Laptop taken over by apype and smartwebsearch

Inactive
By frh
Nov 19, 2011
Topic Status:
Not open for further replies.
  1. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Try from Safe Mode.
  2. frh

    frh Newcomer, in training Topic Starter Posts: 41

    IE Reset doesn't remove Smartwebsearch

    Couldn't get into safe mode by normal routes. Finally got there by switching off via long power key press. Reset IE in Safe Mode (all options selected) and Smartwebsearch is still there after normal reboot. Should I go ahead and run OTL with your latest code?
  3. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Yes, go ahead and when done post fresh OTL log as well.
  4. frh

    frh Newcomer, in training Topic Starter Posts: 41

    4th OTL Log Pt 1

    Didn't get a log after Run Fix. Still seeing Smartwebsearch in IE and Firefox. Chrome and Safari still hijacked. Log after Quick Scan:


    OTL logfile created on: 22-Nov-11 4:42:28 AM - Run 3
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Daddy\Desktop
    64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7600.16385)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy

    3.87 Gb Total Physical Memory | 2.21 Gb Available Physical Memory | 57.09% Memory free
    7.73 Gb Paging File | 5.82 Gb Available in Paging File | 75.28% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 451.01 Gb Total Space | 306.42 Gb Free Space | 67.94% Space Free | Partition Type: NTFS
    Drive D: | 457.02 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: HOLDER-PC | User Name: Daddy | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011-11-22 00:03:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
    PRC - [2011-11-03 12:06:56 | 002,152,152 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
    PRC - [2011-11-03 12:06:56 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
    PRC - [2011-09-06 21:45:28 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2011-06-06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2011-04-18 11:01:12 | 001,827,328 | ---- | M] (AudioEngines Inc.) -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe
    PRC - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
    PRC - [2011-01-13 20:54:26 | 000,464,856 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
    PRC - [2011-01-13 20:42:12 | 003,811,648 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    PRC - [2011-01-13 20:39:32 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    PRC - [2011-01-13 20:37:02 | 000,705,856 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
    PRC - [2010-11-02 00:02:18 | 001,427,952 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
    PRC - [2010-11-02 00:02:12 | 000,522,736 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    PRC - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    PRC - [2010-06-08 17:49:26 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    PRC - [2010-03-03 21:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    PRC - [2010-03-03 21:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    PRC - [2009-12-29 21:19:14 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
    PRC - [2009-09-13 00:09:10 | 000,103,768 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
    PRC - [2009-09-13 00:09:04 | 000,550,232 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
    PRC - [2009-06-24 23:21:38 | 000,409,744 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
    PRC - [2009-06-09 15:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
    PRC - [2007-05-21 00:37:36 | 000,124,512 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE


    ========== Modules (No Company Name) ==========

    MOD - [2011-10-14 02:48:07 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\6d859463c9e6a7423ddb335211a79dda\System.Core.ni.dll
    MOD - [2011-10-14 02:46:54 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\dde0e0cfec8f496421c5f5415d623480\IAStorUtil.ni.dll
    MOD - [2011-10-14 02:41:07 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5672e6b9d976feca51deb06d8dd1df0e\PresentationFramework.Aero.ni.dll
    MOD - [2011-10-14 02:40:51 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\018d2569cf208acbe8ad73908705f607\System.Runtime.Remoting.ni.dll
    MOD - [2011-10-14 02:40:40 | 014,322,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\09e39322b47f9b4e8dd2199ff03acb2e\PresentationFramework.ni.dll
    MOD - [2011-10-14 02:40:26 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d76221993c2fdfb991b8c12ae50a30eb\System.Windows.Forms.ni.dll
    MOD - [2011-10-14 02:40:19 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e245eb9c1067cabd5673fe832d28613\System.Drawing.ni.dll
    MOD - [2011-10-14 02:40:16 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\d2dc021a8311197516e4fa325b292f21\PresentationCore.ni.dll
    MOD - [2011-10-14 02:40:07 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\3136e12cfb8809d39813e76c766c782c\WindowsBase.ni.dll
    MOD - [2011-10-14 02:40:02 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\275680f2b9db0501d53c50ea7d7a43f0\System.Xml.ni.dll
    MOD - [2011-10-14 02:39:59 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e9ebeb7959f1c916ebf6fca8f7077d6c\System.Configuration.ni.dll
    MOD - [2011-10-14 02:39:57 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\95b9866ab6e4437ef5dc5855ebab4e33\System.ni.dll
    MOD - [2011-10-14 02:39:48 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
    MOD - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
    MOD - [2011-03-21 17:30:20 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2011-01-13 20:42:02 | 000,025,920 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftBRCCPiped.dll
    MOD - [2011-01-13 20:39:32 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    MOD - [2011-01-13 20:37:50 | 000,079,168 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll
    MOD - [2011-01-13 20:37:26 | 000,075,072 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll
    MOD - [2011-01-13 20:37:24 | 000,111,936 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll
    MOD - [2011-01-13 20:37:20 | 000,121,152 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll
    MOD - [2011-01-13 20:37:18 | 000,128,320 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
    MOD - [2011-01-13 20:37:14 | 000,234,816 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll
    MOD - [2011-01-13 20:37:04 | 000,025,920 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STBRCCServCLR.dll
    MOD - [2011-01-13 20:36:50 | 001,123,648 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dll
    MOD - [2010-11-02 00:02:18 | 001,427,952 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
    MOD - [2010-11-02 00:02:12 | 000,522,736 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    MOD - [2010-11-02 00:02:06 | 000,657,904 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\BBEngineAS.dll
    MOD - [2010-08-30 10:34:12 | 000,375,280 | ---- | M] () -- c:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\SQLite352.dll


