also @ TechSpot: Updated Microsoft EULA prohibits class action lawsuits

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Solved] System Check virus

Discussion in 'Virus and Malware Removal' started by Paquirris, Jan 11, 2012.

Page 1 of 2

  1. Paquirris Newcomer, in training

    My computer is infected with the "System Check" virus, the icons of my acount desktop, and for the others accounts, are gone as well with the "all Programs" so the computer only displays the windows of the virus "System Check", so i was able to get on Safe Mode and run "aswMBR" then after that I left my pc running the "Combofix" last night, so reading the other post I realized that the logs need to be checked to find out what the "aswBR" and "Combofix" found on my PC.
    I will post the logs once I get home after work, but i am not sure where can i find them.
    Please help me to find the logs and continue with the process to clean my PC
    Thanks.
    Paquirris, Jan 11, 2012
    #1

  2. Broni Malware Annihilator

    Welcome aboard [IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==============================================================

    Never run Combofix on your own!
    Broni, Jan 11, 2012
    #2

  3. Paquirris Newcomer, in training

    Broni, so should i restart my PC and then follow the steps on the topic 58138?
    Yesterday i was not able to run the Microsoft security essencial on the normal mode, i will try again once i get home, but if i still can't do it, should i try on Safe Mode?
    Paquirris, Jan 11, 2012
    #3

  4. Broni Malware Annihilator

    If normal mode doesn't work Safe Mode will be fine for now.
    Broni, Jan 11, 2012
    #4

  5. Paquirris Newcomer, in training

    I was able to scan my pc, Microsft Security Essential did not find anything and here the log from Malwarebytes

    Malwarebytes Anti-Malware (Trial) 1.60.0.1800
    www.malwarebytes.org

    Database version: v2012.01.11.06

    Windows XP Service Pack 3 x86 NTFS
    Internet Explorer 8.0.6001.18702
    Edgar :: YOUR-EF9D1E1329 [administrator]

    Protection: Enabled

    1/11/2012 5:28:19 PM
    mbam-log-2012-01-11 (17-28-19).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 257853
    Time elapsed: 21 minute(s), 52 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 1
    C:\WINDOWS\system32\inusbw32.dll (Trojan.Dropper) -> Delete on reboot.

    Registry Keys Detected: 1
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Detected: 1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|cwwkkUVelOBtP0c (Trojan.FakeAlert.Gen) -> Data: C:\Documents and Settings\Liset\Application Data\dwme.exe -> Quarantined and deleted successfully.

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 1
    C:\Documents and Settings\Liset\Application Data\SystemProc (Trojan.Agent) -> Quarantined and deleted successfully.

    Files Detected: 4
    C:\WINDOWS\system32\inusbw32.dll (Trojan.Dropper) -> Delete on reboot.
    C:\Documents and Settings\Abby\Local Settings\Temp\ICReinstall\MusicConverterSetup[1].exe (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Liset\Local Settings\Temporary Internet Files\Content.IE5\2QI2QERU\readme[1].exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Liset\Application Data\ldr.ini (Malware.Trace) -> Quarantined and deleted successfully.

    (end)
    Paquirris, Jan 11, 2012
    #5

  6. Paquirris Newcomer, in training

    Here is the log for Gmer

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-01-11 18:35:19
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST380013A rev.8.01
    Running: w7mbfktv.exe; Driver: C:\DOCUME~1\Edgar\LOCALS~1\Temp\kwlyapoc.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----
    Paquirris, Jan 11, 2012
    #6

  7. Paquirris Newcomer, in training

    Here is the DDS log

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.6001.18702
    Run by Edgar at 18:39:51 on 2012-01-11
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1129 [GMT -6:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\internet explorer\iexplore.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    mStart Page = hxxp://www.searchcanvas.com/?ot=6
    uURLSearchHooks: H - No File
    mURLSearchHooks: H - No File
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - No File
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - No File
    BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    {9c08a2a0-dad1-4686-a0ea-6044d19d9547}
    BHO: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
    BHO: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
    BHO: Superfiles Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No File
    TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Superfiles Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
    TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [ehTray] c:\windows\ehome\ehtray.exe
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [QuickTime Task] "c:\program files\quicktime alternative\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
    mRun: [JIHYyTpFFCbPF.exe] c:\documents and settings\all users\application data\JIHYyTpFFCbPF.exe
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    IE: &Search
    IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - hxxp://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
    DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1209877873268
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://www.ritzpix.com/net/Uploader/LPUploader57.cab
    DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
    DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
    TCP: DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{B2B9D030-A334-4DA8-A0F0-B081652FF158} : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{D4619AD3-F353-45B2-97A2-DBAFE5A21BC3} : DhcpNameServer = 192.168.0.1
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: intelsusb - ntusbw32.dll
    Notify: ntusbw32 - ntusbw32.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 165648]
    R1 MpKsldc83b09e;MpKsldc83b09e;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a60c5db5-7eff-49dc-80bb-d139d154523e}\MpKsldc83b09e.sys [2012-1-11 29904]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-2-13 54752]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-1-11 652872]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-1-11 20464]
    S1 asodgdls;asodgdls;\??\c:\windows\system32\drivers\asodgdls.sys --> c:\windows\system32\drivers\asodgdls.sys [?]
    S1 gmxzliic;gmxzliic;\??\c:\windows\system32\drivers\gmxzliic.sys --> c:\windows\system32\drivers\gmxzliic.sys [?]
    S1 MpKsl06b76f20;MpKsl06b76f20;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{daec6253-0a58-47a8-bb61-c0d20c962a7b}\mpksl06b76f20.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{daec6253-0a58-47a8-bb61-c0d20c962a7b}\MpKsl06b76f20.sys [?]
    S1 MpKsl079f1f47;MpKsl079f1f47;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8955aea4-88a9-4850-994b-8c89f24b5fdd}\mpksl079f1f47.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8955aea4-88a9-4850-994b-8c89f24b5fdd}\MpKsl079f1f47.sys [?]
    S1 MpKsl1a0f1d16;MpKsl1a0f1d16;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95325a91-6053-45d4-8208-50a32de06c58}\mpksl1a0f1d16.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95325a91-6053-45d4-8208-50a32de06c58}\MpKsl1a0f1d16.sys [?]
    S1 MpKsl1f9f9472;MpKsl1f9f9472;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3c76dbcb-9609-4f78-8d15-5fb329c9296e}\mpksl1f9f9472.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3c76dbcb-9609-4f78-8d15-5fb329c9296e}\MpKsl1f9f9472.sys [?]
    S1 MpKsl38920e80;MpKsl38920e80;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8ba7a2f4-398c-4ec4-9936-a0a218374c83}\mpksl38920e80.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8ba7a2f4-398c-4ec4-9936-a0a218374c83}\MpKsl38920e80.sys [?]
    S1 MpKsl5240baa8;MpKsl5240baa8;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{83edce3a-eceb-4b47-9458-c242de9aa23c}\mpksl5240baa8.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{83edce3a-eceb-4b47-9458-c242de9aa23c}\MpKsl5240baa8.sys [?]
    S1 MpKsl6ca736f8;MpKsl6ca736f8;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41f672bc-cecb-45b1-9738-609f5fcd9091}\mpksl6ca736f8.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41f672bc-cecb-45b1-9738-609f5fcd9091}\MpKsl6ca736f8.sys [?]
    S1 MpKsl6e70bc41;MpKsl6e70bc41;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c6527dea-83fc-409e-a049-d93187c57e3d}\mpksl6e70bc41.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c6527dea-83fc-409e-a049-d93187c57e3d}\MpKsl6e70bc41.sys [?]
    S1 MpKsl733fa383;MpKsl733fa383;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8ba7a2f4-398c-4ec4-9936-a0a218374c83}\mpksl733fa383.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8ba7a2f4-398c-4ec4-9936-a0a218374c83}\MpKsl733fa383.sys [?]
    S1 MpKsl9df2b0f9;MpKsl9df2b0f9;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{66ea9bc6-c760-4df0-98d7-5b02519e7715}\mpksl9df2b0f9.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{66ea9bc6-c760-4df0-98d7-5b02519e7715}\MpKsl9df2b0f9.sys [?]
    S1 MpKsla5ff55f5;MpKsla5ff55f5;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95325a91-6053-45d4-8208-50a32de06c58}\mpksla5ff55f5.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95325a91-6053-45d4-8208-50a32de06c58}\MpKsla5ff55f5.sys [?]
    S1 MpKslac9ac09d;MpKslac9ac09d;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{7d3f9be5-0f95-4347-94da-f7b55c3e1a35}\mpkslac9ac09d.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{7d3f9be5-0f95-4347-94da-f7b55c3e1a35}\MpKslac9ac09d.sys [?]
    S1 MpKslb545da48;MpKslb545da48;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41f672bc-cecb-45b1-9738-609f5fcd9091}\mpkslb545da48.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41f672bc-cecb-45b1-9738-609f5fcd9091}\MpKslb545da48.sys [?]
    S1 MpKslb78a220f;MpKslb78a220f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{24f063b3-3d94-4b63-b494-fd61f44a1f9f}\mpkslb78a220f.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{24f063b3-3d94-4b63-b494-fd61f44a1f9f}\MpKslb78a220f.sys [?]
    S1 MpKslb803c5a5;MpKslb803c5a5;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95325a91-6053-45d4-8208-50a32de06c58}\mpkslb803c5a5.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95325a91-6053-45d4-8208-50a32de06c58}\MpKslb803c5a5.sys [?]
    S1 MpKslde80f0dc;MpKslde80f0dc;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41f672bc-cecb-45b1-9738-609f5fcd9091}\mpkslde80f0dc.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41f672bc-cecb-45b1-9738-609f5fcd9091}\MpKslde80f0dc.sys [?]
    S1 MpKslfa5ff0ce;MpKslfa5ff0ce;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{57c329f6-5650-4111-8501-ae18fcb8613d}\mpkslfa5ff0ce.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{57c329f6-5650-4111-8501-ae18fcb8613d}\MpKslfa5ff0ce.sys [?]
    S1 ppgwxxyb;ppgwxxyb;\??\c:\windows\system32\drivers\ppgwxxyb.sys --> c:\windows\system32\drivers\ppgwxxyb.sys [?]
    S2 intelusb3;Intel USB3 Device Service;c:\windows\system32\svchost.exe -k intelusbs3 [2008-5-3 14336]
    S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2007-5-23 547744]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
    .
    =============== Created Last 30 ================
    .
    2012-01-12 00:36:00 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a60c5db5-7eff-49dc-80bb-d139d154523e}\MpKsldc83b09e.sys
    2012-01-12 00:35:57 56200 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a60c5db5-7eff-49dc-80bb-d139d154523e}\offreg.dll
    2012-01-12 00:35:52 6823496 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a60c5db5-7eff-49dc-80bb-d139d154523e}\mpengine.dll
    2012-01-11 23:25:30 -------- d-----w- c:\documents and settings\edgar\application data\Malwarebytes
    2012-01-11 23:25:04 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
    2012-01-11 23:25:03 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-01-11 23:25:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-01-11 04:35:23 62976 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
    2012-01-11 04:35:23 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
    2012-01-11 04:15:10 -------- d-sha-r- C:\cmdcons
    2012-01-11 04:11:36 98816 ----a-w- c:\windows\sed.exe
    2012-01-11 04:11:36 518144 ----a-w- c:\windows\SWREG.exe
    2012-01-11 04:11:36 256000 ----a-w- c:\windows\PEV.exe
    2012-01-11 04:11:36 208896 ----a-w- c:\windows\MBR.exe
    2012-01-11 04:11:30 -------- d-----w- C:\ComboFix
    .
    ==================== Find3M ====================
    .
    2011-12-02 07:44:50 41680 ---ha-w- c:\windows\system32\drivers\uezroeyy.sys
    2011-11-30 19:19:36 41680 ---ha-w- c:\windows\system32\drivers\dbpoqnaw.sys
    2011-11-23 13:25:32 1859584 ---ha-w- c:\windows\system32\win32k.sys
    2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
    2011-11-04 19:20:51 43520 ---ha-w- c:\windows\system32\licmgr10.dll
    2011-11-04 19:20:51 1469440 ---h--w- c:\windows\system32\inetcpl.cpl
    2011-11-04 11:23:59 385024 ---ha-w- c:\windows\system32\html.iec
    2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
    2011-10-28 05:31:48 33280 ---ha-w- c:\windows\system32\csrsrv.dll
    2011-10-25 13:33:08 2192768 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-10-25 12:52:03 2069376 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-10-14 23:38:00 456192 ---ha-w- c:\windows\system32\encdec.dll
    .
    ============= FINISH: 18:41:24.84 ===============
    Paquirris, Jan 11, 2012
    #7

