M] (iS3, Inc.) -- c:\Program Files\STOPzilla!\STOPzilla.exe
PRC - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2005/12/24 05:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe


========== Modules (SafeList) ==========

MOD - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
MOD - [2010/08/23 17:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) [Auto | Running] -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe -- (szserver)
SRV - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)


========== Driver Services (SafeList) ==========

DRV - [2010/09/16 13:49:08 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/12 18:01:06 | 000,059,280 | R--- | M] (iS3, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\szkgfs.sys -- (szkgfs)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\szkg.sys -- (szkg5)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\is3srv.sys -- (is3srv)
DRV - [2007/03/22 15:59:46 | 000,625,664 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2006/08/20 20:08:43 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2006/03/14 19:02:54 | 001,428,480 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2006/03/01 17:54:48 | 000,003,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SP39371\winphlash\FLASH1.sys -- (Flash1)
DRV - [2005/12/22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005/11/01 18:08:00 | 000,308,992 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/09/19 14:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/09/19 14:24:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2005/09/19 14:23:52 | 000,007,808 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2005/08/22 16:07:00 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/08/22 16:06:16 | 000,201,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/08/22 16:06:10 | 000,718,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/08/04 07:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/ig?hl=en"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 51152
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"


FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/04/05 21:00:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 18:24:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/01 18:24:08 | 000,000,000 | ---D | M]

[2008/12/18 11:37:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Extensions
[2011/06/03 17:18:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions
[2009/09/11 06:46:15 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/05/01 18:24:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\KEELEY BEBB\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\RL2WEBJE.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2009/01/04 18:00:06 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/04/14 17:41:09 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 09:00:00 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/01/01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/06/07 19:32:10 | 000,000,021 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - c:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_19.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.mac...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://flashcasino....en/FlashAX2.cab (Flash Casino Helper Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\TPSvc: DllName - TPSvc.dll - File not found
O24 - Desktop WallPaper: C:\WINDOWS\Wave.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Wave.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 14:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004/04/30 06:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/06/07 19:28:32 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/07 18:51:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware new
[2011/06/07 18:48:22 | 007,734,240 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\clear.com.exe
[2011/06/07 18:46:55 | 001,437,488 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Keeley Bebb\Desktop\123ele.com
[2011/06/07 18:21:05 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2011/06/07 18:19:54 | 018,904,088 | ---- | C] (GridinSoft, Inc. ) -- C:\Documents and Settings\Keeley Bebb\Desktop\blip.exe
[2011/06/06 17:20:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:56:30 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Keeley Bebb\Recent
[2011/06/06 14:42:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/06 14:42:28 | 000,000,000 | ---D | C] -- C:\Program Files\bebb1
[2011/06/06 14:41:25 | 009,435,312 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\bebb1.exe
[2011/06/06 11:39:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011/06/06 11:32:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Desktop\blobby
[2011/06/06 11:19:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2011/06/06 11:19:09 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedingUpMyPC
[2011/06/06 11:18:32 | 001,401,648 | ---- | C] (SpeedingUpMyPC ) -- C:\Documents and Settings\Keeley Bebb\Desktop\speedingupmypc.exe
[2011/05/28 08:37:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2009/09/08 07:19:52 | 008,060,048 | ---- | C] (PC Tools ) -- C:\Program Files\rminstall.exe
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[37 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/07 19:36:10 | 000,000,240 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/07 19:36:03 | 000,001,663 | ---- | M] () -- C:\hpqp.ini
[2011/06/07 19:36:03 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/07 19:35:58 | 000,000,041 | ---- | M] () -- C:\XP_TV.ini
[2011/06/07 19:35:55 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/07 19:35:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/07 19:35:50 | 1063,374,848 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/07 19:32:10 | 000,000,021 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/07 18:51:48 | 000,000,651 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/07 18:51:48 | 000,000,633 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/07 18:49:01 | 007,734,240 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\clear.com.exe
[2011/06/07 18:46:48 | 001,437,488 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Keeley Bebb\Desktop\123ele.com
[2011/06/07 18:44:30 | 001,007,108 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\iExplore.exe
[2011/06/07 18:44:00 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/07 18:41:21 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2011/06/07 18:20:38 | 018,904,088 | ---- | M] (GridinSoft, Inc. ) -- C:\Documents and Settings\Keeley Bebb\Desktop\blip.exe
[2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 17:08:37 | 000,606,105 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\unhide.exe
[2011/06/06 16:40:35 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Shortcut to firefox.exe.lnk
[2011/06/06 14:48:18 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/06 14:41:34 | 009,435,312 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\bebb1.exe
[2011/06/06 11:18:45 | 001,401,648 | ---- | M] (SpeedingUpMyPC ) -- C:\Documents and Settings\Keeley Bebb\Desktop\speedingupmypc.exe
[2011/06/06 07:25:58 | 000,381,560 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/06 07:25:58 | 000,053,616 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[37 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/07 19:36:10 | 000,000,240 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/07 18:51:48 | 000,000,651 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/07 18:44:31 | 001,007,108 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\iExplore.exe
[2011/06/07 18:42:01 | 1063,374,848 | -HS- | C] () -- C:\hiberfil.sys
[2011/06/06 17:08:41 | 000,606,105 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\unhide.exe
[2011/06/06 16:40:35 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\Shortcut to firefox.exe.lnk
[2011/06/06 14:42:33 | 000,000,633 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/05 20:59:36 | 000,023,088 | ---- | C] () -- C:\WINDOWS\hpqins15.dat
[2010/03/09 19:10:18 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010/03/08 14:24:14 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 18:24:57 | 000,050,576 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/12/31 15:05:16 | 000,139,775 | ---- | C] () -- C:\WINDOWS\hpoins15.dat
[2008/12/31 15:05:16 | 000,001,039 | ---- | C] () -- C:\WINDOWS\hpomdl15.dat
[2008/01/17 10:16:24 | 000,001,158 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008/01/17 10:00:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007/05/17 21:54:07 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2007/05/17 21:53:39 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2006/08/21 17:51:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/08/21 17:47:54 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS71.DLL
[2006/08/21 00:24:41 | 000,000,134 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\fusioncache.dat
[2006/08/20 20:14:33 | 000,003,142 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2006/08/20 19:16:51 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\WSBar.dll
[2006/08/20 19:16:27 | 000,122,631 | ---- | C] () -- C:\WINDOWS\Uninstall.exe
[2006/07/26 19:48:20 | 000,028,836 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006/03/27 18:00:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/03/27 18:00:36 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/27 17:24:48 | 000,087,268 | ---- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/03/27 17:20:24 | 000,000,056 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/03/27 17:07:26 | 000,381,560 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/27 17:07:26 | 000,053,616 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/27 17:03:30 | 000,251,880 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/03/27 16:59:32 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/03/27 16:56:52 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/12/02 19:09:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/26 14:28:34 | 000,143,360 | ---- | C] () -- C:\WINDOWS\unzip.exe
[2005/08/26 14:27:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\devenum.exe
[2005/05/06 03:06:32 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2004/08/04 22:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 22:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 22:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 22:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 22:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 22:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 22:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 22:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/05/28 22:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 22:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2008/01/14 20:04:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FirstClass
[2011/03/28 07:29:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\nHgCiOfPgPm28601
[2010/10/31 09:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SITEguard
[2011/06/07 19:37:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2007/08/28 18:39:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/01/15 17:29:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/08/23 18:55:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/25 11:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/09/08 08:09:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/06 11:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2006/08/21 18:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\Template

