[crawdaddy1964]

Hi,

I have a virus that feigns a hard drive crash. It comes up with a message that says "33% of HDD space unreadable" and other messages about a windows security alert or damaged file allocation table. The screen is blue and most all of my desktop icon and files are hidden. It seems to be running something that uses up the available RAM and tries to get me to download a windows security fix.

Following is a copy of the OTL scan file:

OTL logfile created on: 7/7/2011 12:44:11 PM - Run 2
OTL by OldTimer - Version 3.2.26.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.57 Gb Available Physical Memory | 78.78% Memory free
2.58 Gb Paging File | 2.40 Gb Available in Paging File | 92.96% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 49.78 Gb Total Space | 16.43 Gb Free Space | 32.99% Space Free | Partition Type: NTFS
Drive H: | 232.83 Gb Total Space | 140.13 Gb Free Space | 60.19% Space Free | Partition Type: FAT32

Computer Name: CRAWDADDY | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/06 13:36:34 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe
PRC - [2011/06/24 13:51:15 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/07/06 13:36:34 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/07/02 23:07:06 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/27 10:29:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/12/21 11:46:46 | 000,045,056 | ---- | M] (Intuit) [Auto | Stopped] -- c:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2009/07/23 22:10:38 | 000,061,440 | ---- | M] (Intuit Inc.) [On_Demand | Stopped] -- c:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)


========== Driver Services (SafeList) ==========

DRV - [2011/07/02 23:07:08 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/02 23:07:08 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2009/05/11 11:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/05/11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/02/24 19:42:14 | 000,116,736 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mcdbus.sys -- (mcdbus)
DRV - [2009/02/08 17:14:40 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/08/20 13:09:04 | 000,093,544 | ---- | M] (Rocket Division Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\StarPortLite.sys -- (StarPortLite) StarPort Storage Controller (Lite)
DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/12/01 00:46:40 | 000,094,080 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ezplay.sys -- (ezplay)
DRV - [2006/11/15 00:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/14 19:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/02 08:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2005/09/09 21:15:32 | 001,032,472 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005/09/08 03:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005/09/08 03:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005/09/08 03:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005/09/08 03:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005/09/08 03:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005/09/08 03:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005/09/08 03:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005/08/25 10:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005/08/25 10:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2005/08/05 01:32:16 | 000,045,312 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2005/07/22 01:02:12 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/07/22 01:01:08 | 000,201,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/07/22 01:01:00 | 000,717,952 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/10/21 18:56:04 | 003,210,496 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel®


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-21-2575805783-3541672387-54756736-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Dan Armstrong\Application Data\Move Networks\plugins\npqmp071701000002.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/13 18:03:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2010/12/19 18:58:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2010/12/19 18:58:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/24 13:51:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/17 11:14:56 | 000,000,000 | ---D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/13 18:03:04 | 000,000,000 | ---D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2010/12/19 18:58:25 | 000,000,000 | ---D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2010/12/19 18:58:25 | 000,000,000 | ---D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/24 13:51:16 | 000,000,000 | ---D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/17 11:14:56 | 000,000,000 | ---D | M]

