TechSpot

Google redirect bug. 8-steps followed

By Newtman
Sep 18, 2010
  1. I got hit with a virus that my Kaspersky caught. However i now have the Google redirect bug. Actually, any search engine i use the results give me redirects. Also, Explorer wont open pages in a new window when clicking a link even though its set to, but right-click open in new window still works.
    Kaspersky is also now giving me PDM.Invader warnings when i open Internet Explorer. In addition to PDM.DNS Query warning for KIHJKNB.dll, which I believe is for my Logitech mouse.

    Kaspersy Anti-virus 2010 comes back clean.
    Malwarebytes comes back clean - logs attached
    GMER errors when it gets to my Windows folder (after 6 hours of scanning). Ive tried it 5 times now (after regular boot, with Devices unchecked, and in safe-mode) and it always gives an error. After 30 hours of trying to get it to finish a scan i'm giving up on it.
    DDS logs are attached

    Malwarebytes Log

    Malwarebytes' Anti-Malware 1.45
    www.malwarebytes.org

    Database version: 4640

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    9/17/2010 4:24:01 PM
    mbam-log-2010-09-17 (16-24-01).txt

    Scan type: Quick scan
    Objects scanned: 130864
    Time elapsed: 4 minute(s), 43 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    DDS Log Pt1


    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Greg at 17:47:16.95 on Sat 09/18/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1563 [GMT -4:00]

    AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Kaspersky Anti-Virus *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Documents and Settings\Greg\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = about:blank
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uWindow Title = This Space For Rent
    mDefault_Page_URL = about:blank
    mDefault_Search_URL = hxxp://www.google.com/ie
    mSearch Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    mWindow Title = This Space For Rent
    mSearchAssistant = hxxp://www.google.com
    mCustomizeSearch = about:blank
    BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\ievkbd.dll
    BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
    uRun: [PowerPanel Personal Edition User Interaction] "c:\program files\cyberpower powerpanel personal edition\pppeuser.exe"
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanlu.exe" /r
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [AudioDrvEmulator] "c:\program files\creative\shared files\module loader\dllml.exe" -1 audiodrvemulator "c:\program files\creative\shared files\module loader\audio emulator\AudDrvEm.dll"
    mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
    IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
    DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB
    DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263417214078
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263417198500
    Notify: klogon - c:\windows\system32\klogon.dll
    Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    AppInit_DLLs: c:\progra~1\kasper~1\kasper~2\mzvkbd3.dll
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
    Hosts: 127.0.0.1 www.spywareinfo.com

    ============= SERVICES / DRIVERS ===============

    R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
    R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016]
    R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-6-16 315408]
    R2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe [2009-10-20 340520]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]
    S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
    S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2008-8-30 79360]
    S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra lite 2009.sp3c\RpcAgentSrv.exe [2009-6-26 98488]

    =============== Created Last 30 ================

    2010-09-18 01:51:56 3072 --sha-w- C:\Thumbs.db
    2010-09-14 21:31:54 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
    2010-09-14 16:44:15 0 d-----w- c:\windows\system32\wbem\Repository
    2010-09-14 16:44:03 0 d-----w- c:\docume~1\greg\applic~1\E8B07448EEE071FA9106521E50118832
    2010-09-14 05:55:22 68224 ----a-w- c:\windows\system32\drivers\pci.kav
    2010-09-14 05:44:56 155648 --sha-r- c:\windows\system32\normnfc8.dll

    ==================== Find3M ====================

    2010-09-14 17:38:07 68224 ----a-w- c:\windows\system32\drivers\pci.sys
    2010-09-08 18:01:27 13308 ---ha-w- c:\windows\system32\mlfcache.dat
    2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-07-29 17:37:32 97549 ----a-w- c:\windows\system32\drivers\klick.dat
    2010-07-29 17:37:32 113933 ----a-w- c:\windows\system32\drivers\klin.dat
    2010-07-22 15:49:15 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    2010-07-22 05:57:20 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
    2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
    2010-06-07 22:19:15 16384 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat
     
  2. Newtman

    Newtman TS Rookie Topic Starter

    DDS Log pt2 (Attach)

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 5/19/2008 10:49:36 AM
    System Uptime: 9/18/2010 5:24:18 PM (0 hours ago)

    Motherboard: ASUSTeK Computer INC. | | Rampage Formula
    Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | LGA775 | 2405/266mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 466 GiB total, 184.953 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    F: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: 1394 Net Adapter
    Device ID: V1394\NIC1394\12A3EA81E8C00
    Manufacturer: Microsoft
    Name: 1394 Net Adapter
    PNP Device ID: V1394\NIC1394\12A3EA81E8C00
    Service: NIC1394

    Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
    Description: PS/2 Keyboard
    Device ID: ACPI\PNP0303\4&B6AFFD&0
    Manufacturer: Logitech
    Name: PS/2 Keyboard
    PNP Device ID: ACPI\PNP0303\4&B6AFFD&0
    Service: i8042prt

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: SM Bus Controller
    Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_82771043&REV_02\3&11583659&0&FB
    Manufacturer:
    Name: SM Bus Controller
    PNP Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_82771043&REV_02\3&11583659&0&FB
    Service:

    ==== System Restore Points ===================

    RP5: 9/14/2010 10:30:53 PM - System Checkpoint
    RP6: 9/14/2010 10:31:26 PM - A1
    RP7: 9/18/2010 5:43:46 PM - System Checkpoint

    ==== Installed Programs ======================


    3DMark06
    Adobe Flash Player 10 ActiveX
    Adobe Reader 7.0
    Airport Tycoon 2
    Amazon MP3 Downloader 1.0.9
    Any Video Converter 3.0.3
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Barbarian Invasion
    Bonjour
    CDDRV_Installer
    Commander: Conquest of the Americas [DEMO]
    Creative Audio Console
    Creative Console Launcher
    Creative MediaSource 5
    Creative Software AutoUpdate
    Creative System Information
    Curse Client
    CyberPower PowerPanel Personal Edition
    DawnOfWar
    EasyCleaner
    Eraser 5.8.8
    EVGA Precision 1.1.0
    Grand Theft Auto Vice City
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    iTunes
    Java(TM) 6 Update 12
    K-Lite Codec Pack 4.7.5 (Basic)
    Kaspersky Anti-Virus 2010
    KhalInstallWrapper
    LightScribe System Software 1.12.37.1
    Logitech Registration
    Logitech SetPoint
    Malwarebytes' Anti-Malware
    Marvell Miniport Driver
    Medieval II Total War
    Medieval II Total War : Kingdoms : Americas
    Medieval II Total War : Kingdoms : Britannia
    Medieval II Total War : Kingdoms : Crusades
    Medieval II Total War : Kingdoms : Teutonic
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft National Language Support Downlevel APIs
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual J# .NET Redistributable Package 1.1
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Nero 7 Essentials
    neroxml
    NVIDIA Drivers
    NVIDIA PhysX
    OLYMPUS CAMEDIA Master 2.5
    PC Probe II
    Pirates of the Burning Sea
    QuickTime
    Rome - Total War
    SeaTools for Windows
    Security Update for Windows Internet Explorer 7 (KB938127-v2)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player (KB979402)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165-v2)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Sid Meier's Civilization 4 Complete
    Sid Meier's Civilization IV Colonization
    Sid Meier's Pirates!
    SiSoftware Sandra Lite 2009.SP3c
    Sound Blaster X-Fi
    Spybot - Search & Destroy
    System Requirements Lab
    Tropico 3 Demo 1.01
    Tropico Reloaded
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB971180)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Ventrilo Client
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VLC media player 1.0.5
    Volume Panel
    Warhammer Mark of Chaos
    Warhammer Online - Age of Reckoning
    WebFldrs XP
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 8
    Windows Media Format Runtime
    Windows XP Service Pack 3
    WinRAR archiver