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 142 bytes -> C:\WINDOWS\System32\Üý:@^pctlsp.log
@Alternate Data Stream - 142 bytes -> C:\þ:@_pctlsp.log
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >
  • 0

#4
dropdeadhomer
Posted 07 June 2011 - 12:49 PM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Sorry, forgot to say that after i ran your script I got the error message
"Cannot create file C:\windows\system32\drivers\etc\Hosts.

Thanks for your help.
  • 0

#5
Essexboy
Posted 07 June 2011 - 01:07 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Download Unhide.exe to your desktop and run

Let me know if this restores the start menu
  • 0

#6
dropdeadhomer
Posted 08 June 2011 - 10:23 AM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Hiya, thanks for your help so far.

I have run unhide.exe and have most, if not all, of my desk top icons back. The "all programs" list in the start menu is now populated but each item in the list is "e
  • 0

#7
Essexboy
Posted 08 June 2011 - 10:34 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
e - do you mean the names are missing ?

Download RogueKiller to your desktop

  • Quit all running programs
  • For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
  • When prompted, type 6 and validate
  • The RKreport.txt shall be generated next to the executable.
Please post the contents of the RKreport.txt in your next Reply.

THEN

Could I have a fresh OTL log and a description of your current problems
  • 0

#8
dropdeadhomer
Posted 08 June 2011 - 11:23 AM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Thanks for your help. Reports as follows.
When i open the start menu and click on "All programmes" it brings up a list of programs, ie system recovery, games etc but when i click on these, it says the files are empty.