[2011/07/06 11:29:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2011/05/17 10:57:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2006/05/02 22:45:01 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/07/17 13:19:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
File not found (No name found) --
[2010/07/17 13:18:56 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/09/02 11:33:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/06/24 13:51:15 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/09/13 23:15:16 | 000,214,344 | ---- | M] (WebEx Communications Inc.) -- C:\Program Files\mozilla firefox\plugins\atcliun.dll
[2008/09/13 23:06:34 | 000,027,976 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2008/09/13 23:06:34 | 000,125,848 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2008/09/13 23:14:45 | 000,098,712 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\mozilla firefox\plugins\ieatgpc.dll
[2008/09/13 23:06:33 | 000,060,824 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2006/03/24 13:10:14 | 000,331,776 | ---- | M] (LexisNexis) -- C:\Program Files\mozilla firefox\plugins\NPDap.dll
[2010/07/17 13:18:56 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2007/03/05 13:59:06 | 000,645,504 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2008/08/13 15:50:21 | 000,163,840 | ---- | M] (CNN) -- C:\Program Files\mozilla firefox\plugins\NPTURNMED.dll
[2008/09/13 23:15:20 | 000,032,768 | ---- | M] (WebEx Communications Inc.) -- C:\Program Files\mozilla firefox\plugins\ptexmeet.dll
[2011/05/17 11:14:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/07/07 12:43:28 | 000,001,003 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (CutePDF Writer Companion Helper) - {8C3733AE-F794-439A-A959-844DCA64F1A2} - C:\Program Files\Acro Software\CutePDF Writer Companion\CPWC_Co.dll (Acro Software Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivX Download Manager] C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-2575805783-3541672387-54756736-500..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKU\S-1-5-21-2575805783-3541672387-54756736-500..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe ()
O4 - HKU\S-1-5-21-2575805783-3541672387-54756736-500..\Run: [OE_OEM] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2575805783-3541672387-54756736-500\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2575805783-3541672387-54756736-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {00140000-B1BA-11CE-ABC6-F5B2E79D9E3F} file:///D:/Scripts/LTOCX14N.cab (LEAD Main Control (14.0))
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.micr.../OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {26BFFB87-5B07-4611-82BB-AF3947013FDD} http://www.lexis.com/dl/IEDAP.cab (DAPCtl Class)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1191307158000 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_08)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} http://dlm.tools.aka...ivex-latest.cab (DownloadManager Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.2
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\intu-help-qb3 {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\Program Files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 02:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007/04/02 07:17:32 | 000,000,000 | ---D | M] - H:\autorun -- [ FAT32 ]
O32 - AutoRun File - [2005/11/17 18:15:24 | 000,000,069 | ---- | M] () - H:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/06 16:13:16 | 000,000,000 | ---D | C] -- C:\_OTS
[2011/07/06 12:55:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\SmitfraudFix
[2011/07/06 12:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\RK_Quarantine
[2011/07/06 12:29:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\Downloads
[2011/07/06 12:02:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia
[2011/07/06 12:02:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe
[2011/07/06 11:32:01 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\PrivacIE
[2011/07/06 11:29:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla
[2011/07/06 11:28:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Mozilla
[2011/07/06 11:27:30 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\IETldCache
[2009/11/04 16:00:35 | 000,389,632 | ---- | C] (Jacek Pazera) -- C:\Program Files\flvtoavi.exe
[2009/03/25 16:50:27 | 004,642,992 | ---- | C] (Xceed Software Inc. 1-450-442-2626 [email protected] www.xceedsoft.com) -- C:\Program Files\R137843.EXE
[2008/11/12 13:38:44 | 000,441,344 | ---- | C] ( ) -- C:\WINDOWS\System32\savst.exe