  8. Paquirris Newcomer, in training

    Here is the Attach text

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 5/4/2008 12:47:46 AM
    System Uptime: 1/11/2012 5:55:58 PM (1 hours ago)
    .
    Motherboard: First International Computer, Inc. | | KTBC51G
    Processor: AMD Athlon(tm) 64 Processor 4000+ | Socket 939 | 1004/201mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 75 GiB total, 29.082 GiB free.
    E: is FIXED (NTFS) - 182 GiB total, 71.807 GiB free.
    F: is FIXED (FAT32) - 4 GiB total, 2.377 GiB free.
    H: is Removable
    I: is Removable
    J: is Removable
    K: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4D36E965-E325-11CE-BFC1-08002BE10318}
    Description: CD-ROM Drive
    Device ID: IDE\CDROMTSSTCORP_CD/DVDW_TS-H552D_______________GA01____\5&2EECBEAB&0&0.0.0
    Manufacturer: (Standard CD-ROM drives)
    Name: TSSTcorp CD/DVDW TS-H552D
    PNP Device ID: IDE\CDROMTSSTCORP_CD/DVDW_TS-H552D_______________GA01____\5&2EECBEAB&0&0.0.0
    Service: cdrom
    .
    ==== System Restore Points ===================
    .
    RP1562: 12/8/2011 10:07:35 AM - Software Distribution Service 3.0
    RP1563: 12/9/2011 2:29:54 AM - Software Distribution Service 3.0
    RP1564: 12/9/2011 10:01:27 AM - Software Distribution Service 3.0
    RP1565: 12/10/2011 2:30:20 AM - Software Distribution Service 3.0
    RP1566: 12/10/2011 10:02:38 AM - Software Distribution Service 3.0
    RP1567: 12/11/2011 2:29:13 AM - Software Distribution Service 3.0
    RP1568: 12/11/2011 10:03:21 AM - Software Distribution Service 3.0
    RP1569: 12/12/2011 2:28:53 AM - Software Distribution Service 3.0
    RP1570: 12/12/2011 10:03:13 AM - Software Distribution Service 3.0
    RP1571: 12/13/2011 2:29:27 AM - Software Distribution Service 3.0
    RP1572: 12/13/2011 10:03:13 AM - Software Distribution Service 3.0
    RP1573: 12/14/2011 2:29:33 AM - Software Distribution Service 3.0
    RP1574: 12/14/2011 10:03:23 AM - Software Distribution Service 3.0
    RP1575: 12/15/2011 2:29:15 AM - Software Distribution Service 3.0
    RP1576: 12/15/2011 3:00:20 AM - Software Distribution Service 3.0
    RP1577: 12/16/2011 2:09:05 AM - Software Distribution Service 3.0
    RP1578: 12/16/2011 4:51:53 PM - Software Distribution Service 3.0
    RP1579: 12/17/2011 2:09:15 AM - Software Distribution Service 3.0
    RP1580: 12/17/2011 4:51:53 PM - Software Distribution Service 3.0
    RP1581: 12/18/2011 2:09:31 AM - Software Distribution Service 3.0
    RP1582: 12/18/2011 4:51:52 PM - Software Distribution Service 3.0
    RP1583: 12/19/2011 2:08:48 AM - Software Distribution Service 3.0
    RP1584: 12/19/2011 4:52:16 PM - Software Distribution Service 3.0
    RP1585: 12/20/2011 2:08:51 AM - Software Distribution Service 3.0
    RP1586: 12/20/2011 4:51:25 PM - Software Distribution Service 3.0
    RP1587: 12/21/2011 2:09:19 AM - Software Distribution Service 3.0
    RP1588: 12/21/2011 4:51:58 PM - Software Distribution Service 3.0
    RP1589: 12/22/2011 2:10:10 AM - Software Distribution Service 3.0
    RP1590: 12/22/2011 4:51:51 PM - Software Distribution Service 3.0
    RP1591: 12/23/2011 2:09:05 AM - Software Distribution Service 3.0
    RP1592: 12/23/2011 4:51:52 PM - Software Distribution Service 3.0
    RP1593: 12/24/2011 2:09:01 AM - Software Distribution Service 3.0
    RP1594: 12/24/2011 4:51:24 PM - Software Distribution Service 3.0
    RP1595: 12/25/2011 2:09:31 AM - Software Distribution Service 3.0
    RP1596: 12/25/2011 4:52:04 PM - Software Distribution Service 3.0
    RP1597: 12/26/2011 2:09:51 AM - Software Distribution Service 3.0
    RP1598: 12/26/2011 4:52:16 PM - Software Distribution Service 3.0
    RP1599: 12/27/2011 2:10:26 AM - Software Distribution Service 3.0
    RP1600: 12/27/2011 4:52:21 PM - Software Distribution Service 3.0
    RP1601: 12/28/2011 2:09:41 AM - Software Distribution Service 3.0
    RP1602: 12/29/2011 1:42:06 AM - Software Distribution Service 3.0
    RP1603: 12/30/2011 1:41:51 AM - Software Distribution Service 3.0
    RP1604: 12/31/2011 1:41:51 AM - Software Distribution Service 3.0
    RP1605: 1/3/2012 8:54:05 AM - Software Distribution Service 3.0
    RP1606: 1/3/2012 9:03:23 AM - Software Distribution Service 3.0
    RP1607: 1/4/2012 1:56:39 AM - Software Distribution Service 3.0
    RP1608: 1/4/2012 8:58:19 AM - Software Distribution Service 3.0
    RP1609: 1/5/2012 1:56:32 AM - Software Distribution Service 3.0
    RP1610: 1/5/2012 8:58:55 AM - Software Distribution Service 3.0
    RP1611: 1/6/2012 1:56:30 AM - Software Distribution Service 3.0
    RP1612: 1/6/2012 8:58:48 AM - Software Distribution Service 3.0
    RP1613: 1/7/2012 1:34:01 AM - Software Distribution Service 3.0
    RP1614: 1/7/2012 5:58:22 PM - Software Distribution Service 3.0
    RP1615: 1/8/2012 2:06:27 AM - Software Distribution Service 3.0
    RP1616: 1/8/2012 7:43:29 PM - Software Distribution Service 3.0
    RP1617: 1/9/2012 2:05:37 AM - Software Distribution Service 3.0
    RP1618: 1/9/2012 7:43:29 PM - Software Distribution Service 3.0
    RP1619: 1/10/2012 2:06:14 AM - Software Distribution Service 3.0
    RP1620: 1/11/2012 2:05:52 AM - Software Distribution Service 3.0
    .
    ==== Installed Programs ======================
    .
    32 Bit HP CIO Components Installer
    Adobe Acrobat 4.0
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Media Player
    Adobe Reader 8.1.4
    Adobe Shockwave Player 11.5
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Ares 2.1.1
    Athlon 64 Processor Driver
    Blaze Video Magic 2.0
    BufferChm
    Coupon Printer for Windows
    Critical Update for Windows Media Player 11 (KB959772)
    D-Link AirPlus G Wireless LAN Adapter
    Disney Toontown Online
    DJ_AIO_03_F4200_ProductContext
    DJ_AIO_03_F4200_Software
    DJ_AIO_03_F4200_Software_Min
    F4200
    F4200_Help
    Facebook Video Calling 1.0.0.8953
    Form Fill (Windows Live Toolbar)
    Herramienta de carga de Windows Live
    Highlight Viewer (Windows Live Toolbar)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB2570791)
    Hotfix for Windows XP (KB2633952)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB954708)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HP Deskjet F4200 All-In-One Driver Software 11.0 Rel .3
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 17
    Java(TM) 6 Update 4
    Java(TM) 6 Update 7
    Junk Mail filter update
    Kidz Cam Photo Editing Software
    Logitech Audio Echo Cancellation Component
    Logitech QuickCam
    Logitech Video Enumerator
    Malwarebytes Anti-Malware version 1.60.0.1800
    Map Button (Windows Live Toolbar)
    Messenger Plus! Live
    Microsoft .NET Framework 1.0 Hotfix (KB2572066)
    Microsoft .NET Framework 1.0 Hotfix (KB953295)
    Microsoft .NET Framework 1.0 Hotfix (KB979904)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2656353)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Antimalware
    Microsoft Antimalware Service ES-ES Language Pack
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2000 Professional
    Microsoft Security Client
    Microsoft Security Client ES-ES Language Pack
    Microsoft Security Essentials
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    MobileMe Control Panel
    MSN
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MVision
    NVIDIA Drivers
    OneCare Advisor (Windows Live Toolbar)
    Paquete de compatibilidad para 2007 Office system
    Popup Blocker (Windows Live Toolbar)
    QuickTime
    QuickTime Alternative 1.44
    RealPlayer
    Realtek AC'97 Audio
    Realtek High Definition Audio Driver
    RealUpgrade 1.0
    SA32xx Media Converter
    Safari
    Scan
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft Windows (KB2564958)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB2530548)
    Security Update for Windows Internet Explorer 8 (KB2544521)
    Security Update for Windows Internet Explorer 8 (KB2559049)
    Security Update for Windows Internet Explorer 8 (KB2586448)
    Security Update for Windows Internet Explorer 8 (KB2618444)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476490)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2481109)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2503665)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2507938)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB2535512)
    Security Update for Windows XP (KB2536276-v2)
    Security Update for Windows XP (KB2536276)
    Security Update for Windows XP (KB2544893-v2)
    Security Update for Windows XP (KB2544893)
    Security Update for Windows XP (KB2555917)
    Security Update for Windows XP (KB2562937)
    Security Update for Windows XP (KB2566454)
    Security Update for Windows XP (KB2567053)
    Security Update for Windows XP (KB2567680)
    Security Update for Windows XP (KB2570222)
    Security Update for Windows XP (KB2570947)
    Security Update for Windows XP (KB2592799)
    Security Update for Windows XP (KB2618451)
    Security Update for Windows XP (KB2620712)
    Security Update for Windows XP (KB2624667)
    Security Update for Windows XP (KB2633171)
    Security Update for Windows XP (KB2639417)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Segoe UI
    Skype™ 4.2
    Smart Menus (Windows Live Toolbar)
    Sonic Encoders
    Spelling Dictionaries Support For Adobe Reader 8
    Spybot - Search & Destroy
    Toolbox
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB971930)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows Media Player 10 (KB913800)
    Update for Windows Media Player 10 (KB926251)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB2541763)
    Update for Windows XP (KB2607712)
    Update for Windows XP (KB2616676)
    Update for Windows XP (KB2641690)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB960763)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971029)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update Rollup 2 for Windows XP Media Center Edition 2005
    WebFldrs XP
    WebReg
    Windows Backup Utility
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live Mail
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Live Outlook Toolbar (Windows Live Toolbar)
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Toolbar Extension (Windows Live Toolbar)
    Windows Live Toolbar Feed Detector (Windows Live Toolbar)
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Media Center Edition 2005 KB2502898
    Windows XP Media Center Edition 2005 KB2619340
    Windows XP Media Center Edition 2005 KB925766
    Windows XP Media Center Edition 2005 KB973768
    Windows XP Service Pack 3
    Yahoo! Browser Services
    Yahoo! Install Manager
    Yahoo! Internet Mail
    Yahoo! Messenger
    .
    ==== Event Viewer Messages From Past Week ========
    .
    1/7/2012 7:38:38 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Media Center Scheduler Service service to connect.
    1/7/2012 7:38:38 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Media Center Receiver Service service to connect.
    1/7/2012 7:38:38 PM, error: Service Control Manager [7000] - The Media Center Scheduler Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    1/7/2012 7:38:38 PM, error: Service Control Manager [7000] - The LVSrvLauncher service failed to start due to the following error: The system cannot find the file specified.
    1/11/2012 5:56:58 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp iaStor ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
    1/11/2012 5:56:55 PM, error: Service Control Manager [7023] - The Intel USB3 Device Service service terminated with the following error: The specified module could not be found.
    1/10/2012 9:43:46 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 Fips MpFilter
    1/10/2012 9:42:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
    1/10/2012 9:31:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    1/10/2012 8:54:33 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    1/10/2012 8:53:28 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    1/10/2012 8:53:22 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK8 Fips IPSec MpFilter MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
    1/10/2012 8:53:22 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    1/10/2012 8:53:22 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/10/2012 8:53:22 PM, error: Service Control Manager [7001] - The fssfltr service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/10/2012 8:53:22 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/10/2012 8:53:22 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    1/10/2012 8:53:22 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/10/2012 8:52:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    1/10/2012 8:52:39 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    1/10/2012 8:37:47 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware detectó un error al intentar actualizar las firmas. Nueva versión de la firma: Versión anterior de la firma: 1.117.2549.0 Origen de la actualización: Servidor de Microsoft Update Fase de actualización: Buscar Ruta de acceso de origen: http://www.microsoft.com Tipo de firma: AntiVirus Tipo de actualización: Completa Usuario: NT AUTHORITY\SYSTEM Versión del motor actual: Versión del motor anterior: 1.1.7903.0 Código de error: 0x80072efd Descripción del error: A connection with the server could not be established
    1/10/2012 8:28:08 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
    1/10/2012 10:22:42 PM, error: Service Control Manager [7034] - The Process Monitor service terminated unexpectedly. It has done this 1 time(s).
    1/10/2012 10:09:21 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
    .
    ==== End Of File ===========================
    Paquirris, Jan 11, 2012
    #8