Rogue killer report
RogueKiller V5.2.2 [06/05/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-to...-Remontees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: Keeley Bebb [Admin rights]
Mode: Shortcuts HJfix -- Date : 06/08/2011 18:15:28

Bad processes: 0

File attributes restored:
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 62 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 279 / Fail 0
Backup: [NOT FOUND]

Drives:
[C:] \Device\HarddiskVolume1 -- 0x3 --> Restored
[D:] \Device\HarddiskVolume2 -- 0x3 --> Restored
[E:] \Device\CdRom0 -- 0x5 --> Skipped

Finished : << RKreport[1].txt >>
RKreport[1].txt



OTL report as follows
OTL logfile created on: 08/06/2011 18:17:34 - Run 3
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Keeley Bebb\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.04 Mb Total Physical Memory | 319.19 Mb Available Physical Memory | 31.48% Memory free
2.38 Gb Paging File | 2.02 Gb Available in Paging File | 84.60% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 84.63 Gb Total Space | 68.32 Gb Free Space | 80.73% Space Free | Partition Type: NTFS
Drive D: | 7.50 Gb Total Space | 1.21 Gb Free Space | 16.10% Space Free | Partition Type: FAT32

Computer Name: PC157215695224 | User Name: Keeley Bebb | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
PRC - [2011/04/19 17:39:06 | 000,177,616 | R--- | M] (iS3, Inc.) -- c:\Program Files\STOPzilla!\STOPzilla.exe
PRC - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
PRC - [2011/04/14 17:41:09 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2005/12/24 05:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe


========== Modules (SafeList) ==========

MOD - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
MOD - [2010/08/23 17:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) [Auto | Running] -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe -- (szserver)
SRV - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)


========== Driver Services (SafeList) ==========

DRV - [2010/09/16 13:49:08 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/12 18:01:06 | 000,059,280 | R--- | M] (iS3, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\szkgfs.sys -- (szkgfs)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\szkg.sys -- (szkg5)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\is3srv.sys -- (is3srv)
DRV - [2007/03/22 15:59:46 | 000,625,664 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2006/08/20 20:08:43 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2006/03/14 19:02:54 | 001,428,480 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2006/03/01 17:54:48 | 000,003,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SP39371\winphlash\FLASH1.sys -- (Flash1)
DRV - [2005/12/22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005/11/01 18:08:00 | 000,308,992 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/09/19 14:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/09/19 14:24:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2005/09/19 14:23:52 | 000,007,808 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2005/08/22 16:07:00 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/08/22 16:06:16 | 000,201,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/08/22 16:06:10 | 000,718,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/08/04 07:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/ig?hl=en"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 51152
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"


FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/04/05 21:00:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 18:24:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/01 18:24:08 | 000,000,000 | ---D | M]