[2008/09/04 11:23:24 | 006,046,584 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 2.0.0.16.exe
[2007/09/13 01:49:44 | 014,369,749 | ---- | C] (G-Lock Software ) -- C:\Program Files\easymail5_setup.exe
[2007/01/29 01:04:24 | 005,689,344 | ---- | C] (Gabest) -- C:\Program Files\mplayerc.exe
[2006/07/21 12:56:14 | 000,207,330 | ---- | C] (www.mxpie.com) -- C:\Program Files\MXpie Patch v3.2.exe
[2006/05/31 22:49:38 | 000,204,408 | ---- | C] (www.mxpie.com) -- C:\Program Files\MXpie Patch v2.9.exe
[2004/12/07 09:13:40 | 000,479,432 | ---- | C] (Microsoft Corporation) -- C:\Program Files\DXSETUP.exe
[2004/12/07 09:13:38 | 002,249,416 | ---- | C] (Microsoft Corporation) -- C:\Program Files\dsetup32.dll
[2004/12/07 09:13:38 | 000,069,832 | ---- | C] (Microsoft Corporation) -- C:\Program Files\DSETUP.dll
[1996/11/18 01:00:00 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\Implode.dll
[26 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/07 12:34:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/07/07 12:33:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/07/07 12:22:39 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2575805783-3541672387-54756736-1005.job
[2011/07/07 12:22:37 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2575805783-3541672387-54756736-1005.job
[2011/07/07 12:21:02 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/07 12:09:20 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/07 11:34:01 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2575805783-3541672387-54756736-1005UA.job
[2011/07/06 13:28:43 | 000,003,396 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg
[2011/07/06 10:26:59 | 000,000,248 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20438820
[2011/07/06 10:26:59 | 000,000,184 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20438820r
[2011/07/06 10:24:50 | 000,000,344 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\20438820
[2011/07/06 10:24:42 | 000,410,624 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\20438820.exe
[2011/07/06 00:48:27 | 000,465,920 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\jRhcNYUJBNjYqGW.exe
[2011/07/05 23:34:02 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2575805783-3541672387-54756736-1005Core.job
[2011/07/02 23:07:08 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2011/07/02 23:07:08 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2011/07/01 10:34:00 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/06/27 23:50:55 | 000,000,766 | ---- | M] () -- C:\WINDOWS\CoD.INI
[26 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/06 12:57:05 | 000,003,396 | ---- | C] () -- C:\WINDOWS\System32\tmp.reg
[2011/07/06 10:26:59 | 000,000,248 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~20438820
[2011/07/06 10:26:59 | 000,000,184 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~20438820r
[2011/07/06 10:24:50 | 000,000,344 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\20438820
[2011/07/06 10:24:42 | 000,410,624 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\20438820.exe
[2011/07/06 00:48:38 | 000,465,920 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\jRhcNYUJBNjYqGW.exe
[2011/01/03 16:45:22 | 050,982,776 | ---- | C] () -- C:\Program Files\Dell Wireless driver update R115321.EXE
[2011/01/01 20:54:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2010/12/28 12:50:45 | 019,985,265 | ---- | C] () -- C:\Program Files\vlc-1.1.5-win32.exe
[2010/09/21 22:35:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SMMVSplitter.INI
[2010/09/21 22:32:15 | 006,701,168 | ---- | C] () -- C:\Program Files\SolveigMM Video Splitter 2.2.1005.17.exe
[2010/08/23 11:56:19 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT4.DAT
[2010/08/23 11:56:00 | 000,000,066 | ---- | C] () -- C:\WINDOWS\ESPR200.ini
[2010/08/07 11:50:55 | 000,057,395 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2010/07/09 12:04:27 | 000,000,000 | ---- | C] () -- C:\Program Files\vlc-1.1.0-win32.exe
[2010/04/18 19:10:10 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\pool.bin
[2010/01/13 19:47:08 | 000,475,528 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/11/04 16:17:03 | 000,005,110 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xqkcebzs.dik
[2009/11/04 16:00:36 | 002,409,984 | ---- | C] () -- C:\Program Files\ffmpeg_x264.exe
[2009/11/04 16:00:35 | 002,374,656 | ---- | C] () -- C:\Program Files\ffmpeg.exe
[2009/11/04 15:52:02 | 000,147,456 | ---- | C] () -- C:\Program Files\flvparse.exe
[2009/09/28 12:04:41 | 000,000,596 | ---- | C] () -- C:\WINDOWS\WSST_Screen_Saver.ini
[2009/09/28 12:04:39 | 000,180,224 | ---- | C] () -- C:\WINDOWS\UninstallWSST.exe