  9. Broni Malware Annihilator

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    ============================================================

    Download Bootkit Remover to your Desktop.

    • Unzip downloaded file to your Desktop.
    • Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
    Broni, Jan 11, 2012
    #9

  10. Paquirris Newcomer, in training

    log for the aswMBR

    aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
    Run date: 2012-01-10 21:47:22
    -----------------------------
    21:47:22.968 OS Version: Windows 5.1.2600 Service Pack 3
    21:47:22.968 Number of processors: 1 586 0x2701
    21:47:22.968 ComputerName: YOUR-EF9D1E1329 UserName: Edgar
    21:47:23.515 Initialize success
    21:57:29.437 AVAST engine defs: 12011001
    21:58:06.750 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
    21:58:06.765 Disk 0 Vendor: ST380013A 8.01 Size: 76319MB BusType: 3
    21:58:06.781 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
    21:58:06.796 Disk 1 Vendor: ST3200827A 3.AAE Size: 190782MB BusType: 3
    21:58:06.828 Disk 0 MBR read successfully
    21:58:06.843 Disk 0 MBR scan
    21:58:06.890 Disk 0 unknown MBR code
    21:58:06.906 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76316 MB offset 63
    21:58:06.921 Disk 0 scanning sectors +156295440
    21:58:07.015 Disk 0 scanning C:\WINDOWS\system32\drivers
    21:58:24.187 Service scanning
    21:58:27.468 Modules scanning
    21:58:34.187 Disk 0 trace - called modules:
    21:58:34.406 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
    21:58:34.515 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a8ed030]
    21:58:34.609 3 CLASSPNP.SYS[f76b7fd7] -> nt!IofCallDriver -> \Device\00000097[0x8a7e11c0]
    21:58:34.718 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8a7d4d98]
    21:58:35.171 AVAST engine scan C:\WINDOWS
    21:58:53.828 AVAST engine scan C:\WINDOWS\system32
    21:59:33.859 File: C:\WINDOWS\system32\inusbw32.dll **INFECTED** Win32:Malware-gen
    22:00:14.671 File: C:\WINDOWS\system32\ntusbw32.dll **INFECTED** Win32:Malware-gen
    22:01:15.859 AVAST engine scan C:\WINDOWS\system32\drivers
    22:01:37.468 AVAST engine scan C:\Documents and Settings\Edgar
    22:04:15.578 AVAST engine scan C:\Documents and Settings\All Users
    22:05:28.703 Scan finished successfully
    22:06:19.500 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Edgar\Desktop\MBR.dat"
    22:06:19.531 The log file has been saved successfully to "C:\Documents and Settings\Edgar\Desktop\aswMBR.txt"


    aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
    Run date: 2012-01-11 19:09:48
    -----------------------------
    19:09:48.359 OS Version: Windows 5.1.2600 Service Pack 3
    19:09:48.359 Number of processors: 1 586 0x2701
    19:09:48.359 ComputerName: YOUR-EF9D1E1329 UserName: Edgar
    19:09:49.187 Initialize success
    19:25:52.375 AVAST engine defs: 12011101
    19:42:03.953 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
    19:42:03.953 Disk 0 Vendor: ST380013A 8.01 Size: 76319MB BusType: 3
    19:42:03.953 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
    19:42:03.953 Disk 1 Vendor: ST3200827A 3.AAE Size: 190782MB BusType: 3
    19:42:03.984 Disk 0 MBR read successfully
    19:42:03.984 Disk 0 MBR scan
    19:42:04.015 Disk 0 unknown MBR code
    19:42:04.015 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76316 MB offset 63
    19:42:04.031 Disk 0 scanning sectors +156295440
    19:42:04.171 Disk 0 scanning C:\WINDOWS\system32\drivers
    19:42:47.703 Service scanning
    19:42:48.218 Service MpKsldc83b09e C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A60C5DB5-7EFF-49DC-80BB-D139D154523E}\MpKsldc83b09e.sys **LOCKED** 32
    19:42:48.875 Modules scanning
    19:43:16.125 Disk 0 trace - called modules:
    19:43:16.156 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
    19:43:16.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a80f030]
    19:43:16.156 3 CLASSPNP.SYS[ba178fd7] -> nt!IofCallDriver -> \Device\0000009b[0x8a7fcf18]
    19:43:16.156 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8a8a7d98]
    19:43:16.546 AVAST engine scan C:\WINDOWS
    19:43:54.453 File: C:\WINDOWS\PEV.exe **INFECTED** Win32:Rootkit-gen [Rtk]
    19:44:12.546 AVAST engine scan C:\WINDOWS\system32
    19:50:06.640 AVAST engine scan C:\WINDOWS\system32\drivers
    19:50:57.375 AVAST engine scan C:\Documents and Settings\Edgar
    19:57:52.015 AVAST engine scan C:\Documents and Settings\All Users
    20:00:44.000 Scan finished successfully
    20:07:40.234 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Edgar\Desktop\MBR.dat"
    20:07:40.250 The log file has been saved successfully to "C:\Documents and Settings\Edgar\Desktop\aswMBR.txt"
    Paquirris, Jan 11, 2012
    #10

  11. Paquirris Newcomer, in training

    Bootkitlog

    Bootkit Remover
    (c) 2009 Esage Lab
    www.esagelab.com

    Program version: 1.2.0.1
    OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
    Boot sector MD5 is: 8785d03690cc1758d81ac5bd0279d35d

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>


    Done;
    Press any key to quit...
    Paquirris, Jan 11, 2012
    #11

  12. Broni Malware Annihilator

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.