[2008/12/18 11:37:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Extensions
[2011/06/03 17:18:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions
[2009/09/11 06:46:15 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/05/01 18:24:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\KEELEY BEBB\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\RL2WEBJE.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2009/01/04 18:00:06 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/04/14 17:41:09 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 09:00:00 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/01/01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/06/08 17:11:56 | 000,000,021 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - c:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_19.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.mac...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://flashcasino....en/FlashAX2.cab (Flash Casino Helper Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\TPSvc: DllName - TPSvc.dll - File not found
O24 - Desktop WallPaper: C:\WINDOWS\Wave.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Wave.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 14:07:38 | 000,000,000 | --S- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004/04/30 06:01:14 | 000,000,053 | --S- | M] () - D:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/06/08 18:15:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Desktop\RK_Quarantine
[2011/06/08 17:35:55 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/08 17:35:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/08 17:35:47 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/08 17:34:39 | 007,734,240 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\mbam-setup.exe
[2011/06/08 17:27:04 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Keeley Bebb\Recent
[2011/06/07 19:28:32 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/07 18:21:05 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2011/06/06 17:20:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:42:28 | 000,000,000 | ---D | C] -- C:\Program Files\bebb1
[2011/06/06 11:39:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011/06/06 11:19:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2011/06/06 11:19:09 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedingUpMyPC
[2011/05/28 08:37:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2009/09/08 07:19:52 | 008,060,048 | ---- | C] (PC Tools ) -- C:\Program Files\rminstall.exe
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[36 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/08 18:14:01 | 000,511,488 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\RogueKiller.exe
[2011/06/08 17:44:02 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/08 17:44:01 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/08 17:42:58 | 000,382,202 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/08 17:42:58 | 000,054,066 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/06/08 17:38:33 | 000,000,448 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/08 17:38:26 | 000,001,663 | ---- | M] () -- C:\hpqp.ini
[2011/06/08 17:38:24 | 000,000,041 | ---- | M] () -- C:\XP_TV.ini
[2011/06/08 17:38:23 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/08 17:38:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/08 17:38:10 | 1063,374,848 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/08 17:37:22 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/08 17:35:18 | 007,734,240 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\mbam-setup.exe
[2011/06/08 17:29:05 | 000,003,142 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2011/06/08 17:11:56 | 000,000,021 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/07 18:41:21 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:48:18 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/28 08:37:13 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[36 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/08 18:14:07 | 000,511,488 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\RogueKiller.exe
[2011/06/08 17:38:31 | 000,000,448 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/08 17:35:55 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/08 17:17:50 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/08 17:17:50 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/08 17:17:49 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/08 17:17:49 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/08 17:17:49 | 000,000,806 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Registry Mechanic.lnk
[2011/06/08 17:17:49 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/06/08 17:17:49 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/06/08 17:17:49 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/06/08 17:17:49 | 000,000,363 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\My Documents.lnk
[2011/06/07 18:42:01 | 1063,374,848 | -HS- | C] () -- C:\hiberfil.sys
[2010/04/05 20:59:36 | 000,023,088 | ---- | C] () -- C:\WINDOWS\hpqins15.dat
[2010/03/09 19:10:18 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010/03/08 14:24:14 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 18:24:57 | 000,050,576 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/12/31 15:05:16 | 000,139,775 | ---- | C] () -- C:\WINDOWS\hpoins15.dat
[2008/12/31 15:05:16 | 000,001,039 | ---- | C] () -- C:\WINDOWS\hpomdl15.dat
[2008/01/17 10:16:24 | 000,001,158 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008/01/17 10:00:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007/05/17 21:54:07 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2007/05/17 21:53:39 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2006/08/21 17:51:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/08/21 17:47:54 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS71.DLL
[2006/08/21 00:24:41 | 000,000,134 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\fusioncache.dat
[2006/08/20 20:14:33 | 000,003,142 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2006/08/20 19:16:51 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\WSBar.dll
[2006/08/20 19:16:27 | 000,122,631 | ---- | C] () -- C:\WINDOWS\Uninstall.exe
[2006/07/26 19:48:20 | 000,028,836 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006/03/27 18:00:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/03/27 18:00:36 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/27 17:24:48 | 000,087,268 | ---- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/03/27 17:20:24 | 000,000,056 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/03/27 17:07:26 | 000,382,202 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/27 17:07:26 | 000,054,066 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/27 17:03:30 | 000,251,880 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/03/27 16:59:32 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/03/27 16:56:52 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/12/02 19:09:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/26 14:28:34 | 000,143,360 | ---- | C] () -- C:\WINDOWS\unzip.exe
[2005/08/26 14:27:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\devenum.exe
[2005/05/06 03:06:32 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2004/08/04 22:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 22:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 22:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 22:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 22:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 22:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 22:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 22:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/05/28 22:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 22:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2008/01/14 20:04:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FirstClass
[2011/03/28 07:29:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\nHgCiOfPgPm28601
[2010/10/31 09:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SITEguard
[2011/06/08 18:13:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2007/08/28 18:39:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/01/15 17:29:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/08/23 18:55:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/25 11:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/09/08 08:09:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/06 11:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2006/08/21 18:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\Template

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 142 bytes -> C:\WINDOWS\System32\Üý:@^pctlsp.log
@Alternate Data Stream - 142 bytes -> C:\þ:@_pctlsp.log
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >
  • 0

#9
Essexboy
Posted 08 June 2011 - 11:32 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Local drives: Success 279 / Fail 0
User folder: Success 62 / Fail 0

That brought some more back - could you recheck now please

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Files
    ipconfig /flushdns /c
    C:\Documents and Settings\All Users\Application Data\nHgCiOfPgPm28601

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Update and run a quick Malwarebytes scan, posting the resultant log
  • 0

#10
dropdeadhomer
Posted 08 June 2011 - 02:27 PM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Evening,

Don't know if this helps but StopZilla just finished a deep scan and found more problems that have now been removed. These were
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063637.lnk
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063637.exe
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063832.exe
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063699.lnk
hkus\s-1-5-21-1905669410-1357044812-2552072586-1006\microsoft windows NT\current version windows\ "run" = ""
hkus\s-1-5-21-1905669410-1357044812-2552072586-1006\microsoft windows NT\current version\ Policies\ Associates
hklm\software\microsoft windows NT\ current version\winlogon\"taskman" = ""

Is it possible that perhaps I haven't yet fully removed the virus if infections keep popping up each day?
Will do your scan above then post those results also.

Cheers
  • 0

Advertisements

#11
dropdeadhomer
Posted 08 June 2011 - 02:39 PM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Thanks for trying to help me, i really appreciate it.

Just re-booted system after last runfix and got following message on start up

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\System32\drivers\etc\Hosts scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Also, when i tried to run the fix i got the error message Cannot create file C:\windows\system32\drivers\etc\Hosts.