[2009/07/30 10:46:00 | 004,001,773 | ---- | C] () -- C:\Program Files\FileZilla_3.2.6.1_win32-setup.exe
[2009/07/07 13:02:25 | 002,501,190 | ---- | C] () -- C:\Program Files\Elecard MPEG-2 Decoder&Streaming Plug-in for WMP 3.7.90209.exe
[2009/07/07 13:01:08 | 000,178,870 | ---- | C] () -- C:\Program Files\detours.lib
[2009/07/07 13:01:08 | 000,110,592 | ---- | C] () -- C:\Program Files\detours.pdb
[2009/07/07 13:01:08 | 000,098,551 | ---- | C] () -- C:\Program Files\libmpeg2.cpp
[2009/07/07 13:01:08 | 000,051,263 | ---- | C] () -- C:\Program Files\DSUtil.cpp
[2009/07/07 13:01:08 | 000,021,251 | ---- | C] () -- C:\Program Files\detours.h
[2009/07/07 13:01:08 | 000,018,699 | ---- | C] () -- C:\Program Files\a_yuvtable.asm
[2009/07/07 13:01:08 | 000,011,675 | ---- | C] () -- C:\Program Files\libmpeg2.h
[2009/07/07 13:01:08 | 000,010,091 | ---- | C] () -- C:\Program Files\idct_mmx.obj
[2009/07/07 13:01:08 | 000,007,071 | ---- | C] () -- C:\Program Files\DSUtil.h
[2009/07/07 13:01:08 | 000,006,723 | ---- | C] () -- C:\Program Files\GPL MPEG Decoder.vcproj
[2009/07/07 13:01:08 | 000,001,527 | ---- | C] () -- C:\Program Files\stdafx.h
[2009/07/07 13:01:08 | 000,001,053 | ---- | C] () -- C:\Program Files\DeCSSInputPin.h
[2009/06/04 12:42:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI
[2009/06/03 11:50:22 | 000,010,563 | R--- | C] () -- C:\WINDOWS\hpwscr19.dat
[2009/06/03 11:48:10 | 000,176,414 | ---- | C] () -- C:\WINDOWS\hpwins19.dat
[2009/06/03 11:48:10 | 000,000,997 | R--- | C] () -- C:\WINDOWS\hpwmdl19.dat
[2009/03/26 17:04:00 | 000,595,672 | ---- | C] () -- C:\Program Files\R141246.EXE
[2009/03/25 16:50:27 | 008,351,457 | ---- | C] () -- C:\Program Files\R171789.exe
[2009/03/25 16:50:26 | 008,104,912 | ---- | C] () -- C:\Program Files\R120775.EXE
[2009/03/25 16:50:26 | 001,389,856 | ---- | C] () -- C:\Program Files\R114079.EXE
[2009/03/25 16:50:26 | 000,591,481 | ---- | C] () -- C:\Program Files\PHILIPS-SCB5265-TD17.zip
[2009/03/22 18:13:31 | 003,879,797 | ---- | C] () -- C:\Program Files\FileZilla_3.2.3_win32-setup.exe
[2009/03/03 14:41:24 | 000,339,456 | ---- | C] () -- C:\WINDOWS\System32\tx32.dll
[2009/02/04 12:50:13 | 000,000,061 | ---- | C] () -- C:\WINDOWS\dcmvwr.INI
[2009/01/16 22:04:27 | 000,000,028 | ---- | C] () -- C:\WINDOWS\v2d.INI
[2008/12/01 12:23:10 | 000,000,036 | ---- | C] () -- C:\WINDOWS\System32\f9t.dat
[2008/11/17 18:16:26 | 000,000,090 | ---- | C] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2008/10/27 11:38:20 | 004,163,646 | ---- | C] () -- C:\Program Files\Apr2006_MDX1_x86_Archive.cab
[2008/10/27 11:38:20 | 001,907,944 | ---- | C] () -- C:\Program Files\Nov2008_d3dx9_40_x64.cab
[2008/10/27 11:38:20 | 001,803,074 | ---- | C] () -- C:\Program Files\Nov2007_d3dx9_36_x64.cab
[2008/10/27 11:38:18 | 001,801,176 | ---- | C] () -- C:\Program Files\AUG2007_d3dx9_35_x64.cab
[2008/10/27 11:38:18 | 001,795,100 | ---- | C] () -- C:\Program Files\Aug2008_d3dx9_39_x64.cab
[2008/10/27 11:38:18 | 001,793,624 | ---- | C] () -- C:\Program Files\JUN2008_d3dx9_38_x64.cab
[2008/10/27 11:38:18 | 001,770,878 | ---- | C] () -- C:\Program Files\Mar2008_d3dx9_37_x64.cab
[2008/10/27 11:38:18 | 001,710,376 | ---- | C] () -- C:\Program Files\Nov2007_d3dx9_36_x86.cab
[2008/10/27 11:38:18 | 001,709,168 | ---- | C] () -- C:\Program Files\AUG2007_d3dx9_35_x86.cab
[2008/10/27 11:38:18 | 001,608,374 | ---- | C] () -- C:\Program Files\APR2007_d3dx9_33_x64.cab
[2008/10/27 11:38:16 | 001,608,790 | ---- | C] () -- C:\Program Files\JUN2007_d3dx9_34_x64.cab
[2008/10/27 11:38:16 | 001,608,302 | ---- | C] () -- C:\Program Files\JUN2007_d3dx9_34_x86.cab
[2008/10/27 11:38:16 | 001,607,055 | ---- | C] () -- C:\Program Files\APR2007_d3dx9_33_x86.cab
[2008/10/27 11:38:16 | 001,575,392 | ---- | C] () -- C:\Program Files\DEC2006_d3dx9_32_x86.cab
[2008/10/27 11:38:16 | 001,572,170 | ---- | C] () -- C:\Program Files\DEC2006_d3dx9_32_x64.cab
[2008/10/27 11:38:14 | 001,551,228 | ---- | C] () -- C:\Program Files\Nov2008_d3dx9_40_x86.cab
[2008/10/27 11:38:14 | 001,465,688 | ---- | C] () -- C:\Program Files\Aug2008_d3dx9_39_x86.cab
[2008/10/27 11:38:14 | 001,464,894 | ---- | C] () -- C:\Program Files\JUN2008_d3dx9_38_x86.cab
[2008/10/27 11:38:14 | 001,413,918 | ---- | C] () -- C:\Program Files\OCT2006_d3dx9_31_x64.cab
[2008/10/27 11:38:14 | 001,363,812 | ---- | C] () -- C:\Program Files\Feb2006_d3dx9_29_x64.cab
[2008/10/27 11:38:14 | 001,358,992 | ---- | C] () -- C:\Program Files\Dec2005_d3dx9_28_x64.cab
[2008/10/27 11:38:12 | 001,444,298 | ---- | C] () -- C:\Program Files\Mar2008_d3dx9_37_x86.cab
[2008/10/27 11:38:12 | 001,398,846 | ---- | C] () -- C:\Program Files\Apr2006_d3dx9_30_x64.cab