    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
    Broni, Jan 11, 2012
    #12

  13. Paquirris Newcomer, in training

    OK here is the Combofix log

    ComboFix 12-01-10.02 - Edgar 01/11/2012 20:53:53.2.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1179 [GMT -6:00]
    Running from: c:\documents and settings\Edgar\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\windows\system32\drivers\etc\hosts.ics
    .
    ---- Previous Run -------
    .
    c:\documents and settings\All Users\Application Data\~GBACAhWl3f0wG8
    c:\documents and settings\All Users\Application Data\~GBACAhWl3f0wG8r
    c:\documents and settings\All Users\Application Data\~gNtTYuQgxG0QDS
    c:\documents and settings\All Users\Application Data\~gNtTYuQgxG0QDSr
    c:\documents and settings\All Users\Application Data\~xkbIQYdlVFTYu3
    c:\documents and settings\All Users\Application Data\~xkbIQYdlVFTYu3r
    c:\documents and settings\All Users\Application Data\GBACAhWl3f0wG8
    c:\documents and settings\All Users\Application Data\GBACAhWl3f0wG8.exe
    c:\documents and settings\All Users\Application Data\gNtTYuQgxG0QDS
    c:\documents and settings\All Users\Application Data\gNtTYuQgxG0QDS.exe
    c:\documents and settings\All Users\Application Data\JIHYyTpFFCbPF.exe
    c:\documents and settings\All Users\Application Data\xkbIQYdlVFTYu3
    c:\documents and settings\All Users\Application Data\xkbIQYdlVFTYu3.exe
    c:\documents and settings\Edgar\Desktop\System Check.lnk
    c:\documents and settings\Edgar\Start Menu\Programs\System Check\System Check.lnk
    c:\documents and settings\Edgar\Start Menu\Programs\System Check\Uninstall System Check.lnk
    c:\program files\LP\F3C2\26.tmp
    c:\program files\LP\F3C2\27.tmp
    c:\program files\LP\F3C2\2F.tmp
    c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
    c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
    c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
    c:\program files\Search Toolbar\icon.ico
    c:\program files\Search Toolbar\SearchToolbar.dll
    c:\program files\Search Toolbar\SearchToolbarUninstall.exe
    c:\program files\Search Toolbar\SearchToolbarUpdater.exe
    c:\windows\$NtUninstallKB7171$\1940024671
    c:\windows\$NtUninstallKB7171$\1948936233\@
    c:\windows\$NtUninstallKB7171$\1948936233\bckfg.tmp
    c:\windows\$NtUninstallKB7171$\1948936233\cfg.ini
    c:\windows\$NtUninstallKB7171$\1948936233\Desktop.ini
    c:\windows\$NtUninstallKB7171$\1948936233\keywords
    c:\windows\$NtUninstallKB7171$\1948936233\kwrd.dll
    c:\windows\$NtUninstallKB7171$\1948936233\L\mzayzxgd
    c:\windows\$NtUninstallKB7171$\1948936233\lsflt7.ver
    c:\windows\$NtUninstallKB7171$\1948936233\U\00000001.@
    c:\windows\$NtUninstallKB7171$\1948936233\U\00000002.@
    c:\windows\$NtUninstallKB7171$\1948936233\U\00000004.@
    c:\windows\$NtUninstallKB7171$\1948936233\U\80000000.@
    c:\windows\$NtUninstallKB7171$\1948936233\U\80000004.@
    c:\windows\$NtUninstallKB7171$\1948936233\U\80000032.@
    c:\windows\alcrmv.exe
    c:\windows\EventSystem.log
    c:\windows\kb913800.exe
    c:\windows\system32\adawafod.ini
    c:\windows\system32\akivigir.ini
    c:\windows\system32\akizazuy.ini
    c:\windows\system32\aroguruy.ini
    c:\windows\system32\arudoyab.ini
    c:\windows\system32\drivers\etc\hosts.ics
    c:\windows\system32\drivers\etc\hosts.txt
    c:\windows\system32\drivers\npf.sys
    c:\windows\system32\elominev.ini
    c:\windows\system32\emeviyeb.ini
    c:\windows\system32\emezokus.ini
    c:\windows\system32\enusawid.ini
    c:\windows\system32\epigadih.ini
    c:\windows\system32\ihiyasud.ini
    c:\windows\system32\iluzupek.ini
    c:\windows\system32\irotafes.ini
    c:\windows\system32\ntusbw32.dll
    c:\windows\system32\ofoduhuv.ini
    c:\windows\system32\onofavan.ini
    c:\windows\system32\ozutoweg.ini
    c:\windows\system32\Packet.dll
    c:\windows\system32\ubasuvuk.ini
    c:\windows\system32\ukunurar.ini
    c:\windows\system32\uleniwos.ini
    c:\windows\system32\umogevog.ini
    c:\windows\system32\usuboyeb.ini
    c:\windows\system32\utisolot.ini
    c:\windows\system32\uwajerar.ini
    c:\windows\system32\uwezefav.ini
    c:\windows\system32\wpcap.dll
    F:\Autorun.inf
    .
    -- Previous Run --
    .
    c:\windows\system32\drivers\cdrom.sys was missing
    Restored copy from - c:\windows\system32\dllcache\cdrom.sys
    .
    --------
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Legacy_MYWEBSEARCHSERVICE
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-12-12 to 2012-01-12 )))))))))))))))))))))))))))))))
    .
    .
    2012-01-12 00:36 . 2012-01-12 00:36 29904 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A60C5DB5-7EFF-49DC-80BB-D139D154523E}\MpKsldc83b09e.sys
    2012-01-12 00:35 . 2012-01-12 00:35 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A60C5DB5-7EFF-49DC-80BB-D139D154523E}\offreg.dll
    2012-01-12 00:35 . 2011-11-21 10:47 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A60C5DB5-7EFF-49DC-80BB-D139D154523E}\mpengine.dll
    2012-01-11 23:25 . 2012-01-11 23:25 -------- d-----w- c:\documents and settings\Edgar\Application Data\Malwarebytes
    2012-01-11 23:25 . 2012-01-11 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2012-01-11 23:25 . 2012-01-11 23:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-01-11 23:25 . 2011-12-10 21:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-01-11 04:35 . 2008-04-13 18:40 62976 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
    2012-01-11 04:35 . 2008-04-13 18:40 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
    2012-01-11 03:40 . 2012-01-11 03:40 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-12-02 07:44 . 2011-12-02 07:44 41680 ---ha-w- c:\windows\system32\drivers\uezroeyy.sys
    2011-11-30 19:19 . 2011-11-30 19:19 41680 ---ha-w- c:\windows\system32\drivers\dbpoqnaw.sys
    2011-11-23 13:25 . 2008-05-04 05:34 1859584 ---ha-w- c:\windows\system32\win32k.sys
    2011-11-21 10:47 . 2010-06-15 21:05 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2011-11-04 19:20 . 2008-05-04 05:34 916992 ----a-w- c:\windows\system32\wininet.dll
    2011-11-04 19:20 . 2008-05-04 05:33 43520 ---ha-w- c:\windows\system32\licmgr10.dll
    2011-11-04 19:20 . 2008-05-04 05:32 1469440 ---h--w- c:\windows\system32\inetcpl.cpl
    2011-11-04 11:23 . 2008-05-04 05:32 385024 ---ha-w- c:\windows\system32\html.iec
    2011-11-01 16:07 . 2008-05-04 05:33 1288704 ----a-w- c:\windows\system32\ole32.dll
    2011-10-28 05:31 . 2008-05-04 05:31 33280 ---ha-w- c:\windows\system32\csrsrv.dll
    2011-10-25 13:33 . 2008-05-04 05:33 2192768 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-10-25 12:52 . 2008-05-04 05:36 2069376 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-10-14 23:38 . 2005-01-09 23:48 456192 ---ha-w- c:\windows\system32\encdec.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-01-11_22.55.51 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2012-01-11 23:56 . 2012-01-11 23:56 16384 c:\windows\Temp\Perflib_Perfdata_160.dat
    + 2005-01-10 01:17 . 2012-01-11 23:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2005-01-10 01:17 . 2012-01-11 04:40 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2011-11-21 16:37 . 2012-01-11 23:14 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
    - 2011-11-21 16:37 . 2012-01-11 04:40 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
    + 2005-01-10 01:17 . 2012-01-11 23:14 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2005-01-10 01:17 . 2012-01-11 04:40 49152 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2005-01-10 01:17 . 2012-01-11 23:14 458752 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2005-01-10 01:17 . 2012-01-11 04:40 458752 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    c:\program files\Ask.com\GenericAskToolbar.dll [BU]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-09-18 7204864]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-09-18 86016]
    "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
    "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" [2010-08-10 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-10-10 202256]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
    "JIHYyTpFFCbPF.exe"="c:\documents and settings\All Users\Application Data\JIHYyTpFFCbPF.exe" [BU]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\intelsusb]
    ntusbw32.dll [BU]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ntusbw32]
    ntusbw32.dll [BU]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "AppleSyncNotifier"=c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" -atboottime
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
    "nwiz"=nwiz.exe /install
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\Ares\\Ares.exe"=
    "c:\\WINDOWS\\ehome\\ehrecvr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
    "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Documents and Settings\\Liset\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
    .
    R1 MpKsldc83b09e;MpKsldc83b09e;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A60C5DB5-7EFF-49DC-80BB-D139D154523E}\MpKsldc83b09e.sys [1/11/2012 6:36 PM 29904]
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [1/11/2012 5:25 PM 652872]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [1/11/2012 5:25 PM 20464]
    S1 asodgdls;asodgdls;\??\c:\windows\system32\drivers\asodgdls.sys --> c:\windows\system32\drivers\asodgdls.sys [?]
    S1 gmxzliic;gmxzliic;\??\c:\windows\system32\drivers\gmxzliic.sys --> c:\windows\system32\drivers\gmxzliic.sys [?]
    S1 MpKsl06b76f20;MpKsl06b76f20;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DAEC6253-0A58-47A8-BB61-C0D20C962A7B}\MpKsl06b76f20.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DAEC6253-0A58-47A8-BB61-C0D20C962A7B}\MpKsl06b76f20.sys [?]
    S1 MpKsl079f1f47;MpKsl079f1f47;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8955AEA4-88A9-4850-994B-8C89F24B5FDD}\MpKsl079f1f47.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8955AEA4-88A9-4850-994B-8C89F24B5FDD}\MpKsl079f1f47.sys [?]
    S1 MpKsl1a0f1d16;MpKsl1a0f1d16;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsl1a0f1d16.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsl1a0f1d16.sys [?]
    S1 MpKsl1f9f9472;MpKsl1f9f9472;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3C76DBCB-9609-4F78-8D15-5FB329C9296E}\MpKsl1f9f9472.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3C76DBCB-9609-4F78-8D15-5FB329C9296E}\MpKsl1f9f9472.sys [?]
    S1 MpKsl38920e80;MpKsl38920e80;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl38920e80.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl38920e80.sys [?]
    S1 MpKsl5240baa8;MpKsl5240baa8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83EDCE3A-ECEB-4B47-9458-C242DE9AA23C}\MpKsl5240baa8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83EDCE3A-ECEB-4B47-9458-C242DE9AA23C}\MpKsl5240baa8.sys [?]
    S1 MpKsl6ca736f8;MpKsl6ca736f8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKsl6ca736f8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKsl6ca736f8.sys [?]
    S1 MpKsl6e70bc41;MpKsl6e70bc41;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6527DEA-83FC-409E-A049-D93187C57E3D}\MpKsl6e70bc41.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6527DEA-83FC-409E-A049-D93187C57E3D}\MpKsl6e70bc41.sys [?]
    S1 MpKsl733fa383;MpKsl733fa383;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl733fa383.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl733fa383.sys [?]
    S1 MpKsl9df2b0f9;MpKsl9df2b0f9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{66EA9BC6-C760-4DF0-98D7-5B02519E7715}\MpKsl9df2b0f9.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{66EA9BC6-C760-4DF0-98D7-5B02519E7715}\MpKsl9df2b0f9.sys [?]
    S1 MpKsla5ff55f5;MpKsla5ff55f5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsla5ff55f5.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsla5ff55f5.sys [?]
    S1 MpKslac9ac09d;MpKslac9ac09d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D3F9BE5-0F95-4347-94DA-F7B55C3E1A35}\MpKslac9ac09d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D3F9BE5-0F95-4347-94DA-F7B55C3E1A35}\MpKslac9ac09d.sys [?]
    S1 MpKslb545da48;MpKslb545da48;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslb545da48.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslb545da48.sys [?]
    S1 MpKslb78a220f;MpKslb78a220f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{24F063B3-3D94-4B63-B494-FD61F44A1F9F}\MpKslb78a220f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{24F063B3-3D94-4B63-B494-FD61F44A1F9F}\MpKslb78a220f.sys [?]
    S1 MpKslb803c5a5;MpKslb803c5a5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKslb803c5a5.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKslb803c5a5.sys [?]
    S1 MpKslde80f0dc;MpKslde80f0dc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslde80f0dc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslde80f0dc.sys [?]
    S1 MpKslfa5ff0ce;MpKslfa5ff0ce;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57C329F6-5650-4111-8501-AE18FCB8613D}\MpKslfa5ff0ce.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57C329F6-5650-4111-8501-AE18FCB8613D}\MpKslfa5ff0ce.sys [?]
    S1 ppgwxxyb;ppgwxxyb;\??\c:\windows\system32\drivers\ppgwxxyb.sys --> c:\windows\system32\drivers\ppgwxxyb.sys [?]
    S2 intelusb3;Intel USB3 Device Service;c:\windows\System32\svchost.exe -k intelusbs3 [5/3/2008 11:34 PM 14336]
    S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [5/23/2007 4:15 AM 547744]
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - KWLYAPOC
    *NewlyCreated* - MPKSLDC83B09E
    *Deregistered* - aswMBR
    *Deregistered* - kwlyapoc
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    intelusbs3 REG_MULTI_SZ intelusb3
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
    .
    2012-01-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007Core.job
    - c:\documents and settings\Liset\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-30 03:32]
    .
    2012-01-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007UA.job
    - c:\documents and settings\Liset\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-30 03:32]
    .
    2012-01-12 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 21:39]
    .
    2012-01-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1007.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1009.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-12 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1007.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1009.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    mStart Page = hxxp://www.searchcanvas.com/?ot=6
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    TCP: DhcpNameServer = 192.168.0.1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    BHO-{9c08a2a0-dad1-4686-a0ea-6044d19d9547} - (no file)
    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    Toolbar-Locked - (no file)
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-01-11 21:01
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    Completion time: 2012-01-11 21:03:05
    ComboFix-quarantined-files.txt 2012-01-12 03:03
    .
    Pre-Run: 31,169,527,808 bytes free
    Post-Run: 31,198,470,144 bytes free
    .
    - - End Of File - - 0E37DF599BCBF624CF36C4FAC5E7C4B5
    Paquirris, Jan 11, 2012
    #13