OTL report follows
OTL logfile created on: 08/06/2011 21:35:59 - Run 4
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Keeley Bebb\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.04 Mb Total Physical Memory | 441.58 Mb Available Physical Memory | 43.55% Memory free
2.38 Gb Paging File | 1.96 Gb Available in Paging File | 82.31% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 84.63 Gb Total Space | 68.33 Gb Free Space | 80.73% Space Free | Partition Type: NTFS
Drive D: | 7.50 Gb Total Space | 1.21 Gb Free Space | 16.10% Space Free | Partition Type: FAT32

Computer Name: PC157215695224 | User Name: Keeley Bebb | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
PRC - [2011/04/19 17:39:06 | 000,177,616 | R--- | M] (iS3, Inc.) -- c:\Program Files\STOPzilla!\STOPzilla.exe
PRC - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
PRC - [2011/04/14 17:41:09 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/11 04:06:38 | 000,341,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
PRC - [2005/12/24 05:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe


========== Modules (SafeList) ==========

MOD - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
MOD - [2010/08/23 17:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) [Auto | Running] -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe -- (szserver)
SRV - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)


========== Driver Services (SafeList) ==========

DRV - [2010/09/16 13:49:08 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/12 18:01:06 | 000,059,280 | R--- | M] (iS3, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\szkgfs.sys -- (szkgfs)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\szkg.sys -- (szkg5)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\is3srv.sys -- (is3srv)
DRV - [2007/03/22 15:59:46 | 000,625,664 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2006/08/20 20:08:43 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2006/03/14 19:02:54 | 001,428,480 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2006/03/01 17:54:48 | 000,003,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SP39371\winphlash\FLASH1.sys -- (Flash1)
DRV - [2005/12/22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005/11/01 18:08:00 | 000,308,992 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/09/19 14:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/09/19 14:24:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2005/09/19 14:23:52 | 000,007,808 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2005/08/22 16:07:00 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/08/22 16:06:16 | 000,201,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/08/22 16:06:10 | 000,718,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/08/04 07:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/ig?hl=en"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 51152
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"


FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/04/05 21:00:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 18:24:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/01 18:24:08 | 000,000,000 | ---D | M]