    ========== Win32 Services (SafeList) ==========

    SRV:64bit: - [2011-09-06 21:45:28 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV:64bit: - [2010-09-23 01:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
    SRV:64bit: - [2010-06-18 06:10:14 | 000,258,048 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
    SRV:64bit: - [2010-06-02 07:30:28 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
    SRV:64bit: - [2010-02-03 05:13:10 | 000,048,128 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
    SRV:64bit: - [2009-12-29 21:19:12 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
    SRV:64bit: - [2009-06-09 15:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
    SRV:64bit: - [2009-03-03 11:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
    SRV - [2011-11-03 12:06:56 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
    SRV - [2011-08-31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011-06-06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2011-01-13 20:37:02 | 000,705,856 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE -- (SftService)
    SRV - [2010-12-08 14:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
    SRV - [2010-09-04 08:15:22 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
    SRV - [2010-09-04 08:14:26 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
    SRV - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
    SRV - [2010-03-18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2010-03-03 21:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
    SRV - [2010-03-03 21:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
    SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
    SRV - [2009-06-06 01:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe -- (GameConsoleService)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2011-11-03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
    DRV:64bit: - [2011-09-06 21:38:18 | 000,601,944 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
    DRV:64bit: - [2011-09-06 21:38:16 | 000,301,912 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
    DRV:64bit: - [2011-09-06 21:36:41 | 000,058,200 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
    DRV:64bit: - [2011-09-06 21:36:41 | 000,042,328 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr.sys -- (aswRdr)
    DRV:64bit: - [2011-09-06 21:36:30 | 000,065,368 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
    DRV:64bit: - [2011-09-06 21:36:14 | 000,024,408 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV:64bit: - [2011-05-10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
    DRV:64bit: - [2011-03-11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2011-03-11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2010-09-23 01:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
    DRV:64bit: - [2010-07-30 14:18:04 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
    DRV:64bit: - [2010-07-30 14:18:02 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
    DRV:64bit: - [2010-07-30 14:18:00 | 000,026,624 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
    DRV:64bit: - [2010-07-30 14:17:56 | 000,019,456 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
    DRV:64bit: - [2010-07-21 17:59:28 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
    DRV:64bit: - [2010-06-23 10:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
    DRV:64bit: - [2010-06-18 06:10:14 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
    DRV:64bit: - [2010-06-08 17:33:14 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
    DRV:64bit: - [2010-06-02 07:50:28 | 006,857,728 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
    DRV:64bit: - [2010-06-02 06:42:48 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
    DRV:64bit: - [2010-05-06 14:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,053,800 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
    DRV:64bit: - [2010-03-19 10:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
    DRV:64bit: - [2010-03-17 22:44:44 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
    DRV:64bit: - [2010-03-17 22:29:52 | 000,232,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
    DRV:64bit: - [2010-02-03 05:13:08 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)
    DRV:64bit: - [2010-02-03 05:13:08 | 000,020,984 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcmvwl64.sys -- (BcmVWL)
    DRV:64bit: - [2010-02-03 05:13:06 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
    DRV:64bit: - [2009-09-17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
    DRV:64bit: - [2009-09-08 19:13:16 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)
    DRV:64bit: - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009-07-14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009-07-14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
    DRV:64bit: - [2009-07-14 01:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
    DRV:64bit: - [2009-06-15 20:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
    DRV:64bit: - [2009-06-10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
    DRV:64bit: - [2009-06-10 21:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
    DRV:64bit: - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
    DRV:64bit: - [2009-05-18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
    DRV:64bit: - [2008-08-28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
    DRV:64bit: - [2007-07-11 15:57:08 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
    DRV:64bit: - [2007-07-11 11:07:36 | 000,029,696 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
    DRV:64bit: - [2007-07-11 11:04:40 | 000,016,896 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
    DRV:64bit: - [2006-11-01 19:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
    DRV - [2011-11-17 22:51:46 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
    DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
    DRV - [2002-07-17 08:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ASPI32.SYS -- (Aspi32)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
    FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
    FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
    FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736
    FF - prefs.js..extensions.enabledItems: wrc@avast.com:6.0.1289
    FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
    FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
    FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
    FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
    FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll ( )
    FF - HKLM\Software\MozillaPlugins\@ganymede/SNOOKER,version=1.0: C:\Program Files (x86)\Ganymede\Plugins\SNOOKER\NPSNOOKER.dll (Ganymede Technologies)
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\ [2011-05-22 16:13:51 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-10-16 20:29:05 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-11-13 01:48:40 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011-11-13 01:48:39 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011-08-03 19:01:38 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]

    [2011-01-25 00:36:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daddy\AppData\Roaming\Mozilla\Extensions
    [2011-08-30 14:55:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\extensions
    [2011-11-22 04:39:52 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
    [2011-11-13 01:48:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
    [2011-10-16 20:29:05 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
    [2011-11-05 07:53:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
    [2009-09-13 00:05:42 | 000,124,240 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
    [2009-09-13 00:06:22 | 000,070,488 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
    [2009-09-13 00:06:32 | 000,091,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
    [2009-09-13 00:06:28 | 000,022,360 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
    [2011-03-13 01:14:04 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
    [2010-11-24 12:12:30 | 000,120,296 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npganymedenet.dll
    [2009-09-13 00:08:36 | 000,406,864 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
    [2011-04-21 10:47:56 | 000,636,408 | ---- | M] (Ganymede Technologies) -- C:\Program Files (x86)\mozilla firefox\plugins\NPSNOOKER.dll
    [2009-09-13 00:06:24 | 000,023,896 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll
    [2011-11-05 04:21:03 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
    [2011-11-05 04:21:03 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)
    CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:eek:riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
    CHR - Extension: avast! WebRep = C:\Users\Daddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\6.0.1289_0\

    O1 HOSTS File: ([2011-11-21 23:23:50 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
    O2 - BHO: (ALOT Appbar Helper) - {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - C:\Program Files (x86)\alotappbar\bin\BHO\ALOTHelperBHO.dll (Vertro)
    O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
    O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
    O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
    O3 - HKLM\..\Toolbar: (ALOT Appbar) - {A531D99C-5A22-449b-83DA-872725C6D0ED} - C:\Program Files (x86)\alotappbar\bin\alothelper.dll (Vertro)
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE (Dell Inc.)
    O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
    O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
    O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
    O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
    O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
    O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
    O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\oem\Roxio Burn\RoxioBurnLauncher.exe ()
    O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
    O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (CANON INC.)
    O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
    O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
    O4 - HKLM..\Run: [YoutubeDownloader] C:\Program Files (x86)\OneStopSoft.com\Youtube Downloader\Youtube Downloader.exe (SoundInDepth.com)
    O4 - HKCU..\Run: [Foco] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe (AudioEngines Inc.)
    O4 - HKCU..\Run: [NTServiceManager] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe ()
    O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe (Dell)
    O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
    O4 - Startup: C:\Users\Daddy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
    O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79961CF1-3CDA-45FB-901A-89BFE1CA5050}: DhcpNameServer = 194.168.4.100 194.168.8.100
    O18:64bit: - Protocol\Handler\livecall - No CLSID value found
    O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
    O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
    O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
    O18:64bit: - Protocol\Handler\msnim - No CLSID value found
    O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
    O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
    O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2000-08-15 17:00:34 | 000,000,041 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O34 - HKLM BootExecute: (lsdelete)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  5. frh

    frh Newcomer, in training Topic Starter Posts: 41

    4th OTL Log Pt 2

    ========== Files/Folders - Created Within 30 Days ==========

    [2011-11-22 04:41:00 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E2E09817-E277-4AA0-A55D-5657F5BF82CD}
    [2011-11-22 04:40:36 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{DC0AD153-B620-4643-979A-FE6A8D9D02B1}
    [2011-11-22 04:10:57 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{957FA4B2-6880-4BCF-B4C5-A2972BEC13D8}
    [2011-11-22 04:10:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D4120A0C-ED31-4970-AEB0-D68A66129E44}
    [2011-11-22 03:49:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{0799F999-605E-4E7C-95B0-83C26E5CE6C9}
    [2011-11-22 03:49:31 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{228F0A0D-C961-45C2-BE2E-20393F840167}
    [2011-11-22 03:09:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C0EA4F15-218D-4DE2-A03A-1C9A63A5F359}
    [2011-11-22 03:09:04 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{CCDD6E87-DF2F-4E33-908D-871A959F904F}
    [2011-11-22 01:52:34 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{4A04BC3A-025E-450E-8493-E29460CDB901}
    [2011-11-22 01:52:10 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7084EB2B-95BE-43B8-97C1-43DCC21AEC59}
    [2011-11-22 01:46:55 | 000,000,000 | ---D | C] -- C:\_OTL
    [2011-11-22 01:29:56 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{25F3A49C-2AF9-4B5A-AB28-1EDF1C8C8C28}
    [2011-11-22 01:29:43 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7EE5991D-6395-4D24-910D-0DBB27E96063}
    [2011-11-22 01:28:58 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011-11-22 00:03:14 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
    [2011-11-21 23:45:37 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011-11-21 22:34:03 | 000,000,000 | ---D | C] -- C:\ComboFix
    [2011-11-21 22:18:41 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{5E7B5DCA-C3B3-4A99-9D3D-680C7A78E055}
    [2011-11-21 22:18:17 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{1C3D6565-DAD5-43F7-8C4F-E40F215061BB}
    [2011-11-21 00:03:07 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011-11-21 00:03:07 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011-11-21 00:03:07 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011-11-20 23:56:39 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011-11-20 00:52:22 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011-11-20 00:45:56 | 004,303,424 | R--- | C] (Swearware) -- C:\Users\Daddy\Desktop\ComboFix.exe
    [2011-11-20 00:39:14 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Daddy\Desktop\aswMBR.exe
    [2011-11-19 20:47:09 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Daddy\Desktop\dds.scr
    [2011-11-19 20:17:20 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{63345C7D-CA91-4DDE-9B6C-13DEAB8BDCC6}
    [2011-11-19 20:17:06 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{02F99136-B844-4E35-9B64-951485D46D9C}
    [2011-11-19 19:24:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D8435C12-1580-4EE8-B6B2-4D304241ECAE}
    [2011-11-19 19:24:04 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{BDFDC5D8-FF77-4040-A255-5F5E98FDE185}
    [2011-11-19 07:07:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    [2011-11-19 02:08:07 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2F578588-C781-431C-ADD9-0516BF9CAD46}
    [2011-11-19 02:07:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D96D471F-F887-4943-BA8D-1BE6744B3711}
    [2011-11-18 00:04:17 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D4DEB02B-6B22-4554-BE3D-380F4A674286}
    [2011-11-18 00:03:53 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{220F4A37-1030-4E58-ACC9-EA1736633762}
    [2011-11-17 22:51:46 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
    [2011-11-17 22:48:42 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
    [2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
    [2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
    [2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
    [2011-11-17 22:06:46 | 000,000,000 | ---D | C] -- C:\Windows\Sun
    [2011-11-17 22:02:22 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{81547243-F6A2-4239-9C23-E069E5E74095}
    [2011-11-17 22:02:09 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{3FE19719-756B-404B-89D9-4B1082BC60D9}
    [2011-11-17 02:12:11 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C83F3967-5A6B-4CC4-A910-458C64F5BBCC}
    [2011-11-17 02:11:54 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{49FE06D3-4FB6-4D17-97A3-09501CE0289A}
    [2011-11-17 00:50:10 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A0C1B9FE-5C97-4CAD-B6B6-869C5B07B666}
    [2011-11-17 00:50:01 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B7AF6830-B83F-4D30-A3AB-D0A07ED89A4B}
    [2011-11-15 17:25:44 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{181EA340-CA15-4186-8654-D6E91FC54FA1}
    [2011-11-15 17:25:33 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{31B81133-FD5A-4F7E-BCFC-0D0698FA715C}
    [2011-11-15 17:14:35 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{6AD1A3C3-EA33-4060-9BA2-8E405CB7076D}
    [2011-11-15 17:14:28 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{867956E2-F466-4ECF-8F75-97504C719CB7}
    [2011-11-15 00:42:57 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{BC66E416-D557-428A-8DDF-AC62A68E7AD0}
    [2011-11-15 00:42:56 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A939B63C-FF12-4D6B-9B06-77650BCC780E}
    [2011-11-14 19:23:49 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C49AA169-4690-4196-9A34-E0B1EA4657DB}
    [2011-11-14 19:23:15 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C55EDE01-C58B-4BA6-BC8C-7F7D4CDDCC26}
    [2011-11-13 02:15:50 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B260EFF4-0419-4833-9576-6648A05D0FF7}
    [2011-11-13 02:15:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{90B51F54-335F-418D-A9BA-AC2010F8A5EC}
    [2011-11-13 01:05:32 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B4388EDC-CFA5-41B3-A1C2-40F2BA73CAD1}
    [2011-11-13 01:05:08 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{5F0B7321-5FFE-464E-B4A5-10382CFA2D46}
    [2011-11-12 19:49:06 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
    [2011-11-12 19:47:52 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7670782F-5632-4DEA-B553-4479C38DE2A4}
    [2011-11-12 19:47:41 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{68703C67-9D01-4F8C-9F4A-75E0C5AEFC5B}
    [2011-11-12 00:05:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEGV
    [2011-11-11 23:52:43 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{91F1BC4B-9AAD-4E23-8B5B-35636FFC9A26}
    [2011-11-11 23:52:32 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A3063E73-CECB-437F-A8B0-6F054BA57505}
    [2011-11-11 01:38:02 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E788BC36-449E-4918-B6B0-50F123A4305E}
    [2011-11-10 15:06:20 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{6154443F-D3EF-4819-9FBD-06F2B7894590}
    [2011-11-10 15:06:07 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{66A37168-9B2D-48E8-90EE-A349C7ACF0A2}
    [2011-11-10 14:51:25 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{390B54B8-0CA0-42FF-9FD0-C7CA3BBA4578}
    [2011-11-06 23:12:53 | 000,000,000 | ---D | C] -- C:\Users\Daddy\Documents\Photos
    [2011-11-06 23:12:23 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E629B392-F9B7-4889-A277-E43D4BEE4961}
    [2011-11-04 20:41:29 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{60AB8944-1C45-4416-803D-455132F4B967}
    [2011-11-04 20:41:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2A95A727-8526-4BC1-A6E5-56EC93220E9F}
    [2011-10-30 17:28:14 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C36D71FA-30C7-4638-A0E8-DA1ADED7652B}
    [2011-10-30 17:28:02 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2B98BDD9-6857-4BC8-B3D0-8C828082DFDA}
    [2011-10-26 18:24:48 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{AFE03083-33EA-4C4C-AC7E-BDE359EE15DA}
    [2011-10-26 18:24:37 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{8083DF18-8708-456F-AC79-6D88497607C2}