  14. Broni Malware Annihilator

    1. Please open Notepad (Start>All Programs>Accessories>Notepad).

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\windows\system32\drivers\uezroeyy.sys
c:\windows\system32\drivers\dbpoqnaw.sys
c:\windows\system32\drivers\asodgdls.sys
c:\windows\system32\drivers\gmxzliic.sys
c:\windows\system32\drivers\ppgwxxyb.sys

Folder::

Driver::
uezroeyy
dbpoqnaw
asodgdls
gmxzliic
ppgwxxyb


Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\intelsusb]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ntusbw32]

ClearJavaCache::

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    Broni, Jan 11, 2012
    #14

  15. Paquirris Newcomer, in training

    Combofix log

    ComboFix 12-01-11.01 - Edgar 01/11/2012 21:26:23.3.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1223 [GMT -6:00]
    Running from: c:\documents and settings\Edgar\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Edgar\Desktop\CFScript.txt
    AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    .
    FILE ::
    "c:\windows\system32\drivers\asodgdls.sys"
    "c:\windows\system32\drivers\dbpoqnaw.sys"
    "c:\windows\system32\drivers\gmxzliic.sys"
    "c:\windows\system32\drivers\ppgwxxyb.sys"
    "c:\windows\system32\drivers\uezroeyy.sys"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\windows\system32\drivers\dbpoqnaw.sys
    c:\windows\system32\drivers\uezroeyy.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_asodgdls
    -------\Service_gmxzliic
    -------\Service_ppgwxxyb
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-12-12 to 2012-01-12 )))))))))))))))))))))))))))))))
    .
    .
    2012-01-12 03:32 . 2012-01-12 03:32 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4B06163E-B697-4444-9CD5-B526F634CAFC}\offreg.dll
    2012-01-12 03:08 . 2011-11-21 10:47 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4B06163E-B697-4444-9CD5-B526F634CAFC}\mpengine.dll
    2012-01-11 23:25 . 2012-01-11 23:25 -------- d-----w- c:\documents and settings\Edgar\Application Data\Malwarebytes
    2012-01-11 23:25 . 2012-01-11 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2012-01-11 23:25 . 2012-01-11 23:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-01-11 23:25 . 2011-12-10 21:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-01-11 04:35 . 2008-04-13 18:40 62976 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
    2012-01-11 04:35 . 2008-04-13 18:40 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
    2012-01-11 03:40 . 2012-01-11 03:40 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-23 13:25 . 2008-05-04 05:34 1859584 ---ha-w- c:\windows\system32\win32k.sys
    2011-11-21 10:47 . 2010-06-15 21:05 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2011-11-04 19:20 . 2008-05-04 05:34 916992 ----a-w- c:\windows\system32\wininet.dll
    2011-11-04 19:20 . 2008-05-04 05:33 43520 ---ha-w- c:\windows\system32\licmgr10.dll
    2011-11-04 19:20 . 2008-05-04 05:32 1469440 ---h--w- c:\windows\system32\inetcpl.cpl
    2011-11-04 11:23 . 2008-05-04 05:32 385024 ---ha-w- c:\windows\system32\html.iec
    2011-11-01 16:07 . 2008-05-04 05:33 1288704 ----a-w- c:\windows\system32\ole32.dll
    2011-10-28 05:31 . 2008-05-04 05:31 33280 ---ha-w- c:\windows\system32\csrsrv.dll
    2011-10-25 13:33 . 2008-05-04 05:33 2192768 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-10-25 12:52 . 2008-05-04 05:36 2069376 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-10-14 23:38 . 2005-01-09 23:48 456192 ---ha-w- c:\windows\system32\encdec.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-01-11_22.55.51 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2012-01-12 03:32 . 2012-01-12 03:32 16384 c:\windows\Temp\Perflib_Perfdata_748.dat
    + 2005-01-10 01:17 . 2012-01-11 23:14 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2005-01-10 01:17 . 2012-01-11 04:40 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2011-11-21 16:37 . 2012-01-11 23:14 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
    - 2011-11-21 16:37 . 2012-01-11 04:40 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
    + 2012-01-12 03:32 . 2008-12-17 03:59 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
    - 2012-01-11 04:37 . 2008-12-17 03:59 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
    + 2005-01-10 01:17 . 2012-01-11 23:14 458752 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2005-01-10 01:17 . 2012-01-11 04:40 458752 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    c:\program files\Ask.com\GenericAskToolbar.dll [BU]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-09-18 7204864]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-09-18 86016]
    "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
    "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" [2010-08-10 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-10-10 202256]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
    "JIHYyTpFFCbPF.exe"="c:\documents and settings\All Users\Application Data\JIHYyTpFFCbPF.exe" [BU]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "AppleSyncNotifier"=c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" -atboottime
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
    "nwiz"=nwiz.exe /install
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\Ares\\Ares.exe"=
    "c:\\WINDOWS\\ehome\\ehrecvr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
    "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Documents and Settings\\Liset\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
    .
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [1/11/2012 5:25 PM 652872]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [1/11/2012 5:25 PM 20464]
    S1 MpKsl06b76f20;MpKsl06b76f20;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DAEC6253-0A58-47A8-BB61-C0D20C962A7B}\MpKsl06b76f20.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DAEC6253-0A58-47A8-BB61-C0D20C962A7B}\MpKsl06b76f20.sys [?]
    S1 MpKsl079f1f47;MpKsl079f1f47;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8955AEA4-88A9-4850-994B-8C89F24B5FDD}\MpKsl079f1f47.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8955AEA4-88A9-4850-994B-8C89F24B5FDD}\MpKsl079f1f47.sys [?]
    S1 MpKsl1a0f1d16;MpKsl1a0f1d16;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsl1a0f1d16.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsl1a0f1d16.sys [?]
    S1 MpKsl1f9f9472;MpKsl1f9f9472;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3C76DBCB-9609-4F78-8D15-5FB329C9296E}\MpKsl1f9f9472.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3C76DBCB-9609-4F78-8D15-5FB329C9296E}\MpKsl1f9f9472.sys [?]
    S1 MpKsl22df93c7;MpKsl22df93c7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4B06163E-B697-4444-9CD5-B526F634CAFC}\MpKsl22df93c7.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4B06163E-B697-4444-9CD5-B526F634CAFC}\MpKsl22df93c7.sys [?]
    S1 MpKsl38920e80;MpKsl38920e80;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl38920e80.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl38920e80.sys [?]
    S1 MpKsl5240baa8;MpKsl5240baa8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83EDCE3A-ECEB-4B47-9458-C242DE9AA23C}\MpKsl5240baa8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83EDCE3A-ECEB-4B47-9458-C242DE9AA23C}\MpKsl5240baa8.sys [?]
    S1 MpKsl6ca736f8;MpKsl6ca736f8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKsl6ca736f8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKsl6ca736f8.sys [?]
    S1 MpKsl6e70bc41;MpKsl6e70bc41;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6527DEA-83FC-409E-A049-D93187C57E3D}\MpKsl6e70bc41.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C6527DEA-83FC-409E-A049-D93187C57E3D}\MpKsl6e70bc41.sys [?]
    S1 MpKsl733fa383;MpKsl733fa383;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl733fa383.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8BA7A2F4-398C-4EC4-9936-A0A218374C83}\MpKsl733fa383.sys [?]
    S1 MpKsl9df2b0f9;MpKsl9df2b0f9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{66EA9BC6-C760-4DF0-98D7-5B02519E7715}\MpKsl9df2b0f9.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{66EA9BC6-C760-4DF0-98D7-5B02519E7715}\MpKsl9df2b0f9.sys [?]
    S1 MpKsla5ff55f5;MpKsla5ff55f5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsla5ff55f5.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKsla5ff55f5.sys [?]
    S1 MpKslac9ac09d;MpKslac9ac09d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D3F9BE5-0F95-4347-94DA-F7B55C3E1A35}\MpKslac9ac09d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7D3F9BE5-0F95-4347-94DA-F7B55C3E1A35}\MpKslac9ac09d.sys [?]
    S1 MpKslb545da48;MpKslb545da48;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslb545da48.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslb545da48.sys [?]
    S1 MpKslb78a220f;MpKslb78a220f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{24F063B3-3D94-4B63-B494-FD61F44A1F9F}\MpKslb78a220f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{24F063B3-3D94-4B63-B494-FD61F44A1F9F}\MpKslb78a220f.sys [?]
    S1 MpKslb803c5a5;MpKslb803c5a5;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKslb803c5a5.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95325A91-6053-45D4-8208-50A32DE06C58}\MpKslb803c5a5.sys [?]
    S1 MpKslde80f0dc;MpKslde80f0dc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslde80f0dc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41F672BC-CECB-45B1-9738-609F5FCD9091}\MpKslde80f0dc.sys [?]
    S1 MpKslfa5ff0ce;MpKslfa5ff0ce;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57C329F6-5650-4111-8501-AE18FCB8613D}\MpKslfa5ff0ce.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{57C329F6-5650-4111-8501-AE18FCB8613D}\MpKslfa5ff0ce.sys [?]
    S2 intelusb3;Intel USB3 Device Service;c:\windows\System32\svchost.exe -k intelusbs3 [5/3/2008 11:34 PM 14336]
    S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [5/23/2007 4:15 AM 547744]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    intelusbs3 REG_MULTI_SZ intelusb3
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
    .
    2012-01-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007Core.job
    - c:\documents and settings\Liset\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-30 03:32]
    .
    2012-01-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007UA.job
    - c:\documents and settings\Liset\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-30 03:32]
    .
    2012-01-12 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 21:39]
    .
    2012-01-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1007.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1009.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-12 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-12 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1007.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    2012-01-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1009.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 09:02]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    mStart Page = hxxp://www.searchcanvas.com/?ot=6
    IE: &Search
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    TCP: DhcpNameServer = 192.168.0.1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    BHO-{9c08a2a0-dad1-4686-a0ea-6044d19d9547} - (no file)
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-01-11 21:33
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'explorer.exe'(7148)
    c:\windows\system32\WININET.dll
    c:\windows\TEMP\logishrd\LVPrcInj01.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    c:\windows\system32\nvsvc32.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\windows\RTHDCPL.EXE
    c:\windows\eHome\ehmsas.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2012-01-11 21:38:19 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-01-12 03:38
    ComboFix2.txt 2012-01-12 03:03
    .
    Pre-Run: 31,216,881,664 bytes free
    Post-Run: 31,229,419,520 bytes free
    .
    - - End Of File - - EF3E64B1C9EF1CC65B54A85D7E030434
    Paquirris, Jan 11, 2012
    #15

