Solved System Check mal + delayed write failed

[SolutionSeeker]

Hello,

My primary computer is suffering from the System Check Infection that seems to be doing the rounds - multiple write failed errors, bogus programme, hidden icons.

In preparation for removal I am getting the tools mentioned in the five essential steps downloaded to my laptop, however the link to DDS is broken (it seems to be broke elsewhere aswell). I have found a copy of dds.pif on a site called forospyware but am not sure if this is the programme you advise using (I don't want to get started on the wrong foot). Could anyone help clear this up before I start presenting logs?

Regards,

SolutionSeeker

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

===============================================================

I have found a copy of dds.pif on a site called forospyware

That would be fine.

 

[SolutionSeeker]

Good evening Broni,

Thank-you for taking the time to reply.

I have begun running the first stage virus detection (apparently i have both norton and Avira on the same system - I hope this will not be a problem) however as I have disconnected from the net as advised in the forum sticky I was not able to initiate an update of Aviras software (Last update 22/01/12). Is there a way to update avira by transferring files through removable media or will it be okay as is?

I'm afraid I'm sounding rather feeble here, but I'm not very computer literate. Hopefully this process will be a learning one for me.

 

[Broni]

apparently i have both norton and Avira on the same system - I hope this will not be a problem

You must uninstall one of them.
If Norton use this tool: https://www-secure.symantec.com/nor...&version=1&pvid=f-home&entsrc=redirect_pubweb

If operating from normal mode is a problem see if Safe Mode with Networking works better.
You'll have internet connection there.

 

[SolutionSeeker]

Norton: Thank you, I will do so.

Networking: I disconnected my computers connection to the internet as I was unsure if/how my computer is connected to others in the home network. Since it has a direct wired internet connection rather than through the wireless I think this is minimal, but I want to know if my family member's devices may be exposed if I initiate this Safe networking start? I suppose I must sound like a superstitious caveman here, but I really don't want to ruin their things with this horrible infection as well as my own.

In addition, I'm not sure I'd even be able to access the net myself as the malware has disappeared all my icons, depopulated the start menu and blanked my background so I cant even call up right-click menus or draw boxes.

 

[Broni]

Other computer will be fine.

Can you operate computer in normal mode?

 

[SolutionSeeker]

I've loaded into safe mode but am confronted by an empty start menu, no icons and just the system clock in the bottom right hand corner, so nothing effectively. The computer is usable in normal mode but minus all my start menu icons (save shutdown) and with no desktop icons - i only get the cluster of icons that appear in the bottom left of the task bar, which is how i could access avira/norton. What would you advise me to do?

I also have a program called spybot = search and destroy which I ran and found some security entrys and malware called Fraud.DefenseCenter. 'The fix button doesn't seem to have improved my comps overall health though). I could try reconnecting to the internet in normal mode to update avira if you feel this is advisable, but am unsure how I would access the net without icons to get the norton remover.

 

[Broni]

Let's see, if we can look at your computer booting from an external source.

Please download OTLPE (filesize 120,9 MB)

• When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
• Reboot your system using the boot CD you just created.
  • Note : If you do not know how to set your computer to boot from CD follow the steps HERE
• Your system should now display a REATOGO-X-PE desktop.
• Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
• Double-click on the OTLPE icon.
• When asked Do you wish to load the remote registry, select Yes
• When asked Do you wish to load remote user profile(s) for scanning, select Yes
• Ensure the box Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.

 

[SolutionSeeker]

OTL log

\thanks Broni,

The OTLE didn't load exactly as described but it ran and produced this result log:

OTL logfile created on: 2/4/2012 5:56:54 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 127.99 Gb Total Space | 47.11 Gb Free Space | 36.81% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled] -- -- (HidServ)
SRV - [2012/01/27 05:06:07 | 003,342,112 | -H-- | M] () [Auto] -- C:\program files\common files\akamai/netsession_win_e286960.dll -- (Akamai)
SRV - [2012/01/16 18:29:57 | 003,045,688 | -H-- | M] (Emsi Software GmbH) [Auto] -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)
SRV - [2011/07/03 03:36:35 | 000,269,480 | -H-- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/01 04:26:16 | 000,136,360 | -H-- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/09/29 22:06:46 | 000,169,408 | -H-- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2009/11/22 17:15:58 | 001,245,064 | ---- | M] () [On_Demand] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2008/10/17 10:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice)
SRV - [2008/10/17 10:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2008/10/17 10:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2008/10/17 10:52:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2008/09/05 06:52:32 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2008/02/09 12:06:00 | 000,238,968 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2007/08/21 20:21:00 | 000,055,640 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe -- (comHost)
SRV - [2006/11/03 13:19:58 | 000,013,592 | -H-- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand] -- -- (PciCon)
DRV - File not found [Kernel | On_Demand] -- -- (ldiskl)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2012/01/16 18:31:04 | 000,051,632 | -H-- | M] (Emsi Software GmbH) [File_System | On_Demand] -- C:\Program Files\Emsisoft Anti-Malware\a2accx86.sys -- (a2acc)
DRV - [2011/07/03 03:36:36 | 000,138,192 | -H-- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/03 03:36:36 | 000,066,616 | -H-- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/08/24 12:31:14 | 000,079,568 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2010/08/24 12:30:18 | 000,010,448 | -H-- | M] (Logitech, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2010/08/24 12:30:06 | 000,063,312 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2010/08/24 12:30:06 | 000,020,304 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2010/06/17 10:27:22 | 000,028,520 | -H-- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/17 10:27:12 | 000,011,608 | -H-- | M] (Avira GmbH) [Kernel | System] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2010/03/07 10:40:52 | 000,279,712 | -H-- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010/03/07 10:40:52 | 000,025,888 | -H-- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010/02/03 04:00:00 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100219.040\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/02/03 04:00:00 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100219.040\NAVENG.SYS -- (NAVENG)
DRV - [2009/11/22 17:29:58 | 000,124,464 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009/11/19 22:02:58 | 000,268,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\20100210.001\SymIDSCo.sys -- (SYMIDSCO)
DRV - [2009/11/16 05:11:36 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2009/11/16 05:11:36 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2009/03/17 07:56:58 | 000,447,024 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2009/02/19 08:31:42 | 000,031,280 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIMMP)
DRV - [2009/02/19 08:31:42 | 000,031,280 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIM)
DRV - [2009/02/19 08:31:16 | 000,184,496 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2009/02/19 08:31:16 | 000,096,560 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW)
DRV - [2009/02/19 08:31:16 | 000,038,576 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS)
DRV - [2009/02/19 08:31:16 | 000,037,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS)
DRV - [2009/02/19 08:31:16 | 000,022,320 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2009/02/19 08:31:16 | 000,013,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS)
DRV - [2008/11/25 03:37:50 | 004,952,576 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/09/23 20:15:00 | 000,038,400 | RH-- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e)
DRV - [2008/07/30 12:42:12 | 000,023,888 | -H-- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\COH_Mon.sys -- (COH_Mon)
DRV - [2008/06/30 22:02:24 | 000,079,448 | RH-- | M] (JMicron Technology Corp.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\jraid.sys -- (JRAID)
DRV - [2008/01/31 13:51:00 | 000,317,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2008/01/31 13:51:00 | 000,279,088 | ---- | M] (Symantec Corporation) [File_System | System] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2008/01/31 13:51:00 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2007/12/17 04:14:06 | 000,012,400 | RH-- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO)
DRV - [2007/08/08 12:39:00 | 000,036,056 | ---- | M] (Symantec Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\CO_Mon.sys -- (CO_Mon)
DRV - [2004/08/13 13:56:20 | 000,005,810 | RH-- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Andrew_Gregory_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\Andrew_Gregory_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\systemprofile_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.0
FF - prefs.js..extensions.enabledItems: DeviceDetection@logitech.com:1.23.0.5
FF - prefs.js..extensions.enabledItems: plugin@yontoo.com:1.20.00
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.599: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.599: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.599: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.599: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Andrew Gregory\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Andrew Gregory\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Andrew Gregory\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/29 16:14:50 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/24 20:32:10 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/24 20:32:10 | 000,000,000 | -H-D | M]

[2010/07/05 10:01:50 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Andrew Gregory\Application Data\Mozilla\Extensions
[2012/01/29 03:58:07 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Andrew Gregory\Application Data\Mozilla\Firefox\Profiles\jou8aea6.default\extensions
[2010/07/06 08:32:49 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Andrew Gregory\Application Data\Mozilla\Firefox\Profiles\jou8aea6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/09 09:24:27 | 000,000,000 | -H-D | M] (Разпознаване на устройство Logitech) -- C:\Documents and Settings\Andrew Gregory\Application Data\Mozilla\Firefox\Profiles\jou8aea6.default\extensions\DeviceDetection@logitech.com
[2011/12/05 08:54:05 | 000,000,000 | -H-D | M] (Yontoo Layers) -- C:\Documents and Settings\Andrew Gregory\Application Data\Mozilla\Firefox\Profiles\jou8aea6.default\extensions\plugin@yontoo.com
[2012/01/29 03:58:07 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/08/31 17:35:05 | 000,000,000 | -H-D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/29 16:14:50 | 000,000,000 | -H-D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2010/08/31 17:34:57 | 000,000,000 | -H-D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/08/31 17:34:57 | 000,411,368 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/07/22 11:01:52 | 000,001,538 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/07/22 11:01:52 | 000,000,947 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/07/22 11:01:52 | 000,000,769 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/07/22 11:01:52 | 000,001,135 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2001/08/23 07:00:00 | 000,000,734 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - File not found
O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\Andrew_Gregory_ON_C\..\Toolbar\WebBrowser: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe (JMicron Technology Corp.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [KodakShareButtonApp] C:\Program Files\Kodak\KODAK Share Button App\Listener.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton Internet Security\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [RUMrAHicILvex.exe] C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe (Microsoft Corp)
O4 - HKLM..\Run: [Six Engine] C:\Program Files\ASUS\Six Engine\SixEngine.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\Andrew_Gregory_ON_C..\Run: [Akamai NetSession Interface] C:\Documents and Settings\Andrew Gregory\Local Settings\Application Data\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\Andrew_Gregory_ON_C..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\.DEFAULT..\RunOnce: [] File not found
O4 - HKU\LocalService_ON_C..\RunOnce: [] File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [] File not found
O4 - HKU\systemprofile_ON_C..\RunOnce: [] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\Andrew_Gregory_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\Andrew_Gregory_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\Andrew_Gregory_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\systemprofile_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\systemprofile_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258926311984 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/11/22 13:52:16 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/03 18:32:54 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Andrew Gregory\Recent
[2012/02/03 18:02:50 | 000,000,000 | -H-D | C] -- C:\WINDOWS\CSC
[2012/02/01 17:24:49 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2012/01/30 18:17:40 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Andrew Gregory\Start Menu\Programs\System Check
[2012/01/30 18:17:22 | 000,362,496 | -H-- | C] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl.exe
[2012/01/30 18:14:48 | 000,449,536 | -H-- | C] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe
[2012/01/22 17:41:33 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Black Isle
[2012/01/22 16:56:05 | 000,000,000 | -H-D | C] -- C:\Program Files\Black Isle
[2004/11/24 14:25:52 | 000,335,872 | -H-- | C] ( ) -- C:\WINDOWS\System32\drvc.dll
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[14 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Andrew Gregory\My Documents\*.tmp files -> C:\Documents and Settings\Andrew Gregory\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/03 18:36:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/02/03 18:30:36 | 000,000,245 | RHS- | M] () -- C:\boot.ini
[2012/02/03 18:27:49 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012/02/03 18:09:00 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/02/03 18:07:44 | 000,000,296 | -H-- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-117609710-1960408961-839522115-1003.job
[2012/02/03 17:59:04 | 000,001,014 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1960408961-839522115-1003UA.job
[2012/01/30 18:25:07 | 000,000,853 | -H-- | M] () -- C:\Documents and Settings\Andrew Gregory\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2012/01/30 18:17:40 | 000,000,835 | -H-- | M] () -- C:\Documents and Settings\Andrew Gregory\Desktop\System Check.lnk
[2012/01/30 18:17:34 | 000,000,344 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl
[2012/01/30 18:17:22 | 000,362,496 | -H-- | M] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl.exe
[2012/01/30 18:17:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinZip
[2012/01/30 18:17:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
[2012/01/30 18:17:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN
[2012/01/30 18:17:10 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup
[2012/01/30 18:17:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Vampire - The Masquerade Bloodlines
[2012/01/30 18:17:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\The Witcher Enhanced Edition
[2012/01/30 18:17:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2012/01/30 18:17:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Real
[2012/01/30 18:17:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Pax Imperia
[2012/01/30 18:17:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\NVIDIA Corporation
[2012/01/30 18:17:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security
[2012/01/30 18:17:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox
[2012/01/30 18:17:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2012/01/30 18:17:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2012/01/30 18:17:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Mass Effect 2
[2012/01/30 18:17:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\JMicron Technology Corp
[2012/01/30 18:17:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Ground Control II
[2012/01/30 18:17:04 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Games
[2012/01/30 18:17:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Emsisoft Anti-Malware
[2012/01/30 18:17:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Age of Wonders
[2012/01/30 18:17:02 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
[2012/01/30 18:17:02 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
[2012/01/30 18:16:55 | 000,000,304 | -H-- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-117609710-1960408961-839522115-1003.job
[2012/01/30 18:11:42 | 000,449,536 | -H-- | M] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe
[2012/01/30 16:59:00 | 000,000,962 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1960408961-839522115-1003Core.job
[2012/01/30 15:15:46 | 000,457,528 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/01/30 15:15:46 | 000,076,116 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/01/30 15:11:23 | 000,205,437 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012/01/27 21:00:00 | 000,000,360 | -H-- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-ANDY-Andrew Gregory.job
[2012/01/25 17:51:26 | 000,047,380 | -H-- | M] () -- C:\Documents and Settings\Andrew Gregory\Desktop\amazing.JPG
[2012/01/23 15:12:44 | 000,000,640 | -H-- | M] () -- C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Andrew Gregory.job
[2012/01/22 18:25:13 | 000,057,291 | -H-- | M] () -- C:\Documents and Settings\Andrew Gregory\Desktop\TerrorA.jpg
[2012/01/22 17:45:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Black Isle
[2012/01/15 18:13:27 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[14 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Andrew Gregory\My Documents\*.tmp files -> C:\Documents and Settings\Andrew Gregory\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/30 18:25:06 | 000,000,853 | -H-- | C] () -- C:\Documents and Settings\Andrew Gregory\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2012/01/30 18:17:40 | 000,000,835 | -H-- | C] () -- C:\Documents and Settings\Andrew Gregory\Desktop\System Check.lnk
[2012/01/30 18:17:34 | 000,000,344 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl
[2012/01/25 17:51:26 | 000,047,380 | -H-- | C] () -- C:\Documents and Settings\Andrew Gregory\Desktop\amazing.JPG
[2012/01/22 18:25:13 | 000,057,291 | -H-- | C] () -- C:\Documents and Settings\Andrew Gregory\Desktop\TerrorA.jpg
[2011/07/10 16:49:41 | 000,000,292 | -H-- | C] () -- C:\WINDOWS\vtmb.ini
[2011/06/10 08:48:13 | 000,019,038 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\286d533suswx4npd24ql5wd4vtyty8q
[2011/06/10 08:48:12 | 000,019,038 | -HS- | C] () -- C:\Documents and Settings\Andrew Gregory\Local Settings\Application Data\286d533suswx4npd24ql5wd4vtyty8q
[2011/03/02 07:18:14 | 000,004,096 | -H-- | C] () -- C:\WINDOWS\d3dx.dat
[2011/03/02 07:17:17 | 000,021,840 | -H-- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2011/03/02 07:17:17 | 000,017,212 | -H-- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2011/03/02 07:17:17 | 000,012,067 | -H-- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2011/03/02 07:00:02 | 000,000,037 | -H-- | C] () -- C:\WINDOWS\sierra.ini
[2011/02/25 18:07:18 | 000,043,520 | -H-- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2010/07/05 10:01:37 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/14 17:43:50 | 000,000,731 | -H-- | C] () -- C:\WINDOWS\Vtw.INI
[2010/06/12 07:55:37 | 000,354,816 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2010/06/03 14:31:29 | 000,017,408 | -H-- | C] () -- C:\Documents and Settings\Andrew Gregory\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/07 10:40:52 | 000,279,712 | -H-- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010/03/07 10:40:52 | 000,025,888 | -H-- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2009/11/22 21:30:19 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/11/22 21:29:05 | 000,272,576 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/11/22 17:09:01 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/11/22 16:57:34 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2009/11/22 14:21:32 | 000,024,576 | RH-- | C] () -- C:\WINDOWS\System32\AsIO.dll
[2009/11/22 14:21:32 | 000,012,400 | RH-- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys
[2009/11/22 14:21:31 | 000,011,832 | -H-- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys
[2009/11/22 14:21:31 | 000,010,216 | -H-- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys
[2009/11/22 13:56:33 | 000,034,313 | -H-- | C] () -- C:\WINDOWS\Ascd_log.ini
[2009/11/22 13:56:19 | 000,005,810 | RH-- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/11/22 13:56:13 | 000,033,880 | -H-- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009/11/22 13:56:13 | 000,010,296 | -H-- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/11/22 13:53:23 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/11/22 13:50:19 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/08/03 10:07:42 | 000,403,816 | -H-- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 10:07:42 | 000,230,768 | -H-- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/03/08 03:37:00 | 001,724,416 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009/03/08 03:37:00 | 001,657,376 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2009/03/08 03:37:00 | 001,503,232 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll
[2009/03/08 03:37:00 | 001,346,080 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2009/03/08 03:37:00 | 001,101,824 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009/03/08 03:37:00 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009/03/08 03:37:00 | 000,449,056 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2009/03/08 03:37:00 | 000,436,768 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008/12/19 10:15:58 | 004,338,246 | -H-- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2008/12/17 12:41:18 | 000,884,237 | -H-- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2008/12/17 12:22:58 | 000,093,184 | -H-- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2008/12/17 12:22:48 | 000,057,344 | -H-- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/12/17 12:17:34 | 000,239,247 | -H-- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2008/12/17 11:59:54 | 000,560,802 | -H-- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2008/10/07 04:13:30 | 000,197,912 | -H-- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | -H-- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/05/26 16:59:42 | 000,018,904 | -H-- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 16:59:40 | 000,106,605 | -H-- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 05:51:02 | 000,020,698 | -H-- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 05:48:48 | 000,030,628 | -H-- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 05:48:28 | 000,031,698 | -H-- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/11/02 11:10:16 | 000,080,912 | -H-- | C] () -- C:\WINDOWS\System32\sherlock2.exe
[2004/10/03 12:50:54 | 000,129,024 | -H-- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll
[2001/08/23 07:00:00 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 07:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 07:00:00 | 000,457,528 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 07:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 07:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 07:00:00 | 000,076,116 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 07:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 07:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 07:00:00 | 000,004,463 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 07:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2001/08/23 07:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/08/13 13:35:28 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\NetworkService\Application Data\Remote
[2011/10/26 04:20:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\Evreb
[2010/05/03 10:06:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\Facebook
[2010/12/29 15:39:38 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\Leadertech
[2011/12/13 09:50:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\PriceGong
[2011/10/26 12:03:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\Qoaxad
[2011/08/23 08:34:34 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\Remote
[2011/04/07 03:28:43 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\start
[2009/11/30 20:00:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\Windows Desktop Search
[2009/12/01 08:46:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Andrew Gregory\Application Data\Windows Search
[2011/08/13 13:33:31 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\LocalService\Application Data\Remote
[2010/12/09 12:20:58 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2010/12/09 12:21:47 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/12/05 08:54:04 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2009/11/23 15:38:06 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/12/02 10:44:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{49FC035F-4D1B-4459-B8B7-1EF5D11C6BAC}
[2012/02/03 18:27:49 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========


< End of report >

 

[Broni]

Do this on the computer you are posting from:
Copy the text in the codebox below:

:OTL
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - File not found
O4 - HKLM..\Run: [RUMrAHicILvex.exe] C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe (Microsoft Corp)
O4 - HKU\.DEFAULT..\RunOnce: [] File not found
O4 - HKU\LocalService_ON_C..\RunOnce: [] File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [] File not found
O4 - HKU\systemprofile_ON_C..\RunOnce: [] File not found
O7 - HKU\Andrew_Gregory_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer: NoDesktop = 1
[2012/01/30 18:17:40 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Andrew Gregory\Start Menu\Programs\System Check
[2012/01/30 18:17:22 | 000,362,496 | -H-- | C] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl.exe
[2012/01/30 18:14:48 | 000,449,536 | -H-- | C] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[14 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Andrew Gregory\My Documents\*.tmp files -> C:\Documents and Settings\Andrew Gregory\My Documents\*.tmp -> ]
[2012/01/30 18:25:07 | 000,000,853 | -H-- | M] () -- C:\Documents and Settings\Andrew Gregory\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2012/01/30 18:17:40 | 000,000,835 | -H-- | M] () -- C:\Documents and Settings\Andrew Gregory\Desktop\System Check.lnk
[2012/01/30 18:17:34 | 000,000,344 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl
[2012/01/30 18:17:22 | 000,362,496 | -H-- | M] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl.exe
[2012/01/30 18:11:42 | 000,449,536 | -H-- | M] (Microsoft Corp) -- C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe
[2011/06/10 08:48:13 | 000,019,038 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\286d533suswx4npd24ql5wd4vtyty8q
[2011/06/10 08:48:12 | 000,019,038 | -HS- | C] () -- C:\Documents and Settings\Andrew Gregory\Local Settings\Application Data\286d533suswx4npd24ql5wd4vtyty8q


:Services

:Reg

:Files

:Commands
[purity]

Open Notepad and paste it.
Save the document as Fix.txt on to a USB flash drive


On the infected computer the following...

Run OTLPE

• Insert USB stick and find the file Fix.txt. Drag the file Fix.txt and drop it under the Custom Scans/Fixes box at the bottom.
  
  • (The content of Fix.txt should appear in the box)
• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post the log produced (you'll need to transfer it with USB stick)
• Remove the CD and shut down computer manually.
• Attempt to reboot normally into Windows.

 

[SolutionSeeker]

Otl fix log

Pasted the fix in and ran OTL, it finished and produced a log, which I cp’d for transfer. Then I messed up: Hit the eject button on my cd while pulling out the usb stick, which seemed to freeze up the system so I couldn’t select anything and so I had to fit the manual reset button... The computer loaded normally and while there are no icons or start menu, the system check and write errors no longer appear.

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\RUMrAHicILvex.exe deleted successfully.
C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe moved successfully.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ deleted successfully.
Registry value HKEY_USERS\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ deleted successfully.
Registry value HKEY_USERS\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ deleted successfully.
Registry value HKEY_USERS\systemprofile_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ deleted successfully.
Registry key HKEY_USERS\Andrew_Gregory_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ Explorer not found.
C:\Documents and Settings\Andrew Gregory\Start Menu\Programs\System Check folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl.exe moved successfully.
File C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\PerfStringBackup.TMP deleted successfully.
C:\WINDOWS\System32\SET103.tmp deleted successfully.
C:\WINDOWS\System32\SET104.tmp deleted successfully.
C:\WINDOWS\System32\SET10B.tmp deleted successfully.
C:\WINDOWS\System32\SET153.tmp deleted successfully.
C:\WINDOWS\System32\SETFF.tmp deleted successfully.
C:\WINDOWS\002337_.tmp deleted successfully.
C:\WINDOWS\005404_.tmp deleted successfully.
C:\WINDOWS\DXT73.tmp deleted successfully.
C:\WINDOWS\DXT74.tmp deleted successfully.
C:\WINDOWS\DXT75.tmp deleted successfully.
C:\WINDOWS\DXT76.tmp deleted successfully.
C:\WINDOWS\DXT77.tmp deleted successfully.
C:\WINDOWS\DXT78.tmp deleted successfully.
C:\WINDOWS\DXT79.tmp deleted successfully.
C:\WINDOWS\DXT7A.tmp deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3d.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dara.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dchs.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dcht.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dcsy.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3ddan.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3ddeu.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dell.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3deng.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3desm.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3desn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dfin.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dfra.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dheb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dhun.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dita.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3djpn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dkor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dnld.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dnor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dplk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dptb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dptg.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3drus.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dsky.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dslv.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dsve.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dtha.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nv3dtrk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcpl.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplara.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplchs.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplcht.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplcsy.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcpldan.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcpldeu.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplell.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcpleng.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplesm.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplesn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplfin.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplfra.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplheb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplhun.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplita.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcpljpn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplkor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplnld.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplnor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplplk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplptb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplptg.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplrus.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplsky.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplslv.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcplsve.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcpltha.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvcpltrk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdsp.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspara.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspchs.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspcht.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspcsy.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspdan.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspdeu.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspell.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspeng.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspesm.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspesn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspfin.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspfra.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspheb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdsphun.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspita.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspjpn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspkor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspnld.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspnor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspplk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspptb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspptg.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdsprus.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspsky.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspslv.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdspsve.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdsptha.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvdsptrk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmob.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobara.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobchs.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobcht.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobcsy.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobdan.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobdeu.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobell.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobeng.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobesm.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobesn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobfin.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobfra.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobheb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobhun.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobita.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobjpn.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobkor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobnld.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobnor.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobplk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobptb.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobptg.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobrus.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobsky.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobslv.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobsve.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobtha.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP\nvmobtrk.chm deleted successfully.
C:\WINDOWS\NV21721164.TMP folder deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET7.tmp deleted successfully.
C:\WINDOWS\wininit.tmp deleted successfully.
C:\Documents and Settings\Andrew Gregory\My Documents\~WRL1493.tmp deleted successfully.
C:\Documents and Settings\Andrew Gregory\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk moved successfully.
C:\Documents and Settings\Andrew Gregory\Desktop\System Check.lnk moved successfully.
C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl moved successfully.
File C:\Documents and Settings\All Users\Application Data\Gzgj67AvMeHjkl.exe not found.
File C:\Documents and Settings\All Users\Application Data\RUMrAHicILvex.exe not found.
C:\Documents and Settings\All Users\Application Data\286d533suswx4npd24ql5wd4vtyty8q moved successfully.
C:\Documents and Settings\Andrew Gregory\Local Settings\Application Data\286d533suswx4npd24ql5wd4vtyty8q moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

OTLPE by OldTimer - Version 3.1.48.0 log created on 02042012_194233

 

[Broni]

Very well

Let's see, if we can recover your missing features.
Download and run UnHide
Let me know, if it worked.

 

[SolutionSeeker]

Did you mean for me to run unhide in OTL loaded windows or normal windows? In normal windows I cannot access net or usb as it won't produce the icons or start menu.

 

[Broni]

See if you have same issue in Safe Mode with Networking.

 

[SolutionSeeker]

Took a bit of doing, including a weird rainbow screen of death, but I loaded into safemode. It gives me a choice of options - 'my name' and Admin. My name has no icons or start menu. Admin has those, and some seem to work - cant go online, but i can open the usb. Should I try to run unhide here?

 

[Broni]

Go ahead.....

 

[SolutionSeeker]

I've got a partial restore - I can see things in the start menu in normal mode and safe mode, but desktop icons are still invisible and the start folder shortcuts are often 'empty'. I can access I.Explorer from startmenu in normal mode now. Should I try disabling virus programs and running Unhide again in normal mode?

Could probably remove norton now too if neccessary.

 

[Broni]

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[SolutionSeeker]

Ok, slight update - my icons and taskbar contents ARE back (Haven't run combofix yet).

I want to start combofix but I can't shut-down Norton, despite following the link you supplied. I think I have the 2008 version, but it doesn't match up with what the guide says and neither do the other options mentioned alongside it - there is no 'User Accounts' in the left pane.

Addition: I seem to have a few programmes: Norton, Avira, Emisoft Anti-Malware and Spybot Search and Destroy, Windows Defender... Norton and Avira are the only ones in the task bar, but I don't want to get the listed 'unpredictable results'. Is there a way to scan for what progs you may have? I don't want to find some dusty old anti-adware i didn't even know i had messing things up.

 

[Broni]

Good news

Run Combofix from safe mode and disregard any warnings.

 

[SolutionSeeker]

Went into Safemode and ran the .exe.

Combofix made a peeping noise and warned me about Norton but I disregarded as advised.

Continuing, Apparently I do not have a 'Microsoft Windows recovery console' installed (it appears to be making a system restore point) should I have Combofix download one as it appears to want to? It says it wont try fixing some serious infections iff I don't.

 

[Broni]

Skip recovery console installation for now.

 

[SolutionSeeker]

combofix report

Finished



ComboFix 12-02-05.01 - Andrew Gregory 05/02/2012 0:01.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.3327.3032 [GMT 0:00]
Running from: c:\documents and settings\Andrew Gregory\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Norton Internet Security *Enabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Tarma Installer
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
c:\documents and settings\Andrew Gregory\Application Data\PriceGong
c:\documents and settings\Andrew Gregory\Application Data\Remote
c:\documents and settings\Andrew Gregory\Application Data\Remote\cvfq
c:\documents and settings\Andrew Gregory\Application Data\Remote\ffcd
c:\documents and settings\Andrew Gregory\Application Data\Remote\mnj.dat
c:\documents and settings\Andrew Gregory\Application Data\Remote\mxd1.txt
c:\documents and settings\Andrew Gregory\Application Data\Remote\pm_shrd
c:\documents and settings\Andrew Gregory\Application Data\Remote\xnhrr.dat
c:\documents and settings\Andrew Gregory\Application Data\Start
c:\documents and settings\Andrew Gregory\Application Data\Start\temp_20E5ACDA\flash.9.0.115.0.ocx
c:\documents and settings\Andrew Gregory\WINDOWS
c:\documents and settings\LocalService\Application Data\Remote
c:\documents and settings\LocalService\Application Data\Remote\pm_shrd
c:\documents and settings\NetworkService\Application Data\Remote
c:\documents and settings\NetworkService\Application Data\Remote\pm_shrd
.
.
((((((((((((((((((((((((( Files Created from 2012-01-05 to 2012-02-05 )))))))))))))))))))))))))))))))
.
.
2012-02-05 00:42 . 2012-02-05 00:42 -------- d-----w- C:\_OTL
2012-02-04 21:07 . 2012-01-06 04:19 6557240 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{04C60902-E79D-47EA-8FD4-D5B425AED6A3}\mpengine.dll
2012-02-04 20:28 . 2012-02-04 20:28 -------- d-----w- c:\documents and settings\Administrator
2012-02-01 22:24 . 2012-02-01 22:24 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2012-01-22 21:56 . 2012-01-22 21:56 -------- d-----w- c:\program files\Black Isle
2012-01-22 21:55 . 2000-01-04 06:39 212992 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-27 00:21 . 2011-06-11 00:36 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-06 04:19 . 2011-06-11 00:36 6557240 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-11-25 21:57 . 2001-08-23 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2001-08-23 12:00 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2001-08-23 12:00 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2009-11-22 21:46 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2001-08-23 12:00 152064 ----a-w- c:\windows\system32\schannel.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Akamai NetSession Interface"="c:\documents and settings\Andrew Gregory\Local Settings\Application Data\Akamai\netsession_win.exe" [2011-11-08 3295320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-11-13 5974528]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2008-02-06 718704]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-08 13680640]
"nwiz"="nwiz.exe" [2009-03-08 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-08 86016]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2010-10-29 274608]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"KodakShareButtonApp"="c:\program files\Kodak\KODAK Share Button App\Listener.exe" [2010-10-07 106496]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Andrew Gregory\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-11-27 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\Mass Effect 2\\Binaries\\MassEffect2.exe"=
"c:\\Program Files\\Mass Effect 2\\MassEffect2Launcher.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicDownloader\\RelicDownloader.exe"=
"c:\\Documents and Settings\\Andrew Gregory\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [10/06/2011 18:42 3045688]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [30/09/2010 03:06 169408]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [23/08/2001 12:00 14336]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/11/2010 23:43 136360]
S2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [29/12/2010 20:35 10448]
S2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [06/02/2008 19:48 149352]
S3 a2acc;a2acc;c:\program files\Emsisoft Anti-Malware\a2accx86.sys [10/06/2011 18:42 51632]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [12/01/2008 19:32 23888]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [22/11/2009 22:30 102448]
S3 ldiskl;ldiskl;\??\c:\docume~1\ANDREW~1\LOCALS~1\Temp\ldiskl.sys --> c:\docume~1\ANDREW~1\LOCALS~1\Temp\ldiskl.sys [?]
S3 PciCon;PciCon;\??\d:\pcicon.sys --> d:\PciCon.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - COMHOST
*NewlyCreated* - LBEEPKE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-28 c:\windows\Tasks\AdobeAAMUpdater-1.0-ANDY-Andrew Gregory.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-07-29 01:25]
.
2012-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1960408961-839522115-1003Core.job
- c:\documents and settings\Andrew Gregory\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-23 00:09]
.
2012-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1960408961-839522115-1003UA.job
- c:\documents and settings\Andrew Gregory\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-23 00:09]
.
2012-02-04 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
2012-01-23 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Andrew Gregory.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 07:05]
.
2012-02-04 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-117609710-1960408961-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 17:32]
.
2012-02-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-117609710-1960408961-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-10-20 17:32]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\documents and settings\Andrew Gregory\Application Data\Mozilla\Firefox\Profiles\jou8aea6.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Yontoo Layers: plugin@yontoo.com - %profile%\extensions\plugin@yontoo.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: extentions.y2layers.installId - 74e24ab9-c3c9-489c-bd59-182e297a8a66
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - (no file)
AddRemove-sp6 - c:\program files\Common Files\LogiShrd\sp6_Uninstall\setup.exe
AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\docume~1\ALLUSE~1\APPLIC~1\TARMAI~1\{889DF~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-05 00:05
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_e286960.dll"
.
Completion time: 2012-02-05 00:07:00
ComboFix-quarantined-files.txt 2012-02-05 00:06
.
Pre-Run: 50,513,428,480 bytes free
Post-Run: 50,663,247,872 bytes free
.
- - End Of File - - 7A80DB61C063F4039D784D8775BF8C6A

 

[Broni]

Restart computer in Safe Mode with Networking so you can allow Recovery Console installation and....

1. Please open Notepad (Start>All Programs>Accessories>Notepad).

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\docume~1\ANDREW~1\LOCALS~1\Temp\ldiskl.sys

Driver::
ldiskl

ClearJavaCache::

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt

 

[SolutionSeeker]

Will run. Before it starts Does it matter that combofix still seems to detect and object to, my un-switchoff-able Norton programme even while in Safemode?