[2008/12/18 11:37:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Extensions
[2011/06/03 17:18:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions
[2009/09/11 06:46:15 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/05/01 18:24:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\KEELEY BEBB\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\RL2WEBJE.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2009/01/04 18:00:06 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/04/14 17:41:09 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 09:00:00 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/01/01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/06/08 17:11:56 | 000,000,021 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - c:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_19.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.mac...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://flashcasino....en/FlashAX2.cab (Flash Casino Helper Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\TPSvc: DllName - TPSvc.dll - File not found
O24 - Desktop WallPaper: C:\WINDOWS\Wave.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Wave.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 14:07:38 | 000,000,000 | --S- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004/04/30 06:01:14 | 000,000,053 | --S- | M] () - D:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/06/08 18:15:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Desktop\RK_Quarantine
[2011/06/08 17:35:55 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/08 17:35:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/08 17:35:47 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/08 17:34:39 | 007,734,240 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\mbam-setup.exe
[2011/06/08 17:27:04 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Keeley Bebb\Recent
[2011/06/07 19:28:32 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/07 18:21:05 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2011/06/06 17:20:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:42:28 | 000,000,000 | ---D | C] -- C:\Program Files\bebb1
[2011/06/06 11:39:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011/06/06 11:19:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2011/06/06 11:19:09 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedingUpMyPC
[2011/05/28 08:37:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2009/09/08 07:19:52 | 008,060,048 | ---- | C] (PC Tools ) -- C:\Program Files\rminstall.exe
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[36 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/08 21:33:37 | 000,001,663 | ---- | M] () -- C:\hpqp.ini
[2011/06/08 21:33:35 | 000,000,041 | ---- | M] () -- C:\XP_TV.ini
[2011/06/08 21:33:22 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/08 21:33:14 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/08 21:13:09 | 000,000,928 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpfr2.cfg
[2011/06/08 20:44:03 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/08 18:14:01 | 000,511,488 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\RogueKiller.exe
[2011/06/08 17:42:58 | 000,382,202 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/08 17:42:58 | 000,054,066 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/06/08 17:38:33 | 000,000,448 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/08 17:38:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/08 17:38:10 | 1063,374,848 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/08 17:37:22 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/08 17:35:18 | 007,734,240 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\mbam-setup.exe
[2011/06/08 17:29:05 | 000,003,142 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2011/06/08 17:11:56 | 000,000,021 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/07 18:41:21 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:48:18 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/28 08:37:13 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[36 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/08 21:13:07 | 000,000,928 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpfr2.cfg
[2011/06/08 18:14:07 | 000,511,488 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\RogueKiller.exe
[2011/06/08 17:38:31 | 000,000,448 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/08 17:35:55 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/08 17:17:50 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/08 17:17:50 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/08 17:17:49 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/08 17:17:49 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/08 17:17:49 | 000,000,806 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Registry Mechanic.lnk
[2011/06/08 17:17:49 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/06/08 17:17:49 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/06/08 17:17:49 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/06/08 17:17:49 | 000,000,363 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\My Documents.lnk
[2011/06/07 18:42:01 | 1063,374,848 | -HS- | C] () -- C:\hiberfil.sys
[2010/04/05 20:59:36 | 000,023,088 | ---- | C] () -- C:\WINDOWS\hpqins15.dat
[2010/03/09 19:10:18 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010/03/08 14:24:14 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 18:24:57 | 000,050,576 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/12/31 15:05:16 | 000,139,775 | ---- | C] () -- C:\WINDOWS\hpoins15.dat
[2008/12/31 15:05:16 | 000,001,039 | ---- | C] () -- C:\WINDOWS\hpomdl15.dat
[2008/01/17 10:16:24 | 000,001,158 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008/01/17 10:00:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007/05/17 21:54:07 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2007/05/17 21:53:39 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2006/08/21 17:51:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/08/21 17:47:54 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS71.DLL
[2006/08/21 00:24:41 | 000,000,134 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\fusioncache.dat
[2006/08/20 20:14:33 | 000,003,142 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2006/08/20 19:16:51 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\WSBar.dll
[2006/08/20 19:16:27 | 000,122,631 | ---- | C] () -- C:\WINDOWS\Uninstall.exe
[2006/07/26 19:48:20 | 000,028,836 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006/03/27 18:00:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/03/27 18:00:36 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/27 17:24:48 | 000,087,268 | ---- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/03/27 17:20:24 | 000,000,056 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/03/27 17:07:26 | 000,382,202 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/27 17:07:26 | 000,054,066 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/27 17:03:30 | 000,251,880 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/03/27 16:59:32 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/03/27 16:56:52 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/12/02 19:09:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/26 14:28:34 | 000,143,360 | ---- | C] () -- C:\WINDOWS\unzip.exe
[2005/08/26 14:27:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\devenum.exe
[2005/05/06 03:06:32 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2004/08/04 22:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 22:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 22:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 22:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 22:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 22:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 22:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 22:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/05/28 22:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 22:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2008/01/14 20:04:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FirstClass
[2010/10/31 09:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SITEguard
[2011/06/08 21:33:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2007/08/28 18:39:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/01/15 17:29:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/08/23 18:55:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/25 11:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/09/08 08:09:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/06 11:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2006/08/21 18:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\Template

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 142 bytes -> C:\WINDOWS\System32\Üý:@^pctlsp.log
@Alternate Data Stream - 142 bytes -> C:\þ:@_pctlsp.log
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >
  • 0

#12
Essexboy
Posted 08 June 2011 - 03:29 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Don't know if this helps but StopZilla just finished a deep scan and found more problems that have now been removed. These were
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063637.lnk
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063637.exe
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063832.exe
C:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527} rp621\a0063699.lnk
hkus\s-1-5-21-1905669410-1357044812-2552072586-1006\microsoft windows NT\current version windows\ "run" = ""
hkus\s-1-5-21-1905669410-1357044812-2552072586-1006\microsoft windows NT\current version\ Policies\ Associates
hklm\software\microsoft windows NT\ current version\winlogon\"taskman" = ""

Is it possible that perhaps I haven't yet fully removed the virus if infections keep popping up each day?
Will do your scan above then post those results also.

Those are either in system restore or orphan registry keys and can do no harm. We will sort out the host file once MBAM has run

How is your computer behaving now ?

Posted Image Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
  • 0

#13
dropdeadhomer
Posted 09 June 2011 - 11:48 AM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Evening,

Ran M-BAM on quick scan, it found nothing. Log pasted below. Start menu still has same problem, ie click on all programmes and it lists them, but then each folder is empty. One other thing, in case it helps, when i first thought i had got rid of the virus, i tried system restore but although i could access it, when i tried to run it, nothing happened. New OTL log below as well in case that helps.