    ==== Event Viewer Messages From Past Week ========

    9/18/2010 5:46:33 PM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 ba4a3712, parameter3 ba58bc60, parameter4 ba58b95c.
    9/18/2010 2:55:21 AM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
    9/15/2010 6:06:47 AM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\D.
    9/15/2010 12:48:56 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 b3045398, parameter3 b22c5b10, parameter4 00000000.
    9/14/2010 4:01:23 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file pci.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.
    9/14/2010 12:58:40 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service.
    9/14/2010 12:58:16 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    9/14/2010 12:58:16 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
    9/14/2010 11:58:42 AM, error: Service Control Manager [7034] - The WMI Performance Adapter service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:58:38 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:58:31 AM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:58:26 AM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:44:29 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    9/14/2010 11:44:10 AM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:43:56 AM, error: Service Control Manager [7034] - The LightScribeService Direct Disc Labeling Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:43:48 AM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:43:42 AM, error: Service Control Manager [7034] - The PowerPanel Personal Edition Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 11:43:32 AM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    9/14/2010 11:43:22 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    9/14/2010 11:11:44 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file explorer.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2900.5512.
    9/14/2010 11:08:46 AM, error: Dhcp [1002] - The IP address lease 24.245.116.182 for the Network Card with network address 001FC6508C50 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    9/14/2010 10:44:40 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 10:44:39 PM, error: Service Control Manager [7034] - The PLFlash DeviceIoControl Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 10:44:39 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 10:44:39 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 10:44:39 PM, error: Service Control Manager [7034] - The Creative Audio Service service terminated unexpectedly. It has done this 1 time(s).
    9/14/2010 1:38:57 PM, information: Windows File Protection [64007] - The protected system file pci.sys could not be verified as valid because the file was in use. Use the SFC utility to verify the integrity of the file at a later time.
    9/14/2010 1:07:19 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd

    ==== End Of File ===========================


    Thanks much and I appreciate the help
     
  3. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Welcome aboard [​IMG]

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    ====================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  4. Newtman

    Newtman TS Rookie Topic Starter

    MBRCheck

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Home Edition
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000003d

    Kernel Drivers (total 130):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806E4000 \WINDOWS\system32\hal.dll
    0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
    0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
    0xB9F79000 ACPI.sys
    0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xB9F68000 pci.kav
    0xBA0A8000 isapnp.sys
    0xBA0B8000 ohci1394.sys
    0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xBA4BC000 compbatt.sys
    0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
    0xBA670000 pciide.sys
    0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xBA0D8000 MountMgr.sys
    0xB9F49000 ftdisk.sys
    0xBA330000 PartMgr.sys
    0xBA0E8000 VolSnap.sys
    0xB9F31000 atapi.sys
    0xBA0F8000 disk.sys
    0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xB9F11000 fltmgr.sys
    0xB9EFF000 sr.sys
    0xB9EE8000 KSecDD.sys
    0xB9E5B000 Ntfs.sys
    0xB9E2E000 NDIS.sys
    0xB9E14000 Mup.sys
    0xBA118000 klbg.sys
    0xBA248000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xB8C8C000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
    0xB8C78000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xBA460000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xB8C54000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xBA468000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xB8C2C000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0xB8BE3000 \SystemRoot\system32\DRIVERS\yk51x86.sys
    0xB8B63000 \SystemRoot\system32\drivers\ctaud2k.sys
    0xB8B3F000 \SystemRoot\system32\drivers\portcls.sys
    0xBA258000 \SystemRoot\system32\drivers\drmk.sys
    0xB8B1C000 \SystemRoot\system32\drivers\ks.sys
    0xB8AE8000 \SystemRoot\system32\drivers\ctoss2k.sys
    0xBA470000 \SystemRoot\system32\drivers\ctprxy2k.sys
    0xBA478000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xBA5E6000 \SystemRoot\system32\DRIVERS\ASACPI.sys
    0xB9DDC000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
    0xBA480000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xBA278000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xBA288000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xBA298000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xBA488000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    0xBA2A8000 \SystemRoot\system32\DRIVERS\klim5.sys
    0xBA78E000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xBA2B8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xB9DCC000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xB8AD1000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xBA2C8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xBA2D8000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xBA490000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xB8AC0000 \SystemRoot\system32\DRIVERS\psched.sys
    0xBA2E8000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xBA498000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xBA4A0000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xBA2F8000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xBA4A8000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xBA5EA000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xB8A62000 \SystemRoot\system32\DRIVERS\update.sys
    0xB92B3000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xBA308000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xBA168000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xBA5EC000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xB25D8000 \SystemRoot\system32\drivers\ha20x2k.sys
    0xB25A9000 \SystemRoot\system32\drivers\emupia2k.sys
    0xB2580000 \SystemRoot\system32\drivers\ctsfm2k.sys
    0xB24E4000 \SystemRoot\system32\drivers\ctac32k.sys
    0xB2479000 \SystemRoot\system32\CTHWIUT.DLL
    0xB244D000 \SystemRoot\system32\CT20XUT.DLL
    0xB2306000 \SystemRoot\system32\CTEXFIFX.DLL
    0xBA350000 \SystemRoot\system32\DRIVERS\flpydisk.sys
    0xB22B5000 \SystemRoot\system32\DRIVERS\klif.sys
    0xBA388000 \SystemRoot\system32\drivers\RTSTOR.SYS
    0xBA594000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0xB93FE000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0xBA390000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0xBA398000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xBA3A0000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
    0xB93EE000 \SystemRoot\System32\Drivers\WDFLDR.SYS
    0xB223A000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
    0xBA5F6000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xBA799000 \SystemRoot\System32\Drivers\Null.SYS
    0xB93DE000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xBA3C0000 \SystemRoot\System32\drivers\vga.sys
    0xBA5F8000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xBA5FA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xBA3C8000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xBA3D0000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xBA59C000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xB1C95000 \??\C:\WINDOWS\system32\drivers\kl1.sys
    0xBA3D8000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
    0xB1C5A000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xB8A2E000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0xB1C01000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xBA3E0000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
    0xB1B61000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xB1B3B000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xB93CE000 \SystemRoot\system32\DRIVERS\klmouflt.sys
    0xB1B19000 \SystemRoot\System32\drivers\afd.sys
    0xB93BE000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xB93AE000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xB1A4E000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xB19DE000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xB939E000 \SystemRoot\System32\Drivers\Fips.SYS
    0xBA5FE000 \SystemRoot\system32\drivers\AsIO.sys
    0xB690E000 \SystemRoot\system32\DRIVERS\kbdhid.sys
    0xBA1C8000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xB19C6000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xBA620000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xB1C6D000 \SystemRoot\System32\drivers\Dxapi.sys
    0xBA3E8000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xBA6BD000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\nv4_disp.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xB1BA1000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xB1339000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xB11CA000 \SystemRoot\system32\DRIVERS\srv.sys
    0xB0D05000 \SystemRoot\system32\drivers\wdmaud.sys
    0xB0DFA000 \SystemRoot\system32\drivers\sysaudio.sys
    0xAF92B000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 45):
    0 System Idle Process
    4 System
    1268 C:\WINDOWS\system32\smss.exe
    1316 csrss.exe
    1340 C:\WINDOWS\system32\winlogon.exe
    1396 C:\WINDOWS\system32\services.exe
    1436 C:\WINDOWS\system32\lsass.exe
    1588 C:\WINDOWS\system32\svchost.exe
    1680 svchost.exe
    1724 C:\WINDOWS\system32\svchost.exe
    1880 svchost.exe
    1912 svchost.exe
    124 C:\WINDOWS\system32\spoolsv.exe
    148 C:\WINDOWS\system32\rundll32.exe
    240 C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    308 svchost.exe
    348 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    392 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
    416 C:\Program Files\Bonjour\mDNSResponder.exe
    432 C:\WINDOWS\system32\CTSVCCDA.EXE
    480 C:\Program Files\Java\jre6\bin\jqs.exe
    536 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    600 C:\WINDOWS\system32\nvsvc32.exe
    624 C:\WINDOWS\system32\IoctlSvc.exe
    728 C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
    768 C:\WINDOWS\system32\svchost.exe
    820 wdfmgr.exe
    1748 C:\WINDOWS\system32\wbem\wmiapsrv.exe
    1788 alg.exe
    3408 C:\WINDOWS\explorer.exe
    3240 C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
    3456 C:\WINDOWS\system32\rundll32.exe
    3560 C:\Program Files\iTunes\iTunesHelper.exe
    3488 C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
    3528 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
    3604 C:\WINDOWS\system32\CTxfispi.exe
    796 C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe
    1888 C:\WINDOWS\system32\ctfmon.exe
    2328 C:\Program Files\Logitech\SetPoint\SetPoint.exe
    3064 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    3876 C:\Program Files\iPod\bin\iPodService.exe
    1100 C:\Program Files\Internet Explorer\iexplore.exe
    2940 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
    1488 C:\Program Files\Internet Explorer\iexplore.exe
    2456 C:\Documents and Settings\Greg\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: ST3500320NS, Rev: SN04