  16. Broni Malware Annihilator

    Looks good.

    How is computer doing?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
    Broni, Jan 11, 2012
    #16

  17. Paquirris Newcomer, in training

    PC looks much better, Thanks you, here is the OTL log

    OTL logfile created on: 1/11/2012 9:59:41 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Edgar\Desktop
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.87 Gb Total Physical Memory | 1.31 Gb Available Physical Memory | 70.12% Memory free
    3.04 Gb Paging File | 2.62 Gb Available in Paging File | 86.48% Paging File free
    Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 74.53 Gb Total Space | 29.12 Gb Free Space | 39.07% Space Free | Partition Type: NTFS
    Drive E: | 182.03 Gb Total Space | 71.81 Gb Free Space | 39.45% Space Free | Partition Type: NTFS
    Drive F: | 4.27 Gb Total Space | 2.38 Gb Free Space | 55.73% Space Free | Partition Type: FAT32

    Computer Name: YOUR-EF9D1E1329 | User Name: Edgar | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2012/01/11 21:57:44 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Edgar\Desktop\OTL.exe
    PRC - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2011/12/24 17:50:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    PRC - [2011/06/15 15:16:48 | 000,997,920 | -H-- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
    PRC - [2011/04/27 15:39:26 | 000,011,736 | -H-- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    PRC - [2008/12/16 21:59:50 | 000,150,040 | -H-- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


    ========== Modules (No Company Name) ==========

    MOD - [2009/09/04 23:15:06 | 000,067,872 | -H-- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- -- (LVSrvLauncher)
    SRV - File not found [Auto | Stopped] -- -- (intelusb3)
    SRV - File not found [Auto | Stopped] -- -- (gusvc)
    SRV - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011/04/27 15:39:26 | 000,011,736 | -H-- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
    SRV - [2008/12/16 21:59:50 | 000,150,040 | -H-- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
    DRV - [2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2009/08/05 22:48:42 | 000,054,752 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
    DRV - [2008/12/16 21:58:54 | 000,025,624 | -H-- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
    DRV - [2008/05/04 12:49:01 | 000,008,413 | -H-- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\mcstrm.sys -- (MCSTRM)
    DRV - [2007/05/23 04:15:00 | 000,547,744 | -H-- | M] (D-Link Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\A3AB.sys -- (A3AB) D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB)
    DRV - [2005/09/23 18:56:28 | 003,966,976 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
    DRV - [2005/08/12 16:31:12 | 000,098,432 | -H-- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
    DRV - [2005/07/29 19:11:04 | 000,012,928 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
    DRV - [2005/07/29 19:11:02 | 000,034,048 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
    DRV - [2005/03/09 15:53:00 | 000,036,352 | -H-- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
    DRV - [2001/08/17 07:49:32 | 000,019,968 | -H-- | M] (Macronix International Co., Ltd. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mxnic.sys -- (mxnic)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchcanvas.com/?ot=6
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html


    IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

    IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

    IE - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
    IE - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..network.proxy.type: 0

    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.775: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.775: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.775: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/10 14:49:00 | 000,000,000 | ---D | M]

    [2011/09/26 18:02:46 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Edgar\Application Data\Mozilla\Extensions
    [2012/01/10 22:34:48 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2009/01/04 19:45:44 | 000,000,000 | -H-D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
    [2009/09/01 03:00:41 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

    O1 HOSTS File: ([2012/01/11 21:33:15 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - No CLSID value found.
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O2 - BHO: (no name) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - No CLSID value found.
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
    O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll File not found
    O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
    O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
    O2 - BHO: (Superfiles Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
    O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (Superfiles Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
    O3 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
    O3 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
    O3 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\..\Toolbar\WebBrowser: (Superfiles Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
    O4 - HKLM..\Run: [JIHYyTpFFCbPF.exe] C:\Documents and Settings\All Users\Application Data\JIHYyTpFFCbPF.exe File not found
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime Alternative\qttask.exe (Apple Inc.)
    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
    O4 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O4 - Startup: C:\Documents and Settings\Liset\Start Menu\Programs\Startup\Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm File not found
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx File not found
    O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab (Creative Software AutoUpdate)
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab (MSN Photo Upload Tool)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1209877873268 (MUWebControl Class)
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} http://www.ritzpix.com/net/Uploader/LPUploader57.cab (Image Uploader Control)
    O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab (Creative Software AutoUpdate Support Package)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B2B9D030-A334-4DA8-A0F0-B081652FF158}: DhcpNameServer = 192.168.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4619AD3-F353-45B2-97A2-DBAFE5A21BC3}: DhcpNameServer = 192.168.0.1
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: E:\Documents and Settings\Owner.YOUR-F8C4439DFA\My Documents\bonnet-1024x768.BMP
    O24 - Desktop BackupWallPaper: E:\Documents and Settings\Owner.YOUR-F8C4439DFA\My Documents\bonnet-1024x768.BMP
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2005/01/09 19:13:09 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2005/01/09 19:13:09 | 000,000,000 | -H-- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: VIDC.JDCT - jl_jdct.drv File not found