Thanks


Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6820

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09/06/2011 18:40:46
mbam-log-2011-06-09 (18-40-46).txt

Scan type: Quick scan
Objects scanned: 174447
Time elapsed: 4 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OTL logfile created on: 09/06/2011 18:44:42 - Run 5
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Keeley Bebb\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.04 Mb Total Physical Memory | 404.38 Mb Available Physical Memory | 39.88% Memory free
2.38 Gb Paging File | 1.99 Gb Available in Paging File | 83.48% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 84.63 Gb Total Space | 68.30 Gb Free Space | 80.71% Space Free | Partition Type: NTFS
Drive D: | 7.50 Gb Total Space | 1.21 Gb Free Space | 16.10% Space Free | Partition Type: FAT32

Computer Name: PC157215695224 | User Name: Keeley Bebb | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
PRC - [2011/04/19 17:39:06 | 000,177,616 | R--- | M] (iS3, Inc.) -- c:\Program Files\STOPzilla!\STOPzilla.exe
PRC - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
PRC - [2011/04/14 17:41:09 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2005/12/24 05:44:26 | 000,491,606 | ---- | M] () -- C:\Program Files\HPQ\Shared\HpqToaster.exe


========== Modules (SafeList) ==========

MOD - [2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
MOD - [2010/08/23 17:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/19 17:39:02 | 000,062,928 | R--- | M] (iS3, Inc.) [Auto | Running] -- c:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe -- (szserver)
SRV - [2008/03/27 11:39:14 | 001,251,720 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)


========== Driver Services (SafeList) ==========

DRV - [2010/09/16 13:49:08 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/12 18:01:06 | 000,059,280 | R--- | M] (iS3, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\szkgfs.sys -- (szkgfs)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\szkg.sys -- (szkg5)
DRV - [2009/12/07 17:59:32 | 000,061,328 | R--- | M] (iS3 Inc.) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\drivers\is3srv.sys -- (is3srv)
DRV - [2007/03/22 15:59:46 | 000,625,664 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2006/08/20 20:08:43 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2006/03/14 19:02:54 | 001,428,480 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2006/03/01 17:54:48 | 000,003,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SP39371\winphlash\FLASH1.sys -- (Flash1)
DRV - [2005/12/22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005/11/01 18:08:00 | 000,308,992 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/09/19 14:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/09/19 14:24:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2005/09/19 14:23:52 | 000,007,808 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2005/08/22 16:07:00 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/08/22 16:06:16 | 000,201,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/08/22 16:06:10 | 000,718,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/08/04 07:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/ig?hl=en"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 51152
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"


FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/04/05 21:00:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 18:24:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/01 18:24:08 | 000,000,000 | ---D | M]