    Size Device Name MBR Status
    --------------------------------------------
    465 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!
     
  5. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    MBRCheck looks good :)
     
  6. Newtman

    Newtman TS Rookie Topic Starter

    ComboFix Log

    ComboFix Log

    ComboFix 10-09-17.04 - Greg 09/18/2010 18:40:22.1.4 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1353 [GMT -4:00]
    Running from: c:\documents and settings\Greg\Desktop\ComboFix.exe
    AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Kaspersky Anti-Virus *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Documents\Server\admin.txt
    C:\Install.exe
    C:\Thumbs.db
    c:\windows\system32\Thumbs.db

    Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
    Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

    Infected copy of c:\windows\explorer.exe was found and disinfected
    Restored copy from - c:\windows\ServicePackFiles\i386\explorer.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-08-18 to 2010-09-18 )))))))))))))))))))))))))))))))
    .

    2010-09-16 16:18 . 2010-09-16 16:18 850448 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\updater.dll
    2010-09-16 16:18 . 2010-09-16 16:18 850520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\updater.dll
    2010-09-14 21:31 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
    2010-09-14 16:44 . 2010-09-14 16:44 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-09-14 16:44 . 2010-09-14 16:44 -------- d-----w- c:\documents and settings\Greg\Application Data\E8B07448EEE071FA9106521E50118832
    2010-09-14 05:44 . 2010-09-14 05:44 155648 --sha-r- c:\windows\system32\normnfc8.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-18 22:48 . 2009-06-16 22:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
    2010-09-18 22:47 . 2008-05-22 22:43 -------- d-----w- c:\program files\CyberPower PowerPanel Personal Edition
    2010-09-14 17:38 . 2006-02-28 12:00 68224 ----a-w- c:\windows\system32\drivers\pci.sys
    2010-09-14 07:31 . 2010-06-09 05:16 -------- d-----w- c:\documents and settings\Greg\Application Data\vlc
    2010-09-08 18:01 . 2009-12-29 08:18 13308 ---ha-w- c:\windows\system32\mlfcache.dat
    2010-09-07 06:40 . 2008-05-21 21:39 13496 ----a-w- c:\documents and settings\Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-08-23 01:28 . 2010-08-15 18:12 -------- d-----w- c:\documents and settings\Greg\Application Data\Tropico 3 Demo
    2010-08-19 00:50 . 2010-07-19 23:28 265529 ----a-w- c:\documents and settings\Greg\Application Data\Sony Online Entertainment\npsoeact.dll
    2010-08-19 00:50 . 2010-07-19 23:27 -------- d-----w- c:\documents and settings\Greg\Application Data\Sony Online Entertainment
    2010-08-18 15:56 . 2010-08-15 18:09 -------- d-----w- c:\program files\Kalypso
    2010-08-18 15:32 . 2010-08-18 15:32 170584 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\prloader.dll
    2010-08-18 15:27 . 2010-08-18 15:27 340520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\avp.exe
    2010-08-17 13:17 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-08-13 02:30 . 2010-08-13 02:30 -------- d-----w- c:\program files\Paradox Interactive
    2010-07-29 17:37 . 2010-06-16 18:00 97549 ----a-w- c:\windows\system32\drivers\klick.dat
    2010-07-29 17:37 . 2010-06-16 18:00 113933 ----a-w- c:\windows\system32\drivers\klin.dat
    2010-07-22 15:49 . 2006-02-28 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    2010-07-22 05:57 . 2009-06-17 16:23 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-06-30 12:31 . 2006-02-28 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
    2010-06-24 12:22 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-06-23 13:44 . 2006-02-28 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
    2010-06-21 15:27 . 2006-02-28 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PowerPanel Personal Edition User Interaction"="c:\program files\CyberPower PowerPanel Personal Edition\pppeuser.exe" [2007-01-10 262144]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2008-08-06 233576]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608]
    "AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
    "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2010-08-18 340520]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-6-29 805392]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 06:42 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "igndlm.exe"=c:\program files\Download Manager\DLM.exe /windowsstart /startifwork
    "ctfmon.exe"=c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "CTxfiHlp"=CTXFIHLP.EXE
    "nwiz"=nwiz.exe /install
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
    "erncwsxoam.tmp"="c:\docume~1\Greg\LOCALS~1\Temp\erncwsxoam.tmp"
    "aomewnrcsx.tmp"="c:\docume~1\Greg\LOCALS~1\Temp\aomewnrcsx.tmp"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Curse\\CurseClient.exe"=
    "c:\\Program Files\\Flying Lab Software\\Pirates of the Burning Sea\\PlayPOTBS.exe"=
    "c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
    "c:\\Program Files\\Futuremark\\3DMark06\\3DMark06.exe"=
    "c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
    "c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization IV Colonization\\Colonization.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\RpcAgentSrv.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\WNt500x86\\RpcSandraSrv.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [10/14/2009 9:18 PM 36880]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [9/14/2009 2:42 PM 32272]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [10/2/2009 7:39 PM 19472]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
    S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [8/30/2008 12:03 PM 79360]
    S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe [6/26/2009 4:15 AM 98488]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-03-17 21:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    mStart Page = hxxp://www.google.com
    mWindow Title = This Space For Rent
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-09-18 18:48
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCI]
    "ImagePath"="system32\drivers\pci.kav"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1344)
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    c:\program files\common files\logitech\bluetooth\LBTServ.dll