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/01/11 21:57:41 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Edgar\Desktop\OTL.exe
    [2012/01/11 20:48:49 | 004,378,257 | R--- | C] (Swearware) -- C:\Documents and Settings\Edgar\Desktop\ComboFix.exe
    [2012/01/11 20:11:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Edgar\Desktop\bootkit_remover
    [2012/01/11 18:39:12 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Edgar\Desktop\dds.scr
    [2012/01/11 17:25:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Edgar\Application Data\Malwarebytes
    [2012/01/11 17:25:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2012/01/11 17:25:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2012/01/11 17:25:03 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2012/01/11 17:25:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2012/01/11 17:24:15 | 010,847,608 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Edgar\Desktop\mbam-setup-1.60.0.1800.exe
    [2012/01/10 22:15:10 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2012/01/10 22:11:36 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2012/01/10 22:11:36 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2012/01/10 22:11:36 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2012/01/10 22:11:36 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2012/01/10 22:10:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2012/01/10 22:09:57 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/01/10 21:46:44 | 004,713,472 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Edgar\Desktop\aswMBR.exe
    [2012/01/10 20:47:23 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Edgar\Recent
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2012/01/11 21:59:02 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1006.job
    [2012/01/11 21:59:02 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1006.job
    [2012/01/11 21:57:44 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Edgar\Desktop\OTL.exe
    [2012/01/11 21:37:34 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2012/01/11 21:37:00 | 000,000,998 | -H-- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007UA.job
    [2012/01/11 21:37:00 | 000,000,976 | -H-- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007Core.job
    [2012/01/11 21:33:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2012/01/11 21:32:53 | 000,000,374 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics
    [2012/01/11 21:32:42 | 000,000,278 | -H-- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1007.job
    [2012/01/11 21:32:42 | 000,000,276 | -H-- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3487969574-3620517906-821581102-1009.job
    [2012/01/11 21:32:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2012/01/11 21:32:18 | 2011,680,768 | -HS- | M] () -- C:\hiberfil.sys
    [2012/01/11 21:24:37 | 004,378,257 | R--- | M] (Swearware) -- C:\Documents and Settings\Edgar\Desktop\ComboFix.exe
    [2012/01/11 21:07:00 | 000,000,286 | -H-- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1007.job
    [2012/01/11 20:10:45 | 000,044,607 | ---- | M] () -- C:\Documents and Settings\Edgar\Desktop\bootkit_remover.zip
    [2012/01/11 20:07:40 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Edgar\Desktop\MBR.dat
    [2012/01/11 19:06:38 | 004,713,472 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Edgar\Desktop\aswMBR.exe
    [2012/01/11 18:39:18 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Edgar\Desktop\dds.scr
    [2012/01/11 18:00:04 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Edgar\Desktop\w7mbfktv.exe
    [2012/01/11 17:25:09 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/01/11 17:24:20 | 010,847,608 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Edgar\Desktop\mbam-setup-1.60.0.1800.exe
    [2012/01/10 22:15:16 | 000,000,314 | RHS- | M] () -- C:\boot.ini
    [2012/01/10 13:19:05 | 000,030,277 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml
    [2012/01/07 19:12:58 | 000,000,284 | -H-- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3487969574-3620517906-821581102-1009.job
    [2012/01/05 09:27:00 | 000,000,284 | -H-- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2012/01/03 08:58:44 | 000,472,738 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2012/01/03 08:58:44 | 000,084,692 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2012/01/03 08:45:11 | 000,001,170 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/12/21 09:58:10 | 000,103,733 | -H-- | M] () -- C:\WINDOWS\System32\itusbcore.dat
    [2011/12/21 09:58:10 | 000,000,197 | -H-- | M] () -- C:\WINDOWS\System32\itlsvc.dat
    [2011/12/15 03:22:16 | 000,162,728 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2011/12/15 03:05:04 | 000,001,393 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2012/01/11 20:10:44 | 000,044,607 | ---- | C] () -- C:\Documents and Settings\Edgar\Desktop\bootkit_remover.zip
    [2012/01/11 17:59:49 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Edgar\Desktop\w7mbfktv.exe
    [2012/01/11 17:25:09 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/01/10 22:21:54 | 2011,680,768 | -HS- | C] () -- C:\hiberfil.sys
    [2012/01/10 22:15:16 | 000,000,199 | ---- | C] () -- C:\Boot.bak
    [2012/01/10 22:15:11 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2012/01/10 22:11:36 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2012/01/10 22:11:36 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2012/01/10 22:11:36 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2012/01/10 22:11:36 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2012/01/10 22:11:36 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2012/01/10 22:06:19 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Edgar\Desktop\MBR.dat
    [2011/11/21 10:34:43 | 000,103,733 | -H-- | C] () -- C:\WINDOWS\System32\itusbcore.dat
    [2011/11/21 10:34:43 | 000,000,197 | -H-- | C] () -- C:\WINDOWS\System32\itlsvc.dat
    [2010/11/27 13:10:57 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\PTWebCam.INI
    [2010/10/16 08:48:29 | 000,118,784 | -H-- | C] () -- C:\WINDOWS\System32\PTTreeIcons.dll
    [2010/02/05 20:44:02 | 000,000,292 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini
    [2009/11/20 09:14:27 | 000,034,972 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
    [2009/10/03 10:36:50 | 000,000,111 | -H-- | C] () -- C:\WINDOWS\ka.ini
    [2009/09/25 20:28:31 | 000,000,156 | -H-- | C] () -- C:\WINDOWS\QTW.INI
    [2009/09/25 20:28:11 | 000,002,552 | -H-- | C] () -- C:\WINDOWS\WAVEMIX.INI
    [2009/06/26 20:28:39 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
    [2009/04/29 12:34:01 | 000,166,304 | -H-- | C] () -- C:\WINDOWS\hpoins28.dat
    [2009/04/29 12:34:01 | 000,000,796 | -H-- | C] () -- C:\WINDOWS\hpomdl28.dat
    [2009/02/14 12:07:46 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
    [2009/02/04 16:15:51 | 000,000,298 | -H-- | C] () -- C:\WINDOWS\EReg077.dat
    [2009/02/04 16:15:39 | 000,000,033 | -H-- | C] () -- C:\WINDOWS\TLCAPPS.INI
    [2009/01/14 20:16:32 | 000,000,118 | -H-- | C] () -- C:\WINDOWS\System32\MRT.INI
    [2008/12/16 21:58:54 | 000,025,624 | -H-- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
    [2008/12/16 21:50:56 | 000,013,584 | -H-- | C] () -- C:\WINDOWS\System32\drivers\iKeyLgFT.dll
    [2008/12/06 09:05:49 | 000,005,950 | -H-- | C] () -- C:\WINDOWS\wininit.ini
    [2008/11/30 11:48:16 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2008/11/27 19:10:09 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\Edgar\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/08/09 22:14:33 | 000,000,552 | -H-- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2008/07/19 17:04:31 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\SETUP32.INI
    [2008/05/04 13:18:20 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Edgar\Local Settings\Application Data\fusioncache.dat
    [2008/05/04 00:16:53 | 001,662,976 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
    [2008/05/04 00:16:53 | 001,519,616 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe
    [2008/05/04 00:16:53 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll
    [2008/05/04 00:16:53 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll
    [2008/05/04 00:16:52 | 001,466,368 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll
    [2008/05/04 00:16:52 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
    [2008/05/04 00:16:52 | 000,573,440 | -H-- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
    [2008/05/04 00:16:52 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
    [2008/05/04 00:16:50 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe
    [2008/05/04 00:16:50 | 000,393,216 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe
    [2008/05/04 00:16:50 | 000,046,080 | -H-- | C] () -- C:\WINDOWS\System32\nvapi.dll
    [2008/05/04 00:08:12 | 000,000,396 | -H-- | C] () -- C:\WINDOWS\lexstat.ini
    [2008/05/03 23:38:01 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\SYSDRV.DAT
    [2008/05/03 23:34:00 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
    [2008/05/03 23:33:47 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
    [2008/05/03 23:33:47 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
    [2008/05/03 23:33:43 | 000,005,151 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
    [2008/05/03 23:33:39 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
    [2008/05/03 23:33:33 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
    [2008/05/03 23:33:08 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
    [2008/05/03 23:33:07 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
    [2008/05/03 23:32:06 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
    [2008/05/03 23:31:39 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
    [2008/05/03 22:23:26 | 000,040,960 | -H-- | C] () -- C:\WINDOWS\System32\ChCfg.exe
    [2008/05/03 22:23:13 | 000,000,164 | -H-- | C] () -- C:\WINDOWS\avrack.ini
    [2005/08/05 23:01:54 | 000,235,008 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2005/01/12 11:38:00 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/01/12 10:51:23 | 000,352,256 | -H-- | C] () -- C:\WINDOWS\System32\HotlineClient.exe
    [2005/01/09 19:17:55 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2005/01/09 19:07:25 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2005/01/09 17:49:16 | 000,000,461 | -H-- | C] () -- C:\WINDOWS\System32\emver.ini
    [2005/01/09 17:49:16 | 000,000,378 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2005/01/09 17:48:21 | 000,472,738 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
    [2005/01/09 17:48:21 | 000,084,692 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
    [2005/01/09 11:00:34 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2005/01/09 10:59:39 | 000,162,728 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [1999/01/22 12:46:58 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

    ========== LOP Check ==========

    [2011/11/18 21:51:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Abby\Application Data\24C37
    [2011/11/18 21:51:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Abby\Application Data\37EE8
    [2011/04/02 18:35:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BlazeVideo
    [2008/05/04 00:08:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
    [2008/05/03 23:22:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
    [2010/09/16 13:02:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    [2008/05/13 23:35:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\two setup mode load
    [2009/09/13 12:19:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
    [2009/03/21 11:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
    [2010/09/13 11:44:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2009/09/16 07:48:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2009/08/19 23:58:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
    [2009/05/31 10:21:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    [2011/09/26 21:52:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Edgar\Application Data\GetRightToGo
    [2008/08/14 15:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\iWin
    [2011/11/19 02:10:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\24C37
    [2008/05/04 14:58:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\DrvMedia
    [2010/02/16 21:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\Facebook
    [2008/08/14 14:44:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\iWin
    [2011/11/18 21:17:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\K88fRRZ9hTXwUVl
    [2008/08/07 00:46:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\MSNInstaller
    [2008/07/03 15:54:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\Password Solutions
    [2011/11/18 21:17:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\vJJ6dEK8gR
    [2011/11/18 21:17:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\WVVeelOOBtP0
    [2009/03/04 09:18:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\YouSendIt
    [2012/01/11 21:37:00 | 000,000,976 | -H-- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007Core.job
    [2012/01/11 21:37:00 | 000,000,998 | -H-- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-3487969574-3620517906-821581102-1007UA.job
    [2012/01/11 21:37:34 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2010/10/16 08:48:31 | 000,000,035 | -H-- | M] () -- C:\aa.txt
    [2005/01/09 19:13:09 | 000,000,000 | -H-- | M] () -- C:\AUTOEXEC.BAT
    [2008/05/03 23:37:59 | 000,000,199 | ---- | M] () -- C:\Boot.bak
    [2012/01/10 22:15:16 | 000,000,314 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2012/01/11 21:38:19 | 000,020,448 | ---- | M] () -- C:\ComboFix.txt
    [2005/01/09 19:13:09 | 000,000,000 | -H-- | M] () -- C:\CONFIG.SYS
    [2008/05/09 15:22:35 | 000,000,133 | -H-- | M] () -- C:\DealioAu.log
    [2012/01/11 21:32:18 | 2011,680,768 | -HS- | M] () -- C:\hiberfil.sys
    [2009/05/20 20:49:23 | 009,060,074 | -H-- | M] () -- C:\immudebug.log
    [2005/01/09 19:13:09 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2005/01/09 19:13:09 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2004/08/10 13:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008/05/08 20:09:05 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2012/01/11 21:32:15 | 1409,286,144 | -HS- | M] () -- C:\pagefile.sys
    [2008/05/04 00:43:04 | 000,000,002 | -H-- | M] () -- C:\REQUEST_OEMRESET_ENDUSER
    [2009/02/07 21:59:08 | 000,000,232 | -H-- | M] () -- C:\sqmdata00.sqm
    [2009/02/07 21:59:20 | 000,000,232 | -H-- | M] () -- C:\sqmdata01.sqm
    [2009/01/15 17:02:53 | 000,000,232 | -H-- | M] () -- C:\sqmdata02.sqm
    [2009/01/27 18:20:05 | 000,000,232 | -H-- | M] () -- C:\sqmdata03.sqm
    [2009/02/04 19:36:07 | 000,000,232 | -H-- | M] () -- C:\sqmdata04.sqm
    [2009/02/04 20:03:58 | 000,000,232 | -H-- | M] () -- C:\sqmdata05.sqm
    [2009/02/04 20:13:10 | 000,000,232 | -H-- | M] () -- C:\sqmdata06.sqm
    [2009/02/04 20:28:45 | 000,000,232 | -H-- | M] () -- C:\sqmdata07.sqm
    [2009/02/07 22:00:37 | 000,000,232 | -H-- | M] () -- C:\sqmdata08.sqm
    [2009/02/07 22:02:25 | 000,000,232 | -H-- | M] () -- C:\sqmdata09.sqm
    [2009/02/11 20:21:29 | 000,000,232 | -H-- | M] () -- C:\sqmdata10.sqm
    [2008/12/24 00:59:06 | 000,000,232 | -H-- | M] () -- C:\sqmdata11.sqm
    [2008/12/24 09:20:41 | 000,000,232 | -H-- | M] () -- C:\sqmdata12.sqm
    [2008/12/28 01:06:12 | 000,000,232 | -H-- | M] () -- C:\sqmdata13.sqm
    [2008/12/29 21:21:26 | 000,000,232 | -H-- | M] () -- C:\sqmdata14.sqm
    [2008/12/30 22:24:04 | 000,000,232 | -H-- | M] () -- C:\sqmdata15.sqm
    [2009/01/14 20:11:54 | 000,000,232 | -H-- | M] () -- C:\sqmdata16.sqm
    [2009/01/17 09:24:38 | 000,000,232 | -H-- | M] () -- C:\sqmdata17.sqm
    [2009/01/18 21:04:25 | 000,000,232 | -H-- | M] () -- C:\sqmdata18.sqm
    [2009/02/04 21:38:41 | 000,000,232 | -H-- | M] () -- C:\sqmdata19.sqm
    [2009/02/07 21:59:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
    [2009/02/07 21:59:20 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
    [2009/01/15 17:02:53 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
    [2009/01/27 18:20:05 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
    [2009/02/04 19:36:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
    [2009/02/04 20:03:58 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
    [2009/02/04 20:13:10 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
    [2009/02/04 20:28:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
    [2009/02/07 22:00:37 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
    [2009/02/07 22:02:25 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
    [2009/02/11 20:21:29 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
    [2008/12/24 00:59:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
    [2008/12/24 09:20:41 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
    [2008/12/28 01:06:12 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
    [2008/12/29 21:21:25 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
    [2008/12/30 22:24:04 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
    [2009/01/14 20:11:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
    [2009/01/17 09:24:37 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
    [2009/01/18 21:04:25 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
    [2009/02/04 21:38:41 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
    [2008/07/20 21:37:32 | 000,473,946 | -H-- | M] () -- C:\Uninstall.zip
    [2008/05/04 00:43:04 | 000,000,002 | RHS- | M] () -- C:\USER
    [2008/07/20 21:49:42 | 006,664,704 | -H-- | M] () -- C:\winzip111es.msi
    [2008/07/21 23:30:04 | 000,000,158 | -H-- | M] () -- C:\YServer.txt
    Paquirris, Jan 11, 2012
    #17