[2008/12/18 11:37:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Extensions
[2011/06/03 17:18:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions
[2009/09/11 06:46:15 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\Keeley Bebb\Application Data\Mozilla\Firefox\Profiles\rl2webje.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/05/01 18:24:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\KEELEY BEBB\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\RL2WEBJE.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2009/01/04 18:00:06 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/04/14 17:41:09 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 09:00:00 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/01/01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/06/09 18:31:04 | 000,000,021 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (STOPzilla Browser Helper Object) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - c:\Program Files\STOPzilla!\SZIEBHO.dll (iS3, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_19.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.mac...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://flashcasino....en/FlashAX2.cab (Flash Casino Helper Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\TPSvc: DllName - TPSvc.dll - File not found
O24 - Desktop WallPaper: C:\WINDOWS\Wave.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Wave.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 14:07:38 | 000,000,000 | --S- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2004/04/30 06:01:14 | 000,000,053 | --S- | M] () - D:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2011/06/09 18:35:48 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/09 18:35:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/09 18:35:44 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/09 18:35:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/09 18:34:08 | 009,435,312 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/08 21:47:35 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Keeley Bebb\Recent
[2011/06/08 18:15:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Desktop\RK_Quarantine
[2011/06/07 19:28:32 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/07 18:21:05 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2011/06/06 17:20:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:42:28 | 000,000,000 | ---D | C] -- C:\Program Files\bebb1
[2011/06/06 11:39:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011/06/06 11:19:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2011/06/06 11:19:09 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedingUpMyPC
[2011/05/28 08:37:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2009/09/08 07:19:52 | 008,060,048 | ---- | C] (PC Tools ) -- C:\Program Files\rminstall.exe
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[36 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/09 18:44:02 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/09 18:35:48 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/09 18:35:05 | 000,382,202 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/09 18:35:05 | 000,054,066 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/06/09 18:34:28 | 009,435,312 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Keeley Bebb\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/09 18:31:06 | 000,000,240 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/09 18:31:04 | 000,000,021 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/09 18:30:59 | 000,001,663 | ---- | M] () -- C:\hpqp.ini
[2011/06/09 18:30:59 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/09 18:30:56 | 000,000,041 | ---- | M] () -- C:\XP_TV.ini
[2011/06/09 18:30:50 | 000,000,892 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/09 18:30:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/09 18:30:45 | 1063,374,848 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/08 18:14:01 | 000,511,488 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Desktop\RogueKiller.exe
[2011/06/08 17:29:05 | 000,003,142 | ---- | M] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2011/06/07 18:41:21 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2011/06/06 17:20:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Keeley Bebb\Desktop\OTL.exe
[2011/06/06 14:48:18 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/28 08:37:13 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[5 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[36 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/09 18:35:48 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/09 18:31:06 | 000,000,240 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2011/06/08 18:14:07 | 000,511,488 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Desktop\RogueKiller.exe
[2011/06/08 17:17:50 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/08 17:17:50 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/08 17:17:49 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/08 17:17:49 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/08 17:17:49 | 000,000,806 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Registry Mechanic.lnk
[2011/06/08 17:17:49 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/06/08 17:17:49 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/06/08 17:17:49 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/06/08 17:17:49 | 000,000,363 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\Microsoft\Internet Explorer\Quick Launch\My Documents.lnk
[2011/06/07 18:42:01 | 1063,374,848 | -HS- | C] () -- C:\hiberfil.sys
[2010/04/05 20:59:36 | 000,023,088 | ---- | C] () -- C:\WINDOWS\hpqins15.dat
[2010/03/09 19:10:18 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2010/03/08 14:24:14 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 18:24:57 | 000,050,576 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2008/12/31 15:05:16 | 000,139,775 | ---- | C] () -- C:\WINDOWS\hpoins15.dat
[2008/12/31 15:05:16 | 000,001,039 | ---- | C] () -- C:\WINDOWS\hpomdl15.dat
[2008/01/17 10:16:24 | 000,001,158 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008/01/17 10:00:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007/05/17 21:54:07 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2007/05/17 21:53:39 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2006/08/21 17:51:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2006/08/21 17:47:54 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS71.DLL
[2006/08/21 00:24:41 | 000,000,134 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\fusioncache.dat
[2006/08/20 20:14:33 | 000,003,142 | ---- | C] () -- C:\Documents and Settings\Keeley Bebb\Application Data\wklnhst.dat
[2006/08/20 19:16:51 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\WSBar.dll
[2006/08/20 19:16:27 | 000,122,631 | ---- | C] () -- C:\WINDOWS\Uninstall.exe
[2006/07/26 19:48:20 | 000,028,836 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006/03/27 18:00:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/03/27 18:00:36 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/27 17:24:48 | 000,087,268 | ---- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/03/27 17:20:24 | 000,000,056 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/03/27 17:07:26 | 000,382,202 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/27 17:07:26 | 000,054,066 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/27 17:03:30 | 000,251,880 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/03/27 16:59:32 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/03/27 16:56:52 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/12/02 19:09:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/26 14:28:34 | 000,143,360 | ---- | C] () -- C:\WINDOWS\unzip.exe
[2005/08/26 14:27:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\devenum.exe
[2005/05/06 03:06:32 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2004/08/04 22:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 22:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 22:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 22:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 22:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 22:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 22:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 22:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/05/28 22:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 22:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2008/01/14 20:04:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FirstClass
[2010/10/31 09:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SITEguard
[2011/06/09 18:46:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2007/08/28 18:39:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/01/15 17:29:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/08/23 18:55:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/25 11:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/09/08 08:09:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/06 11:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\RegistryKeys
[2006/08/21 18:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Keeley Bebb\Application Data\Template

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 142 bytes -> C:\WINDOWS\System32\Üý:@^pctlsp.log
@Alternate Data Stream - 142 bytes -> C:\þ:@_pctlsp.log
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >
  • 0

#14
dropdeadhomer
Posted 09 June 2011 - 11:55 AM

dropdeadhomer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
(Second post today)
If it helps, i've found the MBAM log form the day of the virus(?) and listed that below

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6787

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

06/06/2011 15:29:45
mbam-log-2011-06-06 (15-29-45).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 232577
Time elapsed: 36 minute(s), 58 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 7
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
c:\documents and settings\all users\application data\vyuamrmefielc.exe (Trojan.FakeMS) -> 2204 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VyuAmrmEfIELC (Trojan.FakeMS) -> Value: VyuAmrmEfIELC -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\dlo.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\dlo.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Keeley Bebb\Local Settings\Application Data\dlo.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\all users\application data\vyuamrmefielc.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527}\RP621\A0063491.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{6d05fab2-7a62-4a96-a638-2f0b6a273527}\RP621\A0063549.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
  • 0

#15
Essexboy
Posted 09 June 2011 - 02:09 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Bear with me I may have a solution but I need to get the destructions right
  • 0
Back to Can't Run Any Antivirus or Malware Removal Programs · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Can't Run Any Antivirus or Malware Removal Programs

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP