also @ TechSpot: Nvidia GeForce GTX 780 Review

Laptop taken over by apype and smartwebsearch

Discussion in 'Virus and Malware Removal' started by frh, Nov 19, 2011.

Page 2 of 4

  1. Broni Malware Annihilator Posts: 39,401   +177

    Open IE. Go Tools>Internet options>Advanced tab, click on "Reset" button.
    Restart IE.
    Same issue?

    Then....

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]

:Commands
[purity]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.
    Broni, Nov 21, 2011
    #21

  2. frh Newcomer, in training Posts: 41

    Cannot reset IE

    I can't reset IE. I get the "Before you can reset Internet Explorer settings, you must first close all other open windows and programs" message, despite all windows being closed. I tried restarting Windows, but get the same problem.

    Thanks.
    frh, Nov 21, 2011
    #22

  3. frh Newcomer, in training Posts: 41

    frh, Nov 21, 2011
    #23

  4. Broni Malware Annihilator Posts: 39,401   +177

    Close all programs including IE.
    Go Start>Control Panel>Internet options>Advanced tab and click on "Reset" button.
    Broni, Nov 21, 2011
    #24

  5. frh Newcomer, in training Posts: 41

    Cannot reset IE via Control Panel

    I did try via Control Panel before, but got the same message. Have tried again and still can't reset.
    frh, Nov 21, 2011
    #25

  6. Broni Malware Annihilator Posts: 39,401   +177

    Try from Safe Mode.
    Broni, Nov 21, 2011
    #26
     

  7. frh Newcomer, in training Posts: 41

    IE Reset doesn't remove Smartwebsearch

    Couldn't get into safe mode by normal routes. Finally got there by switching off via long power key press. Reset IE in Safe Mode (all options selected) and Smartwebsearch is still there after normal reboot. Should I go ahead and run OTL with your latest code?
    frh, Nov 21, 2011
    #27

  8. Broni Malware Annihilator Posts: 39,401   +177

    Yes, go ahead and when done post fresh OTL log as well.
    Broni, Nov 21, 2011
    #28

  9. frh Newcomer, in training Posts: 41

    4th OTL Log Pt 1

    Didn't get a log after Run Fix. Still seeing Smartwebsearch in IE and Firefox. Chrome and Safari still hijacked. Log after Quick Scan:


    OTL logfile created on: 22-Nov-11 4:42:28 AM - Run 3
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Daddy\Desktop
    64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7600.16385)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy

    3.87 Gb Total Physical Memory | 2.21 Gb Available Physical Memory | 57.09% Memory free
    7.73 Gb Paging File | 5.82 Gb Available in Paging File | 75.28% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 451.01 Gb Total Space | 306.42 Gb Free Space | 67.94% Space Free | Partition Type: NTFS
    Drive D: | 457.02 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: HOLDER-PC | User Name: Daddy | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011-11-22 00:03:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
    PRC - [2011-11-03 12:06:56 | 002,152,152 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
    PRC - [2011-11-03 12:06:56 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
    PRC - [2011-09-06 21:45:28 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2011-06-06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2011-04-18 11:01:12 | 001,827,328 | ---- | M] (AudioEngines Inc.) -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe
    PRC - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
    PRC - [2011-01-13 20:54:26 | 000,464,856 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
    PRC - [2011-01-13 20:42:12 | 003,811,648 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    PRC - [2011-01-13 20:39:32 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    PRC - [2011-01-13 20:37:02 | 000,705,856 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
    PRC - [2010-11-02 00:02:18 | 001,427,952 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
    PRC - [2010-11-02 00:02:12 | 000,522,736 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    PRC - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    PRC - [2010-06-08 17:49:26 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    PRC - [2010-03-03 21:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    PRC - [2010-03-03 21:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    PRC - [2009-12-29 21:19:14 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
    PRC - [2009-09-13 00:09:10 | 000,103,768 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
    PRC - [2009-09-13 00:09:04 | 000,550,232 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
    PRC - [2009-06-24 23:21:38 | 000,409,744 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
    PRC - [2009-06-09 15:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
    PRC - [2007-05-21 00:37:36 | 000,124,512 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE


    ========== Modules (No Company Name) ==========

    MOD - [2011-10-14 02:48:07 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\6d859463c9e6a7423ddb335211a79dda\System.Core.ni.dll
    MOD - [2011-10-14 02:46:54 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\dde0e0cfec8f496421c5f5415d623480\IAStorUtil.ni.dll
    MOD - [2011-10-14 02:41:07 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5672e6b9d976feca51deb06d8dd1df0e\PresentationFramework.Aero.ni.dll
    MOD - [2011-10-14 02:40:51 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\018d2569cf208acbe8ad73908705f607\System.Runtime.Remoting.ni.dll
    MOD - [2011-10-14 02:40:40 | 014,322,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\09e39322b47f9b4e8dd2199ff03acb2e\PresentationFramework.ni.dll
    MOD - [2011-10-14 02:40:26 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d76221993c2fdfb991b8c12ae50a30eb\System.Windows.Forms.ni.dll
    MOD - [2011-10-14 02:40:19 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e245eb9c1067cabd5673fe832d28613\System.Drawing.ni.dll
    MOD - [2011-10-14 02:40:16 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\d2dc021a8311197516e4fa325b292f21\PresentationCore.ni.dll
    MOD - [2011-10-14 02:40:07 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\3136e12cfb8809d39813e76c766c782c\WindowsBase.ni.dll
    MOD - [2011-10-14 02:40:02 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\275680f2b9db0501d53c50ea7d7a43f0\System.Xml.ni.dll
    MOD - [2011-10-14 02:39:59 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e9ebeb7959f1c916ebf6fca8f7077d6c\System.Configuration.ni.dll
    MOD - [2011-10-14 02:39:57 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\95b9866ab6e4437ef5dc5855ebab4e33\System.ni.dll
    MOD - [2011-10-14 02:39:48 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
    MOD - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
    MOD - [2011-03-21 17:30:20 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2011-01-13 20:42:02 | 000,025,920 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftBRCCPiped.dll
    MOD - [2011-01-13 20:39:32 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    MOD - [2011-01-13 20:37:50 | 000,079,168 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll
    MOD - [2011-01-13 20:37:26 | 000,075,072 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll
    MOD - [2011-01-13 20:37:24 | 000,111,936 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll
    MOD - [2011-01-13 20:37:20 | 000,121,152 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll
    MOD - [2011-01-13 20:37:18 | 000,128,320 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
    MOD - [2011-01-13 20:37:14 | 000,234,816 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll
    MOD - [2011-01-13 20:37:04 | 000,025,920 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STBRCCServCLR.dll
    MOD - [2011-01-13 20:36:50 | 001,123,648 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dll
    MOD - [2010-11-02 00:02:18 | 001,427,952 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
    MOD - [2010-11-02 00:02:12 | 000,522,736 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    MOD - [2010-11-02 00:02:06 | 000,657,904 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\BBEngineAS.dll
    MOD - [2010-08-30 10:34:12 | 000,375,280 | ---- | M] () -- c:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\SQLite352.dll


    ========== Win32 Services (SafeList) ==========

    SRV:64bit: - [2011-09-06 21:45:28 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV:64bit: - [2010-09-23 01:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
    SRV:64bit: - [2010-06-18 06:10:14 | 000,258,048 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
    SRV:64bit: - [2010-06-02 07:30:28 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
    SRV:64bit: - [2010-02-03 05:13:10 | 000,048,128 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
    SRV:64bit: - [2009-12-29 21:19:12 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
    SRV:64bit: - [2009-06-09 15:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
    SRV:64bit: - [2009-03-03 11:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
    SRV - [2011-11-03 12:06:56 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
    SRV - [2011-08-31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011-06-06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2011-01-13 20:37:02 | 000,705,856 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE -- (SftService)
    SRV - [2010-12-08 14:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
    SRV - [2010-09-04 08:15:22 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
    SRV - [2010-09-04 08:14:26 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
    SRV - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
    SRV - [2010-03-18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2010-03-03 21:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
    SRV - [2010-03-03 21:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
    SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
    SRV - [2009-06-06 01:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe -- (GameConsoleService)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2011-11-03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
    DRV:64bit: - [2011-09-06 21:38:18 | 000,601,944 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
    DRV:64bit: - [2011-09-06 21:38:16 | 000,301,912 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
    DRV:64bit: - [2011-09-06 21:36:41 | 000,058,200 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
    DRV:64bit: - [2011-09-06 21:36:41 | 000,042,328 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr.sys -- (aswRdr)
    DRV:64bit: - [2011-09-06 21:36:30 | 000,065,368 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
    DRV:64bit: - [2011-09-06 21:36:14 | 000,024,408 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV:64bit: - [2011-05-10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
    DRV:64bit: - [2011-03-11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2011-03-11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2010-09-23 01:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
    DRV:64bit: - [2010-07-30 14:18:04 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
    DRV:64bit: - [2010-07-30 14:18:02 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
    DRV:64bit: - [2010-07-30 14:18:00 | 000,026,624 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
    DRV:64bit: - [2010-07-30 14:17:56 | 000,019,456 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
    DRV:64bit: - [2010-07-21 17:59:28 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
    DRV:64bit: - [2010-06-23 10:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
    DRV:64bit: - [2010-06-18 06:10:14 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
    DRV:64bit: - [2010-06-08 17:33:14 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
    DRV:64bit: - [2010-06-02 07:50:28 | 006,857,728 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
    DRV:64bit: - [2010-06-02 06:42:48 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
    DRV:64bit: - [2010-05-06 14:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,053,800 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
    DRV:64bit: - [2010-03-30 20:58:06 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
    DRV:64bit: - [2010-03-19 10:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
    DRV:64bit: - [2010-03-17 22:44:44 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
    DRV:64bit: - [2010-03-17 22:29:52 | 000,232,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
    DRV:64bit: - [2010-02-03 05:13:08 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)
    DRV:64bit: - [2010-02-03 05:13:08 | 000,020,984 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcmvwl64.sys -- (BcmVWL)
    DRV:64bit: - [2010-02-03 05:13:06 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
    DRV:64bit: - [2009-09-17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
    DRV:64bit: - [2009-09-08 19:13:16 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)
    DRV:64bit: - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009-07-14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009-07-14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
    DRV:64bit: - [2009-07-14 01:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
    DRV:64bit: - [2009-06-15 20:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
    DRV:64bit: - [2009-06-10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
    DRV:64bit: - [2009-06-10 21:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
    DRV:64bit: - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
    DRV:64bit: - [2009-05-18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
    DRV:64bit: - [2008-08-28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
    DRV:64bit: - [2007-07-11 15:57:08 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
    DRV:64bit: - [2007-07-11 11:07:36 | 000,029,696 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
    DRV:64bit: - [2007-07-11 11:04:40 | 000,016,896 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
    DRV:64bit: - [2006-11-01 19:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
    DRV - [2011-11-17 22:51:46 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
    DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
    DRV - [2002-07-17 08:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ASPI32.SYS -- (Aspi32)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
    FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
    FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
    FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736
    FF - prefs.js..extensions.enabledItems: wrc@avast.com:6.0.1289
    FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
    FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
    FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
    FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
    FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll ( )
    FF - HKLM\Software\MozillaPlugins\@ganymede/SNOOKER,version=1.0: C:\Program Files (x86)\Ganymede\Plugins\SNOOKER\NPSNOOKER.dll (Ganymede Technologies)
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\ [2011-05-22 16:13:51 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-10-16 20:29:05 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-11-13 01:48:40 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011-11-13 01:48:39 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011-08-03 19:01:38 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]

    [2011-01-25 00:36:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daddy\AppData\Roaming\Mozilla\Extensions
    [2011-08-30 14:55:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\extensions
    [2011-11-22 04:39:52 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
    [2011-11-13 01:48:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
    [2011-10-16 20:29:05 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
    [2011-11-05 07:53:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
    [2009-09-13 00:05:42 | 000,124,240 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
    [2009-09-13 00:06:22 | 000,070,488 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
    [2009-09-13 00:06:32 | 000,091,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
    [2009-09-13 00:06:28 | 000,022,360 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
    [2011-03-13 01:14:04 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
    [2010-11-24 12:12:30 | 000,120,296 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npganymedenet.dll
    [2009-09-13 00:08:36 | 000,406,864 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
    [2011-04-21 10:47:56 | 000,636,408 | ---- | M] (Ganymede Technologies) -- C:\Program Files (x86)\mozilla firefox\plugins\NPSNOOKER.dll
    [2009-09-13 00:06:24 | 000,023,896 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll
    [2011-11-05 04:21:03 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
    [2011-11-05 04:21:03 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)
    CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:eek:riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
    CHR - Extension: avast! WebRep = C:\Users\Daddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\6.0.1289_0\

    O1 HOSTS File: ([2011-11-21 23:23:50 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
    O2 - BHO: (ALOT Appbar Helper) - {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - C:\Program Files (x86)\alotappbar\bin\BHO\ALOTHelperBHO.dll (Vertro)
    O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
    O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
    O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
    O3 - HKLM\..\Toolbar: (ALOT Appbar) - {A531D99C-5A22-449b-83DA-872725C6D0ED} - C:\Program Files (x86)\alotappbar\bin\alothelper.dll (Vertro)
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE (Dell Inc.)
    O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
    O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
    O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
    O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
    O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
    O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
    O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\oem\Roxio Burn\RoxioBurnLauncher.exe ()
    O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
    O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (CANON INC.)
    O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
    O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
    O4 - HKLM..\Run: [YoutubeDownloader] C:\Program Files (x86)\OneStopSoft.com\Youtube Downloader\Youtube Downloader.exe (SoundInDepth.com)
    O4 - HKCU..\Run: [Foco] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe (AudioEngines Inc.)
    O4 - HKCU..\Run: [NTServiceManager] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe ()
    O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe (Dell)
    O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
    O4 - Startup: C:\Users\Daddy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
    O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79961CF1-3CDA-45FB-901A-89BFE1CA5050}: DhcpNameServer = 194.168.4.100 194.168.8.100
    O18:64bit: - Protocol\Handler\livecall - No CLSID value found
    O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
    O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
    O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
    O18:64bit: - Protocol\Handler\msnim - No CLSID value found
    O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
    O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
    O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2000-08-15 17:00:34 | 000,000,041 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O34 - HKLM BootExecute: (lsdelete)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    frh, Nov 21, 2011
    #29

  10. frh Newcomer, in training Posts: 41

    4th OTL Log Pt 2

    ========== Files/Folders - Created Within 30 Days ==========

    [2011-11-22 04:41:00 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E2E09817-E277-4AA0-A55D-5657F5BF82CD}
    [2011-11-22 04:40:36 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{DC0AD153-B620-4643-979A-FE6A8D9D02B1}
    [2011-11-22 04:10:57 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{957FA4B2-6880-4BCF-B4C5-A2972BEC13D8}
    [2011-11-22 04:10:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D4120A0C-ED31-4970-AEB0-D68A66129E44}
    [2011-11-22 03:49:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{0799F999-605E-4E7C-95B0-83C26E5CE6C9}
    [2011-11-22 03:49:31 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{228F0A0D-C961-45C2-BE2E-20393F840167}
    [2011-11-22 03:09:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C0EA4F15-218D-4DE2-A03A-1C9A63A5F359}
    [2011-11-22 03:09:04 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{CCDD6E87-DF2F-4E33-908D-871A959F904F}
    [2011-11-22 01:52:34 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{4A04BC3A-025E-450E-8493-E29460CDB901}
    [2011-11-22 01:52:10 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7084EB2B-95BE-43B8-97C1-43DCC21AEC59}
    [2011-11-22 01:46:55 | 000,000,000 | ---D | C] -- C:\_OTL
    [2011-11-22 01:29:56 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{25F3A49C-2AF9-4B5A-AB28-1EDF1C8C8C28}
    [2011-11-22 01:29:43 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7EE5991D-6395-4D24-910D-0DBB27E96063}
    [2011-11-22 01:28:58 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011-11-22 00:03:14 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
    [2011-11-21 23:45:37 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011-11-21 22:34:03 | 000,000,000 | ---D | C] -- C:\ComboFix
    [2011-11-21 22:18:41 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{5E7B5DCA-C3B3-4A99-9D3D-680C7A78E055}
    [2011-11-21 22:18:17 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{1C3D6565-DAD5-43F7-8C4F-E40F215061BB}
    [2011-11-21 00:03:07 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011-11-21 00:03:07 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011-11-21 00:03:07 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011-11-20 23:56:39 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011-11-20 00:52:22 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011-11-20 00:45:56 | 004,303,424 | R--- | C] (Swearware) -- C:\Users\Daddy\Desktop\ComboFix.exe
    [2011-11-20 00:39:14 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Daddy\Desktop\aswMBR.exe
    [2011-11-19 20:47:09 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Daddy\Desktop\dds.scr
    [2011-11-19 20:17:20 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{63345C7D-CA91-4DDE-9B6C-13DEAB8BDCC6}
    [2011-11-19 20:17:06 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{02F99136-B844-4E35-9B64-951485D46D9C}
    [2011-11-19 19:24:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D8435C12-1580-4EE8-B6B2-4D304241ECAE}
    [2011-11-19 19:24:04 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{BDFDC5D8-FF77-4040-A255-5F5E98FDE185}
    [2011-11-19 07:07:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    [2011-11-19 02:08:07 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2F578588-C781-431C-ADD9-0516BF9CAD46}
    [2011-11-19 02:07:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D96D471F-F887-4943-BA8D-1BE6744B3711}
    [2011-11-18 00:04:17 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D4DEB02B-6B22-4554-BE3D-380F4A674286}
    [2011-11-18 00:03:53 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{220F4A37-1030-4E58-ACC9-EA1736633762}
    [2011-11-17 22:51:46 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
    [2011-11-17 22:48:42 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
    [2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
    [2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
    [2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
    [2011-11-17 22:06:46 | 000,000,000 | ---D | C] -- C:\Windows\Sun
    [2011-11-17 22:02:22 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{81547243-F6A2-4239-9C23-E069E5E74095}
    [2011-11-17 22:02:09 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{3FE19719-756B-404B-89D9-4B1082BC60D9}
    [2011-11-17 02:12:11 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C83F3967-5A6B-4CC4-A910-458C64F5BBCC}
    [2011-11-17 02:11:54 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{49FE06D3-4FB6-4D17-97A3-09501CE0289A}
    [2011-11-17 00:50:10 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A0C1B9FE-5C97-4CAD-B6B6-869C5B07B666}
    [2011-11-17 00:50:01 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B7AF6830-B83F-4D30-A3AB-D0A07ED89A4B}
    [2011-11-15 17:25:44 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{181EA340-CA15-4186-8654-D6E91FC54FA1}
    [2011-11-15 17:25:33 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{31B81133-FD5A-4F7E-BCFC-0D0698FA715C}
    [2011-11-15 17:14:35 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{6AD1A3C3-EA33-4060-9BA2-8E405CB7076D}
    [2011-11-15 17:14:28 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{867956E2-F466-4ECF-8F75-97504C719CB7}
    [2011-11-15 00:42:57 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{BC66E416-D557-428A-8DDF-AC62A68E7AD0}
    [2011-11-15 00:42:56 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A939B63C-FF12-4D6B-9B06-77650BCC780E}
    [2011-11-14 19:23:49 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C49AA169-4690-4196-9A34-E0B1EA4657DB}
    [2011-11-14 19:23:15 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C55EDE01-C58B-4BA6-BC8C-7F7D4CDDCC26}
    [2011-11-13 02:15:50 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B260EFF4-0419-4833-9576-6648A05D0FF7}
    [2011-11-13 02:15:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{90B51F54-335F-418D-A9BA-AC2010F8A5EC}
    [2011-11-13 01:05:32 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B4388EDC-CFA5-41B3-A1C2-40F2BA73CAD1}
    [2011-11-13 01:05:08 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{5F0B7321-5FFE-464E-B4A5-10382CFA2D46}
    [2011-11-12 19:49:06 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
    [2011-11-12 19:47:52 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7670782F-5632-4DEA-B553-4479C38DE2A4}
    [2011-11-12 19:47:41 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{68703C67-9D01-4F8C-9F4A-75E0C5AEFC5B}
    [2011-11-12 00:05:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEGV
    [2011-11-11 23:52:43 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{91F1BC4B-9AAD-4E23-8B5B-35636FFC9A26}
    [2011-11-11 23:52:32 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A3063E73-CECB-437F-A8B0-6F054BA57505}
    [2011-11-11 01:38:02 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E788BC36-449E-4918-B6B0-50F123A4305E}
    [2011-11-10 15:06:20 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{6154443F-D3EF-4819-9FBD-06F2B7894590}
    [2011-11-10 15:06:07 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{66A37168-9B2D-48E8-90EE-A349C7ACF0A2}
    [2011-11-10 14:51:25 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{390B54B8-0CA0-42FF-9FD0-C7CA3BBA4578}
    [2011-11-06 23:12:53 | 000,000,000 | ---D | C] -- C:\Users\Daddy\Documents\Photos
    [2011-11-06 23:12:23 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E629B392-F9B7-4889-A277-E43D4BEE4961}
    [2011-11-04 20:41:29 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{60AB8944-1C45-4416-803D-455132F4B967}
    [2011-11-04 20:41:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2A95A727-8526-4BC1-A6E5-56EC93220E9F}
    [2011-10-30 17:28:14 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C36D71FA-30C7-4638-A0E8-DA1ADED7652B}
    [2011-10-30 17:28:02 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2B98BDD9-6857-4BC8-B3D0-8C828082DFDA}
    [2011-10-26 18:24:48 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{AFE03083-33EA-4C4C-AC7E-BDE359EE15DA}
    [2011-10-26 18:24:37 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{8083DF18-8708-456F-AC79-6D88497607C2}

    ========== Files - Modified Within 30 Days ==========

    [2011-11-22 04:47:11 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2011-11-22 04:47:11 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2011-11-22 04:43:03 | 000,730,448 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2011-11-22 04:43:03 | 000,627,316 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2011-11-22 04:43:03 | 000,107,600 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2011-11-22 04:38:59 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
    [2011-11-22 04:38:42 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011-11-22 04:36:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011-11-22 04:36:44 | 3113,234,432 | -HS- | M] () -- C:\hiberfil.sys
    [2011-11-22 03:49:13 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011-11-22 00:03:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
    [2011-11-21 23:23:50 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
    [2011-11-21 22:29:30 | 004,303,424 | R--- | M] (Swearware) -- C:\Users\Daddy\Desktop\ComboFix.exe
    [2011-11-20 23:30:29 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
    [2011-11-20 23:30:29 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
    [2011-11-20 00:44:46 | 000,000,512 | ---- | M] () -- C:\Users\Daddy\Desktop\MBR.dat
    [2011-11-20 00:39:15 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Daddy\Desktop\aswMBR.exe
    [2011-11-19 20:47:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Daddy\Desktop\dds.scr
    [2011-11-19 20:34:14 | 000,302,592 | ---- | M] () -- C:\Users\Daddy\Desktop\7wxwoicb.exe
    [2011-11-19 07:07:09 | 000,002,259 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
    [2011-11-17 22:51:46 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
    [2011-11-17 22:51:45 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
    [2011-11-17 22:48:45 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
    [2011-11-17 22:01:58 | 000,000,344 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
    [2011-11-13 01:49:12 | 000,002,054 | ---- | M] () -- C:\Users\Daddy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011-11-11 18:30:06 | 000,466,184 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
    [2011-11-03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys

    ========== Files Created - No Company Name ==========

    [2011-11-21 22:16:29 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
    [2011-11-21 00:03:07 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2011-11-21 00:03:07 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2011-11-21 00:03:07 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011-11-21 00:03:07 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011-11-21 00:03:07 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011-11-20 23:30:29 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
    [2011-11-20 23:30:29 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
    [2011-11-20 00:44:46 | 000,000,512 | ---- | C] () -- C:\Users\Daddy\Desktop\MBR.dat
    [2011-11-19 20:34:13 | 000,302,592 | ---- | C] () -- C:\Users\Daddy\Desktop\7wxwoicb.exe
    [2011-11-19 07:07:09 | 000,002,259 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
    [2011-11-19 01:17:07 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
    [2011-11-17 22:48:45 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
    [2011-11-17 22:01:58 | 000,000,344 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
    [2011-11-13 01:48:43 | 000,001,197 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    [2011-08-22 11:17:42 | 000,056,320 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
    [2011-08-22 11:15:17 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll
    [2011-05-26 21:14:52 | 000,743,534 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
    [2011-05-22 16:42:38 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
    [2011-05-22 16:42:38 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
    [2011-01-27 09:48:25 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
    [2011-01-25 20:45:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
    [2011-01-25 00:32:35 | 000,007,605 | ---- | C] () -- C:\Users\Daddy\AppData\Local\resmon.resmoncfg
    [2011-01-17 07:59:38 | 000,002,137 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
    [2011-01-17 07:56:57 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
    [2011-01-17 07:56:57 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini
    [2011-01-17 07:56:57 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini
    [2011-01-17 07:56:57 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini
    [2011-01-17 07:56:57 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
    [2011-01-17 07:56:57 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini
    [2011-01-17 07:08:50 | 000,000,074 | RHS- | C] () -- C:\Windows\CT4CET.bin
    [2011-01-17 06:44:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
    [2010-12-10 01:33:11 | 000,000,325 | ---- | C] () -- C:\Windows\Prelaunch.ini
    [2009-07-14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2009-07-14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
    [2009-07-14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
    [2009-07-14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2009-07-14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
    [2009-07-13 22:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
    [2009-07-13 22:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
    [2009-07-13 22:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
    [2009-07-13 22:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
    [2009-07-13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
    [2009-06-10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

    ========== LOP Check ==========

    [2011-04-22 01:45:00 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\DVDVideoSoft
    [2011-04-22 01:44:15 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\DVDVideoSoftIEHelpers
    [2011-11-18 02:17:32 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\GanymedeNet
    [2011-09-22 23:00:30 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\ICAClient
    [2011-05-22 17:33:21 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\PC Suite
    [2011-06-04 19:27:57 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\PCDr
    [2011-11-14 02:24:11 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Spotify
    [2011-08-03 19:01:44 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Thunderbird
    [2011-07-29 11:18:14 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Windows Live Writer
    [2011-11-22 04:38:59 | 000,000,408 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
    [2011-09-03 19:56:55 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    < End of report >
    frh, Nov 21, 2011
    #30

  11. Broni Malware Annihilator Posts: 39,401   +177

    Something went wrong with OTL fix.
    Let's try again....

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]
[2011-11-22 04:39:52 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\se archplugins\GoogleFeed.xml


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.
    Broni, Nov 21, 2011
    #31

  12. frh Newcomer, in training Posts: 41

    OTL Run Fix log

    Smartwebsearch still evident. OTL Run Fix log below. Will now run Scan.


    All processes killed
    ========== OTL ==========
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
    Prefs.js: "google-feed.net" removed from browser.search.defaultenginename
    Prefs.js: "GoogleFeed.net" removed from browser.search.selectedEngine
    Prefs.js: "http://www.smartwebsearch.net/index.php?from=3" removed from browser.startup.homepage
    Prefs.js: "http://smartwebsearch.net/results.php?q=" removed from keyword.URL
    Prefs.js: "google-feed.net" removed from browser.search.defaultenginename
    Prefs.js: "http://smartwebsearch.net/results.php?q=" removed from keyword.URL
    Prefs.js: "GoogleFeed.net" removed from browser.search.selectedEngine
    Prefs.js: "http://www.smartwebsearch.net/index.php?from=3" removed from browser.startup.homepage
    File HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF not found.
    File C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\se archplugins\GoogleFeed.xml not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Callum
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Daddy
    ->Temp folder emptied: 264806 bytes
    ->Temporary Internet Files folder emptied: 42891637 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 16797516 bytes
    ->Google Chrome cache emptied: 6827958 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 1955 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Mummy
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 68339 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 64.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Callum
    ->Flash cache emptied: 0 bytes

    User: Daddy
    ->Flash cache emptied: 456 bytes

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Mummy
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 11222011_051105

    Files\Folders moved on Reboot...
    C:\Users\Daddy\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF0A51632D2C4B3F98.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF4F0AFE7A776C8141.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF66CDD86486D30D21.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF66D9ADD6E60E3DE8.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DFF012C3AA1EA57B4A.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Temp\~DFF97E59EAC9037C05.TMP not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\ac5[2].htm not found!
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\afr[6].htm moved successfully.
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\if[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\like[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\sandbox[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\sandbox[2].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\v[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\333930[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\kim-kardashian-fragrance-launch-foxy-402036[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\like[1].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\statstracker[4].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\afr[5].htm not found!
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\like[1].htm not found!
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\redirect_v94_cim_11_16_0[2].html moved successfully.
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\afr[5].htm moved successfully.
    File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\ivanka-trump-all-set-open-soho-flagship-store-564452[1].htm not found!
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\kim-kardashian-5088[1].htm moved successfully.
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\pixel[2].htm moved successfully.
    C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\statstracker[4].htm moved successfully.
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
    frh, Nov 21, 2011
    #32

  13. Broni Malware Annihilator Posts: 39,401   +177

    I need new OTL scan log.
    Instead of pasting the log, attach it because it looks to me like a known forum bug is playing games with us.
    Broni, Nov 21, 2011
    #33

  14. frh Newcomer, in training Posts: 41

    Latest OTL Scan Log

    I spy irony :haha:

    Latest OTL scan log attached.

    If you don't mind, I would like to carry on Tuesday evening. It's 4.30am here and I am flagging; have to be up for work in two hours :(

    Thanks for your patience and persistence :)

    Attached Files:

    frh, Nov 21, 2011
    #34

  15. Broni Malware Annihilator Posts: 39,401   +177

    No problem. Go to bed....LOL

    I'll post new instructions in a moment.
    Broni, Nov 21, 2011
    #35

  16. Broni Malware Annihilator Posts: 39,401   +177

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
PRC - [2011-04-18 11:01:12 | 001,827,328 | ---- | M] (AudioEngines Inc.) -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe
PRC - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
[2011-11-22 05:18:14 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]
O4 - HKLM..\Run: [YoutubeDownloader] C:\Program Files (x86)\OneStopSoft.com\Youtube Downloader\Youtube Downloader.exe (SoundInDepth.com)
O4 - HKCU..\Run: [Foco] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe (AudioEngines Inc.)
O4 - HKCU..\Run: [NTServiceManager] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe ()
MOD - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe


:Services

:Reg

:Files
C:\Program Files (x86)\YoutubeDownloader.org
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.
    Broni, Nov 21, 2011
    #36

  17. frh Newcomer, in training Posts: 41

    Latest OTR fix and scan

    Good evening Broni. Hope you're ok.

    When I started up this evening, I ran Firefox which went immediately to the page http://apype.com/?f=3#. I hadn't seen evidence of apype for a while, but clearly it was still there.

    I then ran OTR with the fix in your last post. The PC rebooted and the log is attached (I have assumed you again want the file attached rather than the contents pasted?).

    I then ran the Quick Scan - again, the log file is attached. I then opened Firefox, which went to the Firefox home page. I went to the Google page and searched "BBC". From the results page I clicked on a link to one of the BBC pages and the browser was hijacked.

    Thanks, as ever.

    Attached Files:

    frh, Nov 22, 2011
    #37

  18. Broni Malware Annihilator Posts: 39,401   +177

    OTL log looks much better, but we still have some work to do.

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    64-bit users go HERE
    • Double-click SystemLook.exe to run it.
    • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box and paste it into the main textfield:
      Code:
      :reg
HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions /s
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
    Broni, Nov 22, 2011
    #38

  19. frh Newcomer, in training Posts: 41

    Systemlook

    This ran in milliseconds. I hope I did it ok!


    SystemLook 30.07.11 by jpshortstuff
    Log created at 23:44 on 22/11/2011 by Daddy
    Administrator - Elevation successful

    ========== reg ==========

    [HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions]
    "SearchToolbar@skywebsearch.com"="C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF"


    -= EOF =-
    frh, Nov 22, 2011
    #39

  20. Broni Malware Annihilator Posts: 39,401   +177

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL

:Services

:Reg
[HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions]
"SearchToolbar@skywebsearch.com"=-

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.
    Broni, Nov 22, 2011
    #40
Page 2 of 4
Topic Status:
Not open for further replies.

Add New Comment

Social Login & Guest Posting

TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.