    - - - - - - - > 'explorer.exe'(536)
    c:\windows\system32\WININET.dll
    c:\program files\Logitech\SetPoint\GameHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\rundll32.exe
    c:\program files\Creative\Shared Files\CTAudSvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\CTsvcCDA.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\windows\system32\nvsvc32.exe
    c:\windows\system32\IoctlSvc.exe
    c:\program files\CyberPower PowerPanel Personal Edition\ppped.exe
    c:\windows\system32\wdfmgr.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\windows\SYSTEM32\CTXFISPI.EXE
    c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\wbem\wmiapsrv.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2010-09-18 18:51:57 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-09-18 22:51

    Pre-Run: 198,397,890,560 bytes free
    Post-Run: 198,326,992,896 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - 30379051AA5D8C6F46D4D8801B9F1DF3
     
  7. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\windows\system32\normnfc8.dll
    
    
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "erncwsxoam.tmp"=-
    "aomewnrcsx.tmp"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCI]
    "ImagePath"="system32\drivers\pci.sys"
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  8. Newtman

    Newtman TS Rookie Topic Starter

    New ComboFix Log

    NEW ComboFix Log

    ComboFix 10-09-17.04 - Greg 09/18/2010 19:43:34.2.4 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1511 [GMT -4:00]
    Running from: c:\documents and settings\Greg\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Greg\Desktop\CFScript.txt
    AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Kaspersky Anti-Virus *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

    FILE ::
    "c:\windows\system32\normnfc8.dll"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\normnfc8.dll

    .
    ((((((((((((((((((((((((( Files Created from 2010-08-18 to 2010-09-18 )))))))))))))))))))))))))))))))
    .

    2010-09-18 22:53 . 2010-09-18 22:53 -------- d-----w- c:\windows\LastGood
    2010-09-16 16:18 . 2010-09-16 16:18 850448 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\updater.dll
    2010-09-16 16:18 . 2010-09-16 16:18 850520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\updater.dll
    2010-09-14 21:31 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
    2010-09-14 16:44 . 2010-09-14 16:44 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-09-14 16:44 . 2010-09-14 16:44 -------- d-----w- c:\documents and settings\Greg\Application Data\E8B07448EEE071FA9106521E50118832

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-18 22:48 . 2009-06-16 22:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
    2010-09-18 22:47 . 2008-05-22 22:43 -------- d-----w- c:\program files\CyberPower PowerPanel Personal Edition
    2010-09-14 17:38 . 2006-02-28 12:00 68224 ----a-w- c:\windows\system32\drivers\pci.sys
    2010-09-14 07:31 . 2010-06-09 05:16 -------- d-----w- c:\documents and settings\Greg\Application Data\vlc
    2010-09-08 18:01 . 2009-12-29 08:18 13308 ---ha-w- c:\windows\system32\mlfcache.dat
    2010-09-07 06:40 . 2008-05-21 21:39 13496 ----a-w- c:\documents and settings\Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-08-23 01:28 . 2010-08-15 18:12 -------- d-----w- c:\documents and settings\Greg\Application Data\Tropico 3 Demo
    2010-08-19 00:50 . 2010-07-19 23:28 265529 ----a-w- c:\documents and settings\Greg\Application Data\Sony Online Entertainment\npsoeact.dll
    2010-08-19 00:50 . 2010-07-19 23:27 -------- d-----w- c:\documents and settings\Greg\Application Data\Sony Online Entertainment
    2010-08-18 15:56 . 2010-08-15 18:09 -------- d-----w- c:\program files\Kalypso
    2010-08-18 15:32 . 2010-08-18 15:32 170584 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\prloader.dll
    2010-08-18 15:27 . 2010-08-18 15:27 340520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\avp.exe
    2010-08-17 13:17 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-08-13 02:30 . 2010-08-13 02:30 -------- d-----w- c:\program files\Paradox Interactive
    2010-07-29 17:37 . 2010-06-16 18:00 97549 ----a-w- c:\windows\system32\drivers\klick.dat
    2010-07-29 17:37 . 2010-06-16 18:00 113933 ----a-w- c:\windows\system32\drivers\klin.dat
    2010-07-22 15:49 . 2006-02-28 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    2010-07-22 05:57 . 2009-06-17 16:23 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-06-30 12:31 . 2006-02-28 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
    2010-06-24 12:22 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-06-23 13:44 . 2006-02-28 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
    2010-06-21 15:27 . 2006-02-28 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
    .