    ========== Files - Modified Within 30 Days ==========

    [2011-11-22 04:47:11 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2011-11-22 04:47:11 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2011-11-22 04:43:03 | 000,730,448 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2011-11-22 04:43:03 | 000,627,316 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2011-11-22 04:43:03 | 000,107,600 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2011-11-22 04:38:59 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
    [2011-11-22 04:38:42 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011-11-22 04:36:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011-11-22 04:36:44 | 3113,234,432 | -HS- | M] () -- C:\hiberfil.sys
    [2011-11-22 03:49:13 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011-11-22 00:03:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
    [2011-11-21 23:23:50 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
    [2011-11-21 22:29:30 | 004,303,424 | R--- | M] (Swearware) -- C:\Users\Daddy\Desktop\ComboFix.exe
    [2011-11-20 23:30:29 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
    [2011-11-20 23:30:29 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
    [2011-11-20 00:44:46 | 000,000,512 | ---- | M] () -- C:\Users\Daddy\Desktop\MBR.dat
    [2011-11-20 00:39:15 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Daddy\Desktop\aswMBR.exe
    [2011-11-19 20:47:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Daddy\Desktop\dds.scr
    [2011-11-19 20:34:14 | 000,302,592 | ---- | M] () -- C:\Users\Daddy\Desktop\7wxwoicb.exe
    [2011-11-19 07:07:09 | 000,002,259 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
    [2011-11-17 22:51:46 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
    [2011-11-17 22:51:45 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
    [2011-11-17 22:48:45 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
    [2011-11-17 22:01:58 | 000,000,344 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
    [2011-11-13 01:49:12 | 000,002,054 | ---- | M] () -- C:\Users\Daddy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011-11-11 18:30:06 | 000,466,184 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
    [2011-11-03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys

    ========== Files Created - No Company Name ==========

    [2011-11-21 22:16:29 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
    [2011-11-21 00:03:07 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2011-11-21 00:03:07 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2011-11-21 00:03:07 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011-11-21 00:03:07 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011-11-21 00:03:07 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011-11-20 23:30:29 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
    [2011-11-20 23:30:29 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
    [2011-11-20 00:44:46 | 000,000,512 | ---- | C] () -- C:\Users\Daddy\Desktop\MBR.dat
    [2011-11-19 20:34:13 | 000,302,592 | ---- | C] () -- C:\Users\Daddy\Desktop\7wxwoicb.exe
    [2011-11-19 07:07:09 | 000,002,259 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
    [2011-11-19 01:17:07 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
    [2011-11-17 22:48:45 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
    [2011-11-17 22:01:58 | 000,000,344 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
    [2011-11-13 01:48:43 | 000,001,197 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    [2011-08-22 11:17:42 | 000,056,320 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
    [2011-08-22 11:15:17 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll
    [2011-05-26 21:14:52 | 000,743,534 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
    [2011-05-22 16:42:38 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
    [2011-05-22 16:42:38 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
    [2011-01-27 09:48:25 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
    [2011-01-25 20:45:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
    [2011-01-25 00:32:35 | 000,007,605 | ---- | C] () -- C:\Users\Daddy\AppData\Local\resmon.resmoncfg
    [2011-01-17 07:59:38 | 000,002,137 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
    [2011-01-17 07:56:57 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
    [2011-01-17 07:56:57 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini
    [2011-01-17 07:56:57 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini
    [2011-01-17 07:56:57 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini
    [2011-01-17 07:56:57 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
    [2011-01-17 07:56:57 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini
    [2011-01-17 07:08:50 | 000,000,074 | RHS- | C] () -- C:\Windows\CT4CET.bin
    [2011-01-17 06:44:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
    [2010-12-10 01:33:11 | 000,000,325 | ---- | C] () -- C:\Windows\Prelaunch.ini
    [2009-07-14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2009-07-14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
    [2009-07-14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
    [2009-07-14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2009-07-14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
    [2009-07-13 22:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
    [2009-07-13 22:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
    [2009-07-13 22:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
    [2009-07-13 22:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
    [2009-07-13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
    [2009-06-10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

    ========== LOP Check ==========

    [2011-04-22 01:45:00 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\DVDVideoSoft
    [2011-04-22 01:44:15 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\DVDVideoSoftIEHelpers
    [2011-11-18 02:17:32 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\GanymedeNet
    [2011-09-22 23:00:30 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\ICAClient
    [2011-05-22 17:33:21 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\PC Suite
    [2011-06-04 19:27:57 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\PCDr
    [2011-11-14 02:24:11 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Spotify
    [2011-08-03 19:01:44 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Thunderbird
    [2011-07-29 11:18:14 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Windows Live Writer
    [2011-11-22 04:38:59 | 000,000,408 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
    [2011-09-03 19:56:55 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    < End of report >
  6. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Something went wrong with OTL fix.
    Let's try again....

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
      IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
      FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
      FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
      FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
      FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
      FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
      FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
      FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
      FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
      FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]
      [2011-11-22 04:39:52 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\se archplugins\GoogleFeed.xml
      
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.
  7. frh

    frh Newcomer, in training Topic Starter Posts: 41

    OTL Run Fix log

    Smartwebsearch still evident. OTL Run Fix log below. Will now run Scan.