[2008/10/27 11:38:12 | 001,351,558 | ---- | C] () -- C:\Program Files\Aug2005_d3dx9_27_x64.cab
[2008/10/27 11:38:10 | 001,348,370 | ---- | C] () -- C:\Program Files\Apr2005_d3dx9_25_x64.cab
[2008/10/27 11:38:10 | 001,337,018 | ---- | C] () -- C:\Program Files\Jun2005_d3dx9_26_x64.cab
[2008/10/27 11:38:10 | 001,248,515 | ---- | C] () -- C:\Program Files\Feb2005_d3dx9_24_x64.cab
[2008/10/27 11:38:10 | 001,128,233 | ---- | C] () -- C:\Program Files\OCT2006_d3dx9_31_x86.cab
[2008/10/27 11:38:10 | 001,116,237 | ---- | C] () -- C:\Program Files\Apr2006_d3dx9_30_x86.cab
[2008/10/27 11:38:10 | 001,080,472 | ---- | C] () -- C:\Program Files\Dec2005_d3dx9_28_x86.cab
[2008/10/27 11:38:08 | 001,085,736 | ---- | C] () -- C:\Program Files\Feb2006_d3dx9_29_x86.cab
[2008/10/27 11:38:08 | 001,079,978 | ---- | C] () -- C:\Program Files\Apr2005_d3dx9_25_x86.cab
[2008/10/27 11:38:08 | 001,078,660 | ---- | C] () -- C:\Program Files\Aug2005_d3dx9_27_x86.cab
[2008/10/27 11:38:08 | 001,065,941 | ---- | C] () -- C:\Program Files\Jun2005_d3dx9_26_x86.cab
[2008/10/27 11:38:08 | 001,014,241 | ---- | C] () -- C:\Program Files\Feb2005_d3dx9_24_x86.cab
[2008/10/27 11:38:08 | 000,995,154 | ---- | C] () -- C:\Program Files\Nov2008_d3dx10_40_x64.cab
[2008/10/27 11:38:08 | 000,122,810 | ---- | C] () -- C:\Program Files\Nov2008_XACT_x64.cab
[2008/10/27 11:38:08 | 000,097,833 | ---- | C] () -- C:\Program Files\APR2007_xinput_x64.cab
[2008/10/27 11:38:08 | 000,094,750 | ---- | C] () -- C:\Program Files\Mar2008_XACT_x86.cab
[2008/10/27 11:38:04 | 000,966,445 | ---- | C] () -- C:\Program Files\Nov2008_d3dx10_40_x86.cab
[2008/10/27 11:38:04 | 000,917,446 | ---- | C] () -- C:\Program Files\Apr2006_MDX1_x86.cab
[2008/10/27 11:38:04 | 000,868,844 | ---- | C] () -- C:\Program Files\JUN2008_d3dx10_38_x64.cab
[2008/10/27 11:38:04 | 000,868,628 | ---- | C] () -- C:\Program Files\Aug2008_d3dx10_39_x64.cab
[2008/10/27 11:38:04 | 000,865,616 | ---- | C] () -- C:\Program Files\Nov2007_d3dx10_36_x64.cab
[2008/10/27 11:38:04 | 000,853,302 | ---- | C] () -- C:\Program Files\AUG2007_d3dx10_35_x64.cab
[2008/10/27 11:38:04 | 000,850,935 | ---- | C] () -- C:\Program Files\JUN2008_d3dx10_38_x86.cab
[2008/10/27 11:38:04 | 000,096,053 | ---- | C] () -- C:\Program Files\dxupdate.cab
[2008/10/27 11:38:04 | 000,094,144 | ---- | C] () -- C:\Program Files\JUN2008_XACT_x86.cab
[2008/10/27 11:38:04 | 000,055,538 | ---- | C] () -- C:\Program Files\Nov2008_X3DAudio_x64.cab
[2008/10/27 11:38:04 | 000,045,464 | ---- | C] () -- C:\Program Files\dxdllreg_x86.cab
[2008/10/27 11:38:02 | 000,850,183 | ---- | C] () -- C:\Program Files\Aug2008_d3dx10_39_x86.cab
[2008/10/27 11:38:02 | 000,845,900 | ---- | C] () -- C:\Program Files\Mar2008_d3dx10_37_x64.cab
[2008/10/27 11:38:02 | 000,819,276 | ---- | C] () -- C:\Program Files\Mar2008_d3dx10_37_x86.cab
[2008/10/27 11:38:02 | 000,094,028 | ---- | C] () -- C:\Program Files\Aug2008_XACT_x86.cab
[2008/10/27 11:38:02 | 000,093,700 | ---- | C] () -- C:\Program Files\Nov2008_XACT_x86.cab
[2008/10/27 11:38:02 | 000,088,158 | ---- | C] () -- C:\Program Files\AUG2006_xinput_x64.cab
[2008/10/27 11:38:02 | 000,088,117 | ---- | C] () -- C:\Program Files\Apr2006_xinput_x64.cab
[2008/10/27 11:38:02 | 000,087,053 | ---- | C] () -- C:\Program Files\Oct2005_xinput_x64.cab
[2008/10/27 11:38:02 | 000,056,170 | ---- | C] () -- C:\Program Files\JUN2008_X3DAudio_x64.cab
[2008/10/27 11:38:02 | 000,056,074 | ---- | C] () -- C:\Program Files\Mar2008_X3DAudio_x64.cab
[2008/10/27 11:38:02 | 000,054,318 | ---- | C] () -- C:\Program Files\APR2007_xinput_x86.cab
[2008/10/27 11:38:02 | 000,047,160 | ---- | C] () -- C:\Program Files\NOV2007_X3DAudio_x64.cab
[2008/10/27 11:38:02 | 000,047,074 | ---- | C] () -- C:\Program Files\AUG2006_xinput_x86.cab
[2008/10/27 11:38:02 | 000,046,375 | ---- | C] () -- C:\Program Files\Oct2005_xinput_x86.cab
[2008/10/27 11:38:02 | 000,022,921 | ---- | C] () -- C:\Program Files\JUN2008_X3DAudio_x86.cab
[2008/10/27 11:38:02 | 000,022,867 | ---- | C] () -- C:\Program Files\Nov2008_X3DAudio_x86.cab
[2008/10/27 11:38:02 | 000,019,512 | ---- | C] () -- C:\Program Files\NOV2007_X3DAudio_x86.cab
[2008/10/27 11:38:00 | 000,804,900 | ---- | C] () -- C:\Program Files\Nov2007_d3dx10_36_x86.cab
[2008/10/27 11:38:00 | 000,797,883 | ---- | C] () -- C:\Program Files\AUG2007_d3dx10_35_x86.cab
[2008/10/27 11:38:00 | 000,700,060 | ---- | C] () -- C:\Program Files\JUN2007_d3dx10_34_x64.cab
[2008/10/27 11:38:00 | 000,699,628 | ---- | C] () -- C:\Program Files\APR2007_d3dx10_33_x64.cab
[2008/10/27 11:38:00 | 000,047,026 | ---- | C] () -- C:\Program Files\Apr2006_xinput_x86.cab
[2008/10/27 11:38:00 | 000,022,883 | ---- | C] () -- C:\Program Files\Mar2008_X3DAudio_x86.cab
[2008/10/27 11:37:58 | 000,699,488 | ---- | C] () -- C:\Program Files\JUN2007_d3dx10_34_x86.cab
[2008/10/27 11:37:58 | 000,696,881 | ---- | C] () -- C:\Program Files\APR2007_d3dx10_33_x86.cab
[2008/10/27 11:37:58 | 000,272,384 | ---- | C] () -- C:\Program Files\Aug2008_XAudio_x64.cab
[2008/10/27 11:37:58 | 000,270,858 | ---- | C] () -- C:\Program Files\Aug2008_XAudio_x86.cab
[2008/10/27 11:37:58 | 000,270,644 | ---- | C] () -- C:\Program Files\JUN2008_XAudio_x64.cab
[2008/10/27 11:37:54 | 000,274,976 | ---- | C] () -- C:\Program Files\Nov2008_XAudio_x64.cab
[2008/10/27 11:37:54 | 000,273,627 | ---- | C] () -- C:\Program Files\Nov2008_XAudio_x86.cab
[2008/10/27 11:37:52 | 000,270,040 | ---- | C] () -- C:\Program Files\JUN2008_XAudio_x86.cab
[2008/10/27 11:37:52 | 000,252,210 | ---- | C] () -- C:\Program Files\Mar2008_XAudio_x64.cab
[2008/10/27 11:37:52 | 000,227,266 | ---- | C] () -- C:\Program Files\Mar2008_XAudio_x86.cab
[2008/10/27 11:37:52 | 000,199,112 | ---- | C] () -- C:\Program Files\AUG2007_XACT_x64.cab
[2008/10/27 11:37:50 | 000,213,823 | ---- | C] () -- C:\Program Files\DEC2006_d3dx10_00_x64.cab
[2008/10/27 11:37:50 | 000,198,138 | ---- | C] () -- C:\Program Files\JUN2007_XACT_x64.cab
[2008/10/27 11:37:50 | 000,193,491 | ---- | C] () -- C:\Program Files\DEC2006_XACT_x64.cab
[2008/10/27 11:37:48 | 000,197,778 | ---- | C] () -- C:\Program Files\NOV2007_XACT_x64.cab
[2008/10/27 11:37:48 | 000,196,782 | ---- | C] () -- C:\Program Files\APR2007_XACT_x64.cab
[2008/10/27 11:37:48 | 000,195,691 | ---- | C] () -- C:\Program Files\FEB2007_XACT_x64.cab
[2008/10/27 11:37:48 | 000,192,736 | ---- | C] () -- C:\Program Files\DEC2006_d3dx10_00_x86.cab
[2008/10/27 11:37:48 | 000,183,919 | ---- | C] () -- C:\Program Files\AUG2006_XACT_x64.cab
[2008/10/27 11:37:48 | 000,183,377 | ---- | C] () -- C:\Program Files\OCT2006_XACT_x64.cab
[2008/10/27 11:37:46 | 000,181,801 | ---- | C] () -- C:\Program Files\JUN2006_XACT_x64.cab
[2008/10/27 11:37:46 | 000,180,149 | ---- | C] () -- C:\Program Files\Apr2006_xact_x64.cab
[2008/10/27 11:37:46 | 000,179,375 | ---- | C] () -- C:\Program Files\Feb2006_xact_x64.cab
[2008/10/27 11:37:46 | 000,154,028 | ---- | C] () -- C:\Program Files\AUG2007_XACT_x86.cab
[2008/10/27 11:37:44 | 000,153,925 | ---- | C] () -- C:\Program Files\JUN2007_XACT_x86.cab
[2008/10/27 11:37:44 | 000,152,241 | ---- | C] () -- C:\Program Files\APR2007_XACT_x86.cab
[2008/10/27 11:37:42 | 000,149,280 | ---- | C] () -- C:\Program Files\NOV2007_XACT_x86.cab
[2008/10/27 11:37:42 | 000,148,999 | ---- | C] () -- C:\Program Files\FEB2007_XACT_x86.cab
[2008/10/27 11:37:42 | 000,146,615 | ---- | C] () -- C:\Program Files\DEC2006_XACT_x86.cab
[2008/10/27 11:37:42 | 000,139,033 | ---- | C] () -- C:\Program Files\OCT2006_XACT_x86.cab
[2008/10/27 11:37:42 | 000,138,251 | ---- | C] () -- C:\Program Files\AUG2006_XACT_x86.cab
[2008/10/27 11:37:40 | 000,134,687 | ---- | C] () -- C:\Program Files\JUN2006_XACT_x86.cab
[2008/10/27 11:37:40 | 000,133,425 | ---- | C] () -- C:\Program Files\Feb2006_xact_x86.cab
[2008/10/27 11:37:40 | 000,123,352 | ---- | C] () -- C:\Program Files\Mar2008_XACT_x64.cab
[2008/10/27 11:37:40 | 000,122,840 | ---- | C] () -- C:\Program Files\Aug2008_XACT_x64.cab
[2008/10/27 11:37:40 | 000,122,070 | ---- | C] () -- C:\Program Files\JUN2008_XACT_x64.cab
[2008/10/27 11:37:38 | 000,134,119 | ---- | C] () -- C:\Program Files\Apr2006_xact_x86.cab
[2008/08/28 10:31:25 | 000,000,742 | R--- | C] () -- C:\WINDOWS\MSPPWSV.ini
[2008/07/11 16:57:31 | 000,000,100 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/06/14 17:05:14 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\default_user_class.dat
[2008/03/01 22:04:22 | 000,204,848 | ---- | C] () -- C:\WINDOWS\System32\gswin32c.exe
[2008/01/30 23:28:38 | 000,000,405 | ---- | C] () -- C:\WINDOWS\Chckcite.INI
[2007/05/08 11:36:14 | 000,121,719 | ---- | C] () -- C:\WINDOWS\jgzr.dat
[2007/05/08 11:33:47 | 000,053,248 | ---- | C] () -- C:\WINDOWS\regperm.exe
[2007/05/08 11:33:29 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ESUtil.dll
[2007/03/05 13:34:28 | 000,676,224 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2007/02/09 13:36:47 | 000,000,227 | ---- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/02/09 13:36:25 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/02/09 13:35:15 | 000,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2006/11/03 16:51:03 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2006/09/05 16:54:47 | 000,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/09/05 16:54:47 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/08/26 19:44:46 | 000,069,632 | ---- | C] () -- C:\WINDOWS\realbap1.dll