    ((((((((((((((((((((((((((((( SnapShot@2010-09-18_22.48.32 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-02-18 18:18 . 2009-08-06 23:23 274288 c:\windows\system32\mucltui.dll
    + 2010-09-18 22:53 . 2008-10-16 19:06 268648 c:\windows\LastGood\system32\mucltui.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PowerPanel Personal Edition User Interaction"="c:\program files\CyberPower PowerPanel Personal Edition\pppeuser.exe" [2007-01-10 262144]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2008-08-06 233576]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608]
    "AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
    "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2010-08-18 340520]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-6-29 805392]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 06:42 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "igndlm.exe"=c:\program files\Download Manager\DLM.exe /windowsstart /startifwork
    "ctfmon.exe"=c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "CTxfiHlp"=CTXFIHLP.EXE
    "nwiz"=nwiz.exe /install
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Curse\\CurseClient.exe"=
    "c:\\Program Files\\Flying Lab Software\\Pirates of the Burning Sea\\PlayPOTBS.exe"=
    "c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
    "c:\\Program Files\\Futuremark\\3DMark06\\3DMark06.exe"=
    "c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
    "c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
    "c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization IV Colonization\\Colonization.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\RpcAgentSrv.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP3c\\WNt500x86\\RpcSandraSrv.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [10/14/2009 9:18 PM 36880]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [9/14/2009 2:42 PM 32272]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [10/2/2009 7:39 PM 19472]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
    S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [8/30/2008 12:03 PM 79360]
    S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe [6/26/2009 4:15 AM 98488]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-03-17 21:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    mStart Page = hxxp://www.google.com
    mWindow Title = This Space For Rent
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-09-18 19:50
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCI]
    "ImagePath"="system32\drivers\pci.kav"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1344)
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    c:\program files\common files\logitech\bluetooth\LBTServ.dll
    .
    Completion time: 2010-09-18 19:51:29
    ComboFix-quarantined-files.txt 2010-09-18 23:51
    ComboFix2.txt 2010-09-18 22:51

    Pre-Run: 198,330,105,856 bytes free
    Post-Run: 198,318,419,968 bytes free

    - - End Of File - - 394EED92D9CB28DA29420B74F31738D1
     
  9. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    How is redirection?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  10. Newtman

    Newtman TS Rookie Topic Starter

    OTL pt1

    OTL

    OTL logfile created on: 9/18/2010 8:31:27 PM - Run 1
    OTL by OldTimer - Version 3.2.12.1 Folder = C:\Documents and Settings\Greg\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
    6.00 Gb Paging File | 6.00 Gb Available in Paging File | 94.00% Paging File free
    Paging file location(s): C:\pagefile.sys 4092 4092 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 465.75 Gb Total Space | 184.72 Gb Free Space | 39.66% Space Free | Partition Type: NTFS
    D: Drive not present or media not loaded
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name:
    Current User Name: Greg
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Processes (SafeList) ==========

    PRC - [2010/09/18 20:29:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\OTL.exe
    PRC - [2010/08/18 14:15:12 | 000,340,520 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
    PRC - [2008/08/06 16:31:44 | 000,233,576 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
    PRC - [2008/07/11 15:46:44 | 000,969,216 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTxfispi.exe
    PRC - [2008/05/02 02:44:08 | 000,805,392 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
    PRC - [2008/05/02 02:40:56 | 000,076,304 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    PRC - [2008/04/30 10:35:20 | 000,425,984 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2005/11/04 18:07:56 | 000,049,152 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/09/18 20:29:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\OTL.exe
    MOD - [2009/07/12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
    MOD - [2008/05/02 02:42:50 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\lgscroll.dll
    MOD - [2008/05/02 02:38:54 | 000,064,016 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\GameHook.dll
    MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
    SRV - [2010/08/18 14:15:12 | 000,340,520 | ---- | M] (Kaspersky Lab) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe -- (AVP)
    SRV - [2009/05/17 22:04:00 | 000,098,488 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe -- (SandraAgentSrv)
    SRV - [2008/08/30 12:03:07 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
    SRV - [2008/05/02 02:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
    SRV - [2008/04/30 10:35:20 | 000,425,984 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
    SRV - [2007/01/10 19:54:10 | 000,512,000 | ---- | M] () [Auto | Stopped] -- C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe -- (ppped)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [File_System | Boot | Stopped] -- C:\WINDOWS\System32\DRIVERS\Lbd.sys -- (Lbd)
    DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2010/06/16 14:11:46 | 000,315,408 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
    DRV - [2010/03/04 16:13:36 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tbhsd.sys -- (tbhsd)
    DRV - [2009/10/14 21:18:34 | 000,036,880 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg)
    DRV - [2009/10/02 19:39:44 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
    DRV - [2009/09/14 14:42:46 | 000,032,272 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
    DRV - [2009/09/01 15:29:50 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1)
    DRV - [2009/05/05 23:37:52 | 000,026,216 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\WNt500x86\sandra.sys -- (SANDRA)
    DRV - [2009/01/15 09:19:00 | 006,301,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2008/12/09 11:06:00 | 000,296,448 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
    DRV - [2008/07/15 18:12:38 | 001,173,016 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ha20x2k.sys -- (ha20x2k)
    DRV - [2008/07/15 18:11:14 | 000,092,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia)
    DRV - [2008/07/15 18:10:28 | 000,157,208 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
    DRV - [2008/07/15 18:09:44 | 000,014,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k)
    DRV - [2008/07/15 18:08:36 | 000,127,000 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
    DRV - [2008/07/15 18:08:08 | 000,347,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctdvda2k.sys -- (ctdvda2k)
    DRV - [2008/07/15 18:07:18 | 000,527,384 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM)
    DRV - [2008/07/15 18:06:46 | 000,511,000 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k)
    DRV - [2008/07/15 17:23:42 | 000,072,728 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\CTHWIUT.DLL -- (CTHWIUT.DLL)
    DRV - [2008/07/15 17:23:22 | 000,170,520 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\CT20XUT.DLL -- (CT20XUT.DLL)
    DRV - [2008/07/15 17:22:46 | 001,323,544 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\CTEXFIFX.DLL -- (CTEXFIFX.DLL)
    DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
    DRV - [2008/02/29 03:13:46 | 000,028,944 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
    DRV - [2008/02/29 03:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
    DRV - [2008/02/29 03:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
    DRV - [2008/02/29 03:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
    DRV - [2008/02/25 09:41:28 | 000,329,240 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEDSPSY.DLL -- (CTEDSPSY.DLL)
    DRV - [2008/02/25 09:41:18 | 000,134,680 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEDSPIO.DLL -- (CTEDSPIO.DLL)
    DRV - [2008/02/25 09:41:14 | 000,100,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTERFXFX.DLL -- (CTERFXFX.DLL)
    DRV - [2008/02/25 09:41:10 | 000,286,232 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEDSPFX.DLL -- (CTEDSPFX.DLL)
    DRV - [2008/02/25 09:41:06 | 000,174,104 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEAPSFX.DLL -- (CTEAPSFX.DLL)
    DRV - [2008/02/25 09:41:02 | 000,566,296 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTSBLFX.DLL -- (CTSBLFX.DLL)
    DRV - [2008/02/25 09:40:56 | 000,551,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTAUDFX.DLL -- (CTAUDFX.DLL)
    DRV - [2008/02/25 09:40:52 | 000,098,328 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\COMMONFX.DLL -- (COMMONFX.DLL)
    DRV - [2006/10/18 15:12:16 | 000,012,664 | R--- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO)
    DRV - [2005/07/21 10:48:04 | 000,020,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTSTOR.sys -- (RTSTOR)
    DRV - [2004/08/12 22:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
    DRV - [2004/08/03 23:07:48 | 000,068,224 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\pci.kav -- (PCI)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    O1 HOSTS File: ([2010/09/18 19:50:04 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll (Kaspersky Lab)
    O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll (Kaspersky Lab)
    O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
    O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe (Kaspersky Lab)
    O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
    O4 - HKCU..\Run: [PowerPanel Personal Edition User Interaction] C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe ()
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll (Kaspersky Lab)
    O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll (Kaspersky Lab)
    O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
    O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/voxacm.CAB (Reg Error: Key error.)
    O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1263417214078 (WUWebControl Class)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1263417198500 (MUWebControl Class)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 156.154.119.11 156.154.129.11
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
    O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
    O24 - Desktop WallPaper: C:\Documents and Settings\Greg\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Greg\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2008/05/19 10:47:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (7038850102722560)

    ========== Files/Folders - Created Within 90 Days ==========

    [2010/09/18 20:29:33 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\OTL.exe
    [2010/09/18 18:53:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
    [2010/09/18 18:36:52 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/09/18 18:35:25 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/09/18 18:35:25 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/09/18 18:35:25 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/09/18 18:35:25 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2010/09/18 18:35:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/09/18 18:35:02 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/09/17 14:54:23 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Greg\Recent
    [2010/09/15 01:05:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Greg\My Documents\z Clean-up Logs
    [2010/09/14 22:43:40 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\TFC.exe
    [2010/09/14 17:38:34 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2010/09/14 12:44:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Greg\Application Data\E8B07448EEE071FA9106521E50118832
    [2010/09/14 01:43:57 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Documents\Server
    [2010/08/15 14:12:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Greg\Application Data\Tropico 3 Demo
    [2010/08/15 14:09:47 | 000,000,000 | ---D | C] -- C:\Program Files\Kalypso
    [2010/08/12 22:42:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Greg\My Documents\Commander Demo
    [2010/08/12 22:30:11 | 000,000,000 | ---D | C] -- C:\Program Files\Paradox Interactive
    [2010/07/31 18:25:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Greg\Local Settings\Application Data\unhrurqat
    [2010/07/29 03:50:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\%PersonalRootCertificateFolder%
    [2010/07/19 19:27:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Greg\Application Data\Sony Online Entertainment
    [2010/07/19 19:27:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Greg\Local Settings\Application Data\SCE
    [2006/05/24 00:38:39 | 000,034,816 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
    [2 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
     