    All processes killed
    ========== OTL ==========
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
    Prefs.js: "google-feed.net" removed from browser.search.defaultenginename
    Prefs.js: "GoogleFeed.net" removed from browser.search.selectedEngine
    Prefs.js: "http://www.smartwebsearch.net/index.php?from=3" removed from browser.startup.homepage
    Prefs.js: "http://smartwebsearch.net/results.php?q=" removed from keyword.URL
    Prefs.js: "google-feed.net" removed from browser.search.defaultenginename
    Prefs.js: "http://smartwebsearch.net/results.php?q=" removed from keyword.URL
    Prefs.js: "GoogleFeed.net" removed from browser.search.selectedEngine
    Prefs.js: "http://www.smartwebsearch.net/index.php?from=3" removed from browser.startup.homepage
    File HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF not found.
    File C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\se archplugins\GoogleFeed.xml not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Callum
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Daddy
    ->Temp folder emptied: 264806 bytes
    ->Temporary Internet Files folder emptied: 42891637 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 16797516 bytes
    ->Google Chrome cache emptied: 6827958 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 1955 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Mummy
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 68339 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 64.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Callum
    ->Flash cache emptied: 0 bytes

    User: Daddy
    ->Flash cache emptied: 456 bytes

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Mummy
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 11222011_051105

    Files\Folders moved on Reboot...
    C:\Users\Daddy\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF0A51632D2C4B3F98.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF4F0AFE7A776C8141.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF66CDD86486D30D21.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF66D9ADD6E60E3DE8.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DFF012C3AA1EA57B4A.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DFF97E59EAC9037C05.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\ac5[2].htm not found!
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\afr[6].htm moved successfully.
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\if[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\like[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\sandbox[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\sandbox[2].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\v[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\333930[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\kim-kardashian-fragrance-launch-foxy-402036[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\like[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\statstracker[4].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\afr[5].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\like[1].htm not found!
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\redirect_v94_cim_11_16_0[2].html moved successfully.
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\afr[5].htm moved successfully.
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\ivanka-trump-all-set-open-soho-flagship-store-564452[1].htm not found!
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\kim-kardashian-5088[1].htm moved successfully.
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\pixel[2].htm moved successfully.
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\statstracker[4].htm moved successfully.
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
  8. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    I need new OTL scan log.
    Instead of pasting the log, attach it because it looks to me like a known forum bug is playing games with us.
  9. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Latest OTL Scan Log

    I spy irony :haha:

    Latest OTL scan log attached.

    If you don't mind, I would like to carry on Tuesday evening. It's 4.30am here and I am flagging; have to be up for work in two hours :(

    Thanks for your patience and persistence :)

    Attached Files:

  10. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    No problem. Go to bed....LOL

    I'll post new instructions in a moment.
  11. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      PRC - [2011-04-18 11:01:12 | 001,827,328 | ---- | M] (AudioEngines Inc.) -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe
      PRC - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
      IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
      FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
      FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
      FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
      FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
      [2011-11-22 05:18:14 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
      FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]
      O4 - HKLM..\Run: [YoutubeDownloader] C:\Program Files (x86)\OneStopSoft.com\Youtube Downloader\Youtube Downloader.exe (SoundInDepth.com)
      O4 - HKCU..\Run: [Foco] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe (AudioEngines Inc.)
      O4 - HKCU..\Run: [NTServiceManager] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe ()
      MOD - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
      
      
      :Services
      
      :Reg
      
      :Files
      C:\Program Files (x86)\YoutubeDownloader.org
      C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
      
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.
  12. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Latest OTR fix and scan

    Good evening Broni. Hope you're ok.

    When I started up this evening, I ran Firefox which went immediately to the page http://apype.com/?f=3#. I hadn't seen evidence of apype for a while, but clearly it was still there.

    I then ran OTR with the fix in your last post. The PC rebooted and the log is attached (I have assumed you again want the file attached rather than the contents pasted?).

    I then ran the Quick Scan - again, the log file is attached. I then opened Firefox, which went to the Firefox home page. I went to the Google page and searched "BBC". From the results page I clicked on a link to one of the BBC pages and the browser was hijacked.

    Thanks, as ever.

    Attached Files:

  13. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    OTL log looks much better, but we still have some work to do.

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    64-bit users go HERE
    • Double-click SystemLook.exe to run it.
    • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box and paste it into the main textfield:
      Code:
      :reg
      HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions /s
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
  14. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Systemlook

    This ran in milliseconds. I hope I did it ok!


    SystemLook 30.07.11 by jpshortstuff
    Log created at 23:44 on 22/11/2011 by Daddy
    Administrator - Elevation successful

    ========== reg ==========

    [HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions]
    "SearchToolbar@skywebsearch.com"="C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF"


    -= EOF =-
  15. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      
      :Services
      
      :Reg
      [HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions]
      "SearchToolbar@skywebsearch.com"=-
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.
  16. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Further OTR fix and scan

    Still evidence of hijacking. Logs attached.