[2006/08/26 19:44:46 | 000,045,568 | ---- | C] () -- C:\WINDOWS\realbsf1.dll
[2006/08/21 18:23:45 | 000,000,045 | ---- | C] () -- C:\WINDOWS\INSTALL.INI
[2006/08/13 00:25:09 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\realbap1.dll
[2006/08/13 00:25:09 | 000,045,568 | ---- | C] () -- C:\WINDOWS\System32\realbsf1.dll
[2006/06/28 14:58:41 | 000,000,766 | ---- | C] () -- C:\WINDOWS\CoD.INI
[2006/06/21 11:14:32 | 000,006,580 | --S- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/05/06 12:49:29 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\uninscpw.exe
[2006/05/06 12:49:28 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2006/05/06 12:29:45 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll
[2006/05/06 12:29:44 | 000,000,129 | ---- | C] () -- C:\WINDOWS\primopdf.ini
[2006/05/06 11:22:35 | 000,000,056 | R-S- | C] () -- C:\WINDOWS\System32\2D8CCF372A.sys
[2006/05/03 15:42:52 | 000,002,394 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/03 14:55:08 | 000,000,088 | R-S- | C] () -- C:\WINDOWS\System32\2A37CF8C2D.sys
[2006/05/03 12:12:23 | 000,112,886 | ---- | C] () -- C:\WINDOWS\hpoins07.dat
[2006/05/03 12:12:22 | 000,021,124 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat
[2006/05/02 22:44:49 | 000,002,930 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006/05/02 22:26:45 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/05/02 22:18:45 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/04/28 15:25:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/04/28 15:20:14 | 000,000,420 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/04/28 15:16:23 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2006/04/28 15:11:06 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/04/28 14:44:28 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006/04/28 14:44:14 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2006/04/28 14:43:44 | 000,000,387 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 06:56:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/16 18:52:01 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2005/08/16 02:48:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/08/16 02:38:45 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/08/16 02:37:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2005/08/16 02:33:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/08/16 02:27:59 | 000,391,184 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/16 02:18:35 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/08/16 02:18:33 | 000,446,814 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/08/16 02:18:33 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2005/08/16 02:18:33 | 000,073,496 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/08/16 02:18:33 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2005/08/16 02:18:32 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2005/08/16 02:18:30 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/08/16 02:18:28 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/08/16 02:18:23 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2005/08/16 02:18:23 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2005/08/16 02:18:15 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2005/08/16 02:18:08 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2005/08/10 11:56:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ESxUtil.dll
[2005/08/05 12:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/12/07 09:13:42 | 003,578,547 | ---- | C] () -- C:\Program Files\ManagedDX.CAB
[2004/12/07 09:13:42 | 001,156,363 | ---- | C] () -- C:\Program Files\BDANT.cab
[2004/12/07 09:13:42 | 000,703,080 | ---- | C] () -- C:\Program Files\BDA.cab
[2004/12/07 09:13:38 | 013,265,040 | R--- | C] () -- C:\Program Files\dxnt.cab
[2004/12/07 09:13:36 | 015,493,481 | ---- | C] () -- C:\Program Files\DirectX.cab
[2004/12/07 09:13:36 | 000,976,020 | ---- | C] () -- C:\Program Files\BDAXP.cab
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/06 15:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
[1996/11/18 01:00:00 | 000,748,160 | ---- | C] () -- C:\WINDOWS\System32\Co2c40en.dll
[1996/11/18 01:00:00 | 000,054,272 | ---- | C] () -- C:\WINDOWS\System32\P2irdao.dll
[1996/11/18 01:00:00 | 000,050,176 | ---- | C] () -- C:\WINDOWS\System32\P2ctdao.dll
[1996/05/25 17:00:00 | 000,107,008 | ---- | C] () -- C:\WINDOWS\System32\fxtls432.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8CE646EE
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