  11. Newtman

    Newtman TS Rookie Topic Starter

    OTL pt2

    ========== Files - Modified Within 90 Days ==========

    [2010/09/18 20:29:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\OTL.exe
    [2010/09/18 19:51:30 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/09/18 19:50:11 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
    [2010/09/18 19:50:04 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/09/18 18:48:01 | 000,207,365 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
    [2010/09/18 18:47:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/09/18 18:47:43 | 2146,553,856 | -HS- | M] () -- C:\hiberfil.sys
    [2010/09/18 18:45:40 | 017,039,360 | ---- | M] () -- C:\Documents and Settings\Greg\ntuser.dat
    [2010/09/18 18:45:40 | 000,055,048 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000006-00000000-00000002-00001102-00000005-00311102}.rfx
    [2010/09/18 18:45:40 | 000,055,048 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000006-00000000-00000002-00001102-00000005-00311102}.rfx
    [2010/09/18 18:45:40 | 000,000,788 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000006-00000000-00000002-00001102-00000005-00311102}.rfx
    [2010/09/18 18:37:00 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2010/09/18 18:27:19 | 003,846,590 | R--- | M] () -- C:\Documents and Settings\Greg\Desktop\ComboFix.exe
    [2010/09/18 18:26:49 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\MBRCheck.exe
    [2010/09/17 16:13:35 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Greg\ntuser.ini
    [2010/09/17 13:38:59 | 000,013,698 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/09/16 16:12:03 | 000,126,976 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\ResetTeaTimer.exe
    [2010/09/15 00:44:07 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\dds.scr
    [2010/09/14 23:05:31 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\fyswmet6.exe
    [2010/09/14 22:44:40 | 000,524,020 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/09/14 22:44:40 | 000,442,796 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/09/14 22:44:40 | 000,071,936 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/09/14 22:43:40 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\TFC.exe
    [2010/09/14 22:32:40 | 000,052,736 | ---- | M] () -- C:\Documents and Settings\Greg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/09/14 20:09:24 | 000,008,078 | ---- | M] () -- C:\Documents and Settings\Greg\My Documents\2010.19.14 - 7.57pm.rar
    [2010/09/14 17:54:23 | 000,095,864 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/09/14 17:47:43 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/09/14 15:50:33 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
    [2010/09/14 15:50:25 | 000,000,125 | ---- | M] () -- C:\Documents and Settings\Greg\default.pls
    [2010/09/14 13:38:07 | 000,068,224 | ---- | M] () -- C:\WINDOWS\System32\drivers\pci.sys
    [2010/09/14 12:48:51 | 000,001,493 | ---- | M] () -- C:\Documents and Settings\Greg\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Explorer.lnk
    [2010/09/12 21:12:45 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\Greg\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
    [2010/09/10 15:55:23 | 000,000,151 | ---- | M] () -- C:\WINDOWS\PhotoSnapViewer.INI
    [2010/09/08 14:01:27 | 000,013,308 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
    [2010/09/07 02:40:01 | 000,013,496 | ---- | M] () -- C:\Documents and Settings\Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    [2010/08/31 18:01:28 | 000,000,127 | ---- | M] () -- C:\WINDOWS\wininit.ini
    [2010/08/30 14:46:26 | 006,550,071 | ---- | M] () -- C:\Documents and Settings\Greg\My Documents\Life_the_Game_of_Spongebob_Squarepants.pdf
    [2010/08/18 20:43:08 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/08/18 20:29:47 | 002,114,362 | -H-- | M] () -- C:\Documents and Settings\Greg\Local Settings\Application Data\IconCache.db
    [2010/08/18 12:02:50 | 000,000,949 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Tropico 2.lnk
    [2010/08/18 12:02:50 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Tropico.lnk
    [2010/08/15 14:09:48 | 000,000,849 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\Tropico 3 Demo.lnk
    [2010/08/12 22:34:10 | 000,001,835 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\Play Commander Demo.lnk
    [2010/08/03 15:02:03 | 000,021,997 | ---- | M] () -- C:\Documents and Settings\Greg\My Documents\2010_AirShowSchedule-rev.pdf
    [2010/07/29 13:37:32 | 000,113,933 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
    [2010/07/29 13:37:32 | 000,097,549 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
    [2010/07/07 00:26:11 | 003,555,313 | ---- | M] () -- C:\Documents and Settings\Greg\My Documents\Doc Johnson Summer'09.pdf
    [2 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2010/09/18 18:37:00 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2010/09/18 18:36:56 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2010/09/18 18:35:25 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/09/18 18:35:25 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/09/18 18:35:25 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/09/18 18:35:25 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/09/18 18:35:25 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/09/18 18:27:07 | 003,846,590 | R--- | C] () -- C:\Documents and Settings\Greg\Desktop\ComboFix.exe
    [2010/09/18 18:26:49 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Greg\Desktop\MBRCheck.exe
    [2010/09/17 21:49:18 | 2146,553,856 | -HS- | C] () -- C:\hiberfil.sys
    [2010/09/16 16:12:03 | 000,126,976 | ---- | C] () -- C:\Documents and Settings\Greg\Desktop\ResetTeaTimer.exe
    [2010/09/15 00:44:07 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Greg\Desktop\dds.scr
    [2010/09/14 23:05:31 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Greg\Desktop\fyswmet6.exe
    [2010/09/14 20:09:24 | 000,008,078 | ---- | C] () -- C:\Documents and Settings\Greg\My Documents\2010.19.14 - 7.57pm.rar
    [2010/09/14 01:50:42 | 017,039,360 | ---- | C] () -- C:\Documents and Settings\Greg\ntuser.dat
    [2010/08/30 14:46:26 | 006,550,071 | ---- | C] () -- C:\Documents and Settings\Greg\My Documents\Life_the_Game_of_Spongebob_Squarepants.pdf
    [2010/08/18 12:02:50 | 000,000,949 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Tropico 2.lnk
    [2010/08/18 12:02:50 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Tropico.lnk
    [2010/08/15 14:09:48 | 000,000,849 | ---- | C] () -- C:\Documents and Settings\Greg\Desktop\Tropico 3 Demo.lnk
    [2010/08/12 22:34:10 | 000,001,835 | ---- | C] () -- C:\Documents and Settings\Greg\Desktop\Play Commander Demo.lnk
    [2010/08/03 15:02:03 | 000,021,997 | ---- | C] () -- C:\Documents and Settings\Greg\My Documents\2010_AirShowSchedule-rev.pdf
    [2010/07/25 14:59:46 | 000,000,127 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2010/07/07 00:26:11 | 003,555,313 | ---- | C] () -- C:\Documents and Settings\Greg\My Documents\Doc Johnson Summer'09.pdf
    [2009/11/25 03:15:42 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
    [2009/10/29 19:53:04 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
    [2009/06/26 04:15:56 | 010,665,984 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\sandra.mda
    [2009/05/19 13:26:30 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
    [2009/03/30 14:33:55 | 000,000,391 | ---- | C] () -- C:\WINDOWS\COVERE~1.INI
    [2009/01/15 09:19:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
    [2009/01/15 09:19:00 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
    [2009/01/15 09:19:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
    [2009/01/15 09:19:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
    [2008/10/07 10:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
    [2008/10/07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
    [2008/07/15 16:35:42 | 000,030,305 | ---- | C] () -- C:\WINDOWS\System32\instwdm.ini
    [2008/07/11 16:22:30 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
    [2008/07/11 15:50:28 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\CtxfiRes.dll
    [2008/07/11 15:50:28 | 000,003,072 | ---- | C] () -- C:\WINDOWS\CTXFIRES.DLL
    [2008/06/05 08:58:26 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
    [2008/06/01 01:35:27 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
    [2008/05/22 22:00:45 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2008/05/22 18:14:39 | 000,000,152 | ---- | C] () -- C:\WINDOWS\CoolPlay.ini
    [2008/05/21 19:13:13 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
    [2008/05/21 19:01:32 | 000,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll
    [2008/05/21 19:01:32 | 000,012,664 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys
    [2008/05/21 19:01:30 | 000,012,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys
    [2008/05/21 19:01:30 | 000,010,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys
    [2008/05/21 18:51:11 | 000,052,736 | ---- | C] () -- C:\Documents and Settings\Greg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/05/21 05:39:17 | 000,034,668 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
    [2008/05/21 05:39:15 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
    [2008/05/21 05:39:09 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
    [2008/02/20 21:00:12 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CTBurst.dll
    [2007/08/13 20:45:02 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\ctmmactl.dll
    [2006/10/02 17:25:18 | 000,000,307 | ---- | C] () -- C:\WINDOWS\System32\kill.ini
    [2006/02/28 08:00:00 | 000,068,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\pci.sys

    ========== LOP Check ==========

    [2008/05/21 21:17:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
    [2010/03/19 03:23:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RapidSolution
    [2009/12/29 04:14:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2010/06/08 01:10:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
    [2010/01/22 01:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\Amazon
    [2010/03/14 02:18:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\AnvSoft
    [2010/09/14 12:44:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\E8B07448EEE071FA9106521E50118832
    [2008/05/21 21:41:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\Leadertech
    [2010/08/18 20:50:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\Sony Online Entertainment
    [2008/05/21 05:39:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\TMP
    [2010/08/22 21:28:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\Tropico 3 Demo
    [2010/03/10 20:59:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Greg\Application Data\TS3Client

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/11/25 03:53:29 | 000,002,523 | ---- | M] () -- C:\1021724319
    [2010/06/07 23:59:48 | 000,117,148 | ---- | M] () -- C:\aaw7boot.log
    [2008/05/19 10:47:52 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2008/05/19 10:43:10 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2010/09/18 18:37:00 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/09/18 19:51:30 | 000,009,943 | ---- | M] () -- C:\ComboFix.txt
    [2008/05/19 10:47:52 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
    [2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
    [2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
    [2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
    [2010/09/18 18:47:43 | 2146,553,856 | -HS- | M] () -- C:\hiberfil.sys
    [2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
    [2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
    [2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
    [2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
    [2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
    [2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
    [2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
    [2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
    [2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
    [2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
    [2008/05/19 10:47:52 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2010/06/01 17:43:58 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
    [2008/05/19 10:47:52 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2006/02/28 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008/05/21 18:11:31 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2010/09/18 18:47:43 | 4290,772,992 | -HS- | M] () -- C:\pagefile.sys
    [2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
    [2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
    [2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI

    < %systemroot%\Fonts\*.com >
    [2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2008/05/19 10:47:34 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2008/05/19 06:31:50 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2008/05/19 06:31:50 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2008/05/19 06:31:50 | 000,925,696 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2008/05/21 18:13:50 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >
    [2008/04/10 19:52:08 | 000,648,192 | ---- | M] () -- C:\WINDOWS\system32\NEROINSTAEC43759.DB

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2008/05/21 18:20:25 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Greg\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2008/05/19 10:53:37 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Greg\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/09/14 17:25:03 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\Greg\Desktop\ATF-Cleaner.exe
    [2010/09/18 18:27:19 | 003,846,590 | R--- | M] () -- C:\Documents and Settings\Greg\Desktop\ComboFix.exe
    [2010/09/14 23:05:31 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\fyswmet6.exe
    [2010/09/18 18:26:49 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\MBRCheck.exe
    [2010/09/18 20:29:34 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\OTL.exe
    [2010/09/16 16:12:03 | 000,126,976 | ---- | M] () -- C:\Documents and Settings\Greg\Desktop\ResetTeaTimer.exe
    [2010/09/14 22:43:40 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Greg\Desktop\TFC.exe
     