    Attached Files:

  17. frh

    frh Newcomer, in training Topic Starter Posts: 41

    zzzzzzzzzzzzzz

    Hi Broni,

    I think I will go to bed - pushed it too far last night. Looking forward to your next instructions.

    Thanks, & have a good evening & day tomorrow.
  18. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Give me more details.
    Is IE OK?
  19. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Hijackers still aboard

    Hi Broni,

    IE opens to MSN page. Search for BBC gives results in MSN engine. Click on link and three urls cycle through address box. Third url is http://paymente.net/in.cgi?11&onli=osou&ur=1&HTTP_REFERER=22200.c.evoplus.com&parameter=bbc&CS=1, which has now spent 3 minutes trying to complete load.

    Firefox has about:home load. Click on home button reloads about:home. Search for BBC loads "Google Custom Search" with url http://www.google.com/cse?q=bbc&cx=...TF-8&sa=search#gsc.tab=0&gsc.q=bbc&gsc.page=1, with BBC results listed. Click on BBC home page link loads BBC home page. Click on home button again loads about:home. From here click on Google favourite loads UK Google as normal. Search from here for BBC loads BBC home page. Clicks on various BBC links load expected pages.Return to Google page followed by search followed by click on results link invokes hijack page urls cycling until rest at http://www.easya-z.com/search_uk/v_tukb/innerxy.php?q=Football&xy=itcg-20342.

    Safari and GoogleChrome similarly hijacked, though symptoms show as soon as links following initial search are clicked.
  20. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Download Bootkit Remover to your Desktop.

    • Unzip downloaded file to your Desktop.
    • Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
  21. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Bootkit run

    Hi Broni,

    As I am running Windows 7 I looked for remover.exe in the zip file but found only boot_cleaner.exe, so I ran that. Results below:


    Bootkit Remover
    (c) 2009 Esage Lab
    www.esagelab.com

    Program version: 1.2.0.1
    OS Version: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000003`afd00000

    Size Device Name MBR Status
    --------------------------------------------
    465 GB \\.\PhysicalDrive0 Controlled by rootkit!

    Boot code on some of your physical disks is hidden by a rootkit.
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]


    Done;
    Press any key to quit...
  22. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    My mistake, sorry about it. You did fine :)

    It looks like your MBR is infected.

    Please Boot to the System Recovery Options
    If you have Windows 7 installation disc, just insert a DVD to the drive, restart computer and it should load automatically (option two presented in the article).
    It's possible also that your computer has a pre-installed recovery partition instead - in such a case use a method one (by pressing F8 before Windows starts loading)...

    On the System Recovery Options menu you will get the following options:

    • Startup Repair
    • System Restore
    • Windows Complete PC Restore
    • Windows Memory Diagnostic Tool
    • Command Prompt

    Choose Command Prompt
    You should see X:\SOURCES>...

    Execute the following commands in bold.
    Press Enter after every one of them.

    bootrec /fixmbr (<--- there is a "space" after "bootrec")

    exit

    Restart computer.

    Post new Bootkit Remover log.
  23. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Cannot access recovery options

    I do not appear to have a recovery partition. I made a set of (2) recovery disks when I bought the laptop about a year ago.

    I set the boot order in BIOS to boot from DVD first. I got the "Windows loading files" message and the load bar takes appx 4 mins to fill. I then got a blue screen with error code c000021a, and began to feel nauseous.....

    I removed the DVD and restarted. The machine appeared to be loading windows, then powered off - several times. Finally Windows loaded successfully.

    The Startup Repair option gives the loading files message then appears to stall when the bar is full, and I have to CTRL-ALT-DEL to power the machine off.

    Where do we go from here? I can browse the recovery disks normally, if that is of any use at all.

    Thanks.
  24. frh

    frh Newcomer, in training Topic Starter Posts: 41

    Recovery DVD loaded



    Managed to get recovery dvd to load, but find no command prompt option. I get restore computer and preserve files option, and select other system backup and more options.

    If I go for the second option, I have choice of factory restore, backup files and folders, and restore computer options.
  25. Broni

    Broni Malware Annihilator Posts: 45,159   +242

    Recovery DVD won't do.
    You would have to have Windows 7 DVD (full version).
    Since you don't have it you have to use "option 1" from my link.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.