< End of report >


Please Help!!!

Thanks,

Dan

Attached Files

•  OTL 7-7.Txt   95.72KB   86 downloads

[Advertisements]

1. Open Avira AntiVir Personal. (There is likely an icon on your desktop, or in your system tray by the clock.)
2. Click the "Configuration" link on the main screen. This opens the configuration panel.
3. Check the "Expert mode" option.
4. Click on General > Security.
5. *Uncheck* the option titled "Protect files and registry entries from manipulation".
6. Click the "OK" button.


Copy the text in the code box by highlighting and Ctrl + c

:processes
killallprocesses

:OTL
[2011/07/07 12:22:39 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2575805783-3541672387-54756736-1005.job
[2011/07/07 12:22:37 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2575805783-3541672387-54756736-1005.job
[2011/07/07 12:21:02 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/07 12:09:20 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/07 11:34:01 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2575805783-3541672387-54756736-1005UA.job
[2011/07/06 13:28:43 | 000,003,396 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg
[2011/07/06 10:26:59 | 000,000,248 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20438820
[2011/07/06 10:26:59 | 000,000,184 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20438820r
[2011/07/06 10:24:50 | 000,000,344 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\20438820
[2011/07/06 10:24:42 | 000,410,624 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\20438820.exe
[2011/07/06 00:48:27 | 000,465,920 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\jRhcNYUJBNjYqGW.exe
[2011/07/05 23:34:02 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2575805783-3541672387-54756736-1005Core.job

:files
xcopy %Temp%\smtmp C:\Documents and Settings\Administrator\Desktop\LostFiles /H /I /S /Y /C
xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C

:Commands
[RESETHOSTS]
[purity]
[Reboot]

then run OTL and Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the Run Fix button at the top
Let the program run unhindered, OTL will reboot the PC when it is done. Save the log and copy and paste it to a reply.

Download, Save and Right click on unhide.exe and Run As Administrator from

http://download.blee...nler/unhide.exe



Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:

http://www.malwarebytes.org/mbam.php

SAVE Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.



ComboFix
:!: If you have a previous version of Combofix.exe, delete it and download a fresh copy. :!:

:!: It must be saved to your desktop, do not run it :!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Save this file -- to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Doubleclick on ComboFix to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix. Allow it to install the Recovery Console then Continue. When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.


A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.

Re-activate your anti-virus at this time :!:

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan (Note if the Fix button is enabled and tell me) click save log, save it to your desktop and post in your next reply


Download TDSSKiller:
http://support.kaspe.../tdsskiller.exe
Save it to your desktop then run it.
Double click on TDSSKiller.exe
If TDSSKiller alerts you that the system needs to reboot, please consent.
When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.



Open OTL again and select either the Use SafeList or All option in the Extra Registry group then the Run Scan button. Post the two logs it produces in your next reply.

Ron

[RKinner]

1. Open Avira AntiVir Personal. (There is likely an icon on your desktop, or in your system tray by the clock.)
2. Click the "Configuration" link on the main screen. This opens the configuration panel.
3. Check the "Expert mode" option.
4. Click on General > Security.
5. *Uncheck* the option titled "Protect files and registry entries from manipulation".
6. Click the "OK" button.


Copy the text in the code box by highlighting and Ctrl + c

:processes
killallprocesses

:OTL
[2011/07/07 12:22:39 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2575805783-3541672387-54756736-1005.job
[2011/07/07 12:22:37 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2575805783-3541672387-54756736-1005.job
[2011/07/07 12:21:02 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/07 12:09:20 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/07 11:34:01 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2575805783-3541672387-54756736-1005UA.job
[2011/07/06 13:28:43 | 000,003,396 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg
[2011/07/06 10:26:59 | 000,000,248 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20438820
[2011/07/06 10:26:59 | 000,000,184 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~20438820r
[2011/07/06 10:24:50 | 000,000,344 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\20438820
[2011/07/06 10:24:42 | 000,410,624 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\20438820.exe
[2011/07/06 00:48:27 | 000,465,920 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\jRhcNYUJBNjYqGW.exe
[2011/07/05 23:34:02 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2575805783-3541672387-54756736-1005Core.job

:files
xcopy %Temp%\smtmp C:\Documents and Settings\Administrator\Desktop\LostFiles /H /I /S /Y /C
xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C

:Commands
[RESETHOSTS]
[purity]
[Reboot]

then run OTL and Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the Run Fix button at the top
Let the program run unhindered, OTL will reboot the PC when it is done. Save the log and copy and paste it to a reply.

Download, Save and Right click on unhide.exe and Run As Administrator from

http://download.blee...nler/unhide.exe



Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:

http://www.malwarebytes.org/mbam.php

SAVE Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.



ComboFix
:!: If you have a previous version of Combofix.exe, delete it and download a fresh copy. :!:

:!: It must be saved to your desktop, do not run it :!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Save this file -- to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Doubleclick on ComboFix to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix. Allow it to install the Recovery Console then Continue. When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.


A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.

Re-activate your anti-virus at this time :!:

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan (Note if the Fix button is enabled and tell me) click save log, save it to your desktop and post in your next reply


Download TDSSKiller:
http://support.kaspe.../tdsskiller.exe
Save it to your desktop then run it.
Double click on TDSSKiller.exe
If TDSSKiller alerts you that the system needs to reboot, please consent.
When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.



Open OTL again and select either the Use SafeList or All option in the Extra Registry group then the Run Scan button. Post the two logs it produces in your next reply.

Ron