  12. Newtman

    Newtman TS Rookie Topic Starter

    OTL pt3

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2008/05/21 18:20:25 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Greg\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/09/18 20:13:33 | 000,065,536 | -HS- | M] () -- C:\Documents and Settings\Greg\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2008/04/13 20:12:38 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Files - Unicode (All) ==========
    [2010/01/11 15:56:09 | 000,000,000 | ---D | M](C:\Documents and Settings\Greg\Application Data\???????sAppData) -- C:\Documents and Settings\Greg\Application Data\敎潲䍄敔灭慬整sAppData
    [2010/01/11 15:56:09 | 000,000,000 | ---D | M](C:\Documents and Settings\Greg\Application Data\???????sAppData) -- C:\Documents and Settings\Greg\Application Data\敎潲䍄敔灭慬整sAppData
    (C:\Documents and Settings\Greg\Application Data\???????sAppData) -- C:\Documents and Settings\Greg\Application Data\敎潲䍄敔灭慬整sAppData

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 88 bytes -> C:\1021724319:SummaryInformation
    < End of report >
     
  13. Newtman

    Newtman TS Rookie Topic Starter

    OTL Extras

    Here's the OTL Extras. Faster than breaking it up into sections

    Redirection is gone. But new pages still wont open in a new window, they still open in a new tab. Unless ive got it set wrong. Doublechecking
     

    Attached Files:

  14. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Good news :)

    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =====================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
      O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
      O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
      O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/voxacm.CAB (Reg Error: Key error.)
      O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...8f/wvc1dmo.cab (Reg Error: Key error.)
      [2 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ] 
      @Alternate Data Stream - 88 bytes -> C:\1021724319:SummaryInformation
      
      
      :Services
      
      :Reg
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
      "" =-
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =====================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Go to Kaspersky website and perform an online antivirus scan.

    • Disable your active antivirus program.
    • Read through the requirements and privacy statement and click on Accept button.
    • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    • When the downloads have finished, click on Settings.
    • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
      • Archives
      • Mail databases
    • Click on My Computer under Scan.
    • Once the scan is complete, it will display the results. Click on View Scan Report.
    • You will see a list of infected items there. Click on Save Report As....
    • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
     
  15. Newtman

    Newtman TS Rookie Topic Starter

    Newest OTL

    Newest OTL

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
    Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
    Starting removal of ActiveX control {00000075-9980-0010-8000-00AA00389B71}
    C:\WINDOWS\Downloaded Program Files\voxacm.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{00000075-9980-0010-8000-00AA00389B71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000075-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{00000075-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000075-9980-0010-8000-00AA00389B71}\ not found.
    Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}
    C:\WINDOWS\Downloaded Program Files\wvc1dmo.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31435657-9980-0010-8000-00AA00389B71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{31435657-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
    C:\Documents and Settings\All Users\Application Data\xml2D.tmp deleted successfully.
    C:\Documents and Settings\All Users\Application Data\xml2E.tmp deleted successfully.
    ADS C:\1021724319:SummaryInformation deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\\ deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Greg
    ->Temp folder emptied: 9252581 bytes
    ->Temporary Internet Files folder emptied: 10388862 bytes
    ->Java cache emptied: 2027 bytes
    ->Flash cache emptied: 533 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32835 bytes

    User: Lori
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32835 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 2355245 bytes

    Total Files Cleaned = 21.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default User

    User: Greg
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: Lori
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.12.1 log created on 09182010_213410

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\SXVJM1VV\01[1].htm moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\SXVJM1VV\sh23[1].html moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\SXVJM1VV\topic153522[2].html moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\1BKVQLW0\adsCAHOEPWN.htm moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

    Registry entries deleted on Reboot...
     
  16. Newtman

    Newtman TS Rookie Topic Starter

    Security Check

    Security Check

    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 3
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    Kaspersky Anti-Virus 2010
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    EasyCleaner
    Java(TM) 6 Update 21
    Adobe Flash Player
    Adobe Reader 7.0
    Out of date Adobe Reader installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Kaspersky Lab Kaspersky Anti-Virus 2010 avp.exe
    Kaspersky Lab Kaspersky Anti-Virus 2010 klwtblfs.exe
    ````````````````````````````````
    DNS Vulnerability Check:

    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````
     
  17. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Good :)

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [​IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button
     
  18. Newtman

    Newtman TS Rookie Topic Starter

    Hmmm

    I cant run the Kaspersky Online Scan. If I disable my Kaspersky Anti-virus to run the Scan it closes all my open ports. If I leave it running it tells me to run the scan from Kaspersky website, where the scan isnt active due to being "updated and improved"

    so ... on to updating me reader
     
  19. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • IMPORTANT! UN-check Remove found threats
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Push Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
     
  20. Newtman

    Newtman TS Rookie Topic Starter

    ESET Online scanner

    Ran Eset Online Scanner. It came back with zero detected threats but no option to save a text file or view any results. After the scan the only option given was a check-box to uninstall on close and grey square button to "Finish". Clicking Finish took me to the option to buy. Nothing else.
     
  21. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Good :)

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how is your computer doing.
     
  22. Newtman

    Newtman TS Rookie Topic Starter

    Last OTL

    Here's the last OTL log after restore

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Greg
    ->Temp folder emptied: 41289518 bytes
    ->Temporary Internet Files folder emptied: 58743136 bytes
    ->Java cache emptied: 128101 bytes
    ->Flash cache emptied: 802 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Lori
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 96.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default User

    User: Greg
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: Lori
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.14.0 log created on 09192010_141441

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\ZNJJZA16\sh23[1].html moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\LAIIKPGH\ads[2].htm moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\LAIIKPGH\ads[3].htm moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\Content.IE5\1L2B577P\topic153522-2[1].html moved successfully.
    C:\Documents and Settings\Greg\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

    Registry entries deleted on Reboot...
     
  23. Newtman

    Newtman TS Rookie Topic Starter

    Thanks!

    Ok, Everything looks good.
    I have a custom script to clean Temp files that I run every night before I shut down, In addition to running ATF-Cleaner. I try to run Kaspersky Quick scan and Malwarebytes Quick scan at least twice a week, with full scans of each once a week. Plus a Spybot Search & Destroy and EasyCleaner once a week. I just had some bad luck I guess :-(.
    Is there anything I should edit out of my posts? I believe i saw my IP and my computer name in a couple of the posts.
    Thanks Much for your help, I very much appreciate it!
     
  24. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    You're very welcome :)

    Good luck and stay safe :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...