  18. Paquirris Newcomer, in training

    < %systemroot%\Fonts\*.com >
    [2006/04/18 15:39:28 | 000,026,040 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 14:53:56 | 000,026,489 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 15:39:28 | 000,029,779 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 14:58:52 | 000,030,808 | -H-- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/08/10 13:00:00 | 000,000,067 | -H-- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008/07/06 06:06:10 | 000,089,088 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2007/10/20 18:21:50 | 000,278,016 | -H-- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5mu.dll
    [2003/01/16 19:37:14 | 000,011,264 | -H-- | M] (BVRP Software) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxprint2000.dll
    [2008/07/06 04:50:03 | 000,597,504 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2010/04/17 00:04:40 | 000,306,032 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2005/01/09 10:58:49 | 000,094,208 | -H-- | M] () -- C:\WINDOWS\System32\config\default.sav
    [2005/01/09 10:58:49 | 000,659,456 | -H-- | M] () -- C:\WINDOWS\System32\config\software.sav
    [2005/01/09 10:58:49 | 000,868,352 | -H-- | M] () -- C:\WINDOWS\System32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

    < %USERPROFILE%\Desktop\*.exe >
    [2012/01/11 19:06:38 | 004,713,472 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Edgar\Desktop\aswMBR.exe
    [2012/01/11 21:24:37 | 004,378,257 | R--- | M] (Swearware) -- C:\Documents and Settings\Edgar\Desktop\ComboFix.exe
    [2012/01/11 17:24:20 | 010,847,608 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Edgar\Desktop\mbam-setup-1.60.0.1800.exe
    [2012/01/11 21:57:44 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Edgar\Desktop\OTL.exe
    [2012/01/11 18:00:04 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Edgar\Desktop\w7mbfktv.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >
    [2011/09/26 21:52:18 | 000,367,924 | ---- | M] (Conduit) -- C:\Documents and Settings\Edgar\My Documents\Brothersoftdownloader_for_WinSockFix.exe
    [2010/06/13 15:58:22 | 011,899,976 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Edgar\My Documents\mssefullinstall-x86fre-es-es-xp.exe
    [2008/06/25 17:38:43 | 002,017,515 | ---- | M] () -- C:\Documents and Settings\Edgar\My Documents\WCLP_PCDrv_US_1_02_05_506.EXE

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2008/05/04 00:49:07 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Edgar\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2012/01/11 21:58:59 | 000,163,840 | ---- | M] () -- C:\Documents and Settings\Edgar\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 22:10:26 | 000,317,440 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 18:11:51 | 000,033,792 | -H-- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 10:06:34 | 000,004,821 | -H-- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 10:06:34 | 000,007,047 | -H-- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 08:01:49 | 000,083,968 | -H-- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 11:30:28 | 000,180,224 | -H-- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 18:12:28 | 001,695,232 | -H-- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/04 10:06:36 | 000,002,882 | -H-- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 10:06:36 | 000,006,156 | -H-- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 10:06:36 | 000,006,160 | -H-- | M] () -- C:\Program Files\Messenger\online.wav
    [2008/12/25 23:36:58 | 000,005,120 | -HS- | M] () -- C:\Program Files\Messenger\Thumbs.db
    [2004/08/04 10:06:36 | 000,004,454 | -H-- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 10:06:36 | 000,115,981 | -H-- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >
    [1995/12/14 02:10:00 | 000,004,176 | RH-- | M] (Apple Computer, Inc.) -- C:\WINDOWS\system\QTNOTIFY.EXE

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < >

    < End of report >
    Paquirris, Jan 11, 2012
    #18

  19. Paquirris Newcomer, in training

    Extras Log

    OTL Extras logfile created on: 1/11/2012 9:59:41 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Edgar\Desktop
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.87 Gb Total Physical Memory | 1.31 Gb Available Physical Memory | 70.12% Memory free
    3.04 Gb Paging File | 2.62 Gb Available in Paging File | 86.48% Paging File free
    Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 74.53 Gb Total Space | 29.12 Gb Free Space | 39.07% Space Free | Partition Type: NTFS
    Drive E: | 182.03 Gb Total Space | 71.81 Gb Free Space | 39.45% Space Free | Partition Type: NTFS
    Drive F: | 4.27 Gb Total Space | 2.38 Gb Free Space | 55.73% Space Free | Partition Type: FAT32

    Computer Name: YOUR-EF9D1E1329 | User Name: Edgar | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:*:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:*:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:*:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:*:Enabled:mad:xpsp2res.dll,-22002

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 0
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22002

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
    "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
    "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
    "C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe
    "C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe
    "C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe
    "C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe
    "C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe
    "C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe
    "C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
    "C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Disabled:Ares p2p for windows -- (Ares Development Group)
    "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
    "C:\Documents and Settings\Liset\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\Liset\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin -- (Skype Limited)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
    "{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
    "{117CD9C0-0F15-4633-93D7-F957B50535A5}" = Popup Blocker (Windows Live Toolbar)
    "{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
    "{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
    "{1BD07DF4-FB06-41BA-B896-B2DA59000C96}" = Windows Live Toolbar
    "{1D7CE340-70C3-4848-BCCF-215950328A4C}" = Facebook Video Calling 1.0.0.8953
    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Herramienta de carga de Windows Live
    "{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}" = Safari
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{24E7B19B-EA09-483F-8735-97DD371E861B}" = SA32xx Media Converter
    "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17
    "{2A8E4833-F483-4074-B4DB-F295F7901A8D}" = MobileMe Control Panel
    "{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
    "{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
    "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
    "{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
    "{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
    "{38024121-D084-4E7D-B1A2-1A04CB5C4CF3}" = Windows Live Toolbar Feed Detector (Windows Live Toolbar)
    "{3BEF9769-BA52-18F7-1D02-2362F6A27E38}" = Adobe Media Player
    "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
    "{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
    "{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client ES-ES Language Pack
    "{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
    "{60D4F9F1-B828-4048-A5AB-9AA2FD0C4751}" = DJ_AIO_03_F4200_Software
    "{6365C963-4B72-43F8-8392-2A5441EC2A86}" = DJ_AIO_03_F4200_ProductContext
    "{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
    "{7D481DFF-88C5-4685-B0EA-D167F0B46CF1}" = Microsoft Antimalware Service ES-ES Language Pack
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
    "{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
    "{90120000-0020-0C0A-0000-0000000FF1CE}" = Paquete de compatibilidad para 2007 Office system
    "{937B232D-9776-471E-92BD-D424E514EF14}" = Logitech QuickCam
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A40D6757-B145-4FE7-B694-89180A9F3F64}" = Windows Live Outlook Toolbar (Windows Live Toolbar)
    "{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}" = Highlight Viewer (Windows Live Toolbar)
    "{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
    "{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
    "{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
    "{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B5749E57-AD4A-4B1B-ABC5-885FDBC286C9}" = D-Link AirPlus G Wireless LAN Adapter
    "{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
    "{B61A79BE-E94C-42C0-921D-8B7E5217069C}" = F4200
    "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
    "{BE8A9C2C-8E41-445B-A746-BEB0B1F992F8}" = DJ_AIO_03_F4200_Software_Min
    "{BEF726DD-4037-4214-8C6A-E625C02D2870}" = Logitech Audio Echo Cancellation Component
    "{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
    "{C3B6AEB1-390C-4792-8677-CD87F8B2C959}" = HP Deskjet F4200 All-In-One Driver Software 11.0 Rel .3
    "{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
    "{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
    "{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
    "{DF821FC5-C198-452B-A0D4-82433EFEAE9B}" = OneCare Advisor (Windows Live Toolbar)
    "{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
    "{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
    "{EA516024-D84D-41F1-814F-83175A6188F2}" = Logitech Video Enumerator
    "{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
    "{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
    "{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
    "{F5AF5CDA-76FC-4794-9F28-09B6D54E7431}" = Form Fill (Windows Live Toolbar)
    "{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
    "{F8A5531E-FEB4-4F7C-AF51-342E40FA7A0D}" = F4200_Help
    "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
    "Adobe Acrobat 4.0" = Adobe Acrobat 4.0
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "AIMars" = Kidz Cam Photo Editing Software
    "Ares" = Ares 2.1.1
    "Blaze Video Magic_is1" = Blaze Video Magic 2.0
    "com.adobe.amp.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Media Player
    "Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
    "Disney Toontown Online" = Disney Toontown Online
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "ie7" = Windows Internet Explorer 7
    "ie8" = Windows Internet Explorer 8
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
    "Messenger Plus! Live" = Messenger Plus! Live
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft Security Client" = Microsoft Security Essentials
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "MSNINST" = MSN
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "NVIDIA Drivers" = NVIDIA Drivers
    "QuicktimeAlt_is1" = QuickTime Alternative 1.44
    "RealPlayer 12.0" = RealPlayer
    "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    "Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WinLiveSuite_Wave3" = Windows Live Essentials
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "Yahoo! Extras" = Yahoo! Browser Services
    "Yahoo! Mail" = Yahoo! Internet Mail
    "Yahoo! Messenger" = Yahoo! Messenger
    "YInstHelper" = Yahoo! Install Manager

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 1/3/2012 11:23:57 PM | Computer Name = YOUR-EF9D1E1329 | Source = Application Error | ID = 1000
    Description = Faulting application wlxphotogallery.exe, version 14.0.8117.416, faulting
    module coreaudiotoolbox.dll, version 7.9.3.0, fault address 0x00273bd9.

    Error - 1/10/2012 3:07:37 PM | Computer Name = YOUR-EF9D1E1329 | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 1/10/2012 10:37:57 PM | Computer Name = YOUR-EF9D1E1329 | Source = MPSampleSubmission | ID = 5000
    Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 3.0.8402.0,
    P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
    P8 NIL, P9 NIL, P10 NIL.

    Error - 1/10/2012 10:43:52 PM | Computer Name = YOUR-EF9D1E1329 | Source = Application Error | ID = 1000
    Description = Faulting application sdupdate.exe, version 1.6.0.12, faulting module
    kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

    Error - 1/10/2012 10:44:26 PM | Computer Name = YOUR-EF9D1E1329 | Source = Application Error | ID = 1000
    Description = Faulting application sdupdate.exe, version 1.6.0.12, faulting module
    kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

    Error - 1/10/2012 10:44:29 PM | Computer Name = YOUR-EF9D1E1329 | Source = Application Error | ID = 1001
    Description = Fault bucket 1228891604.

    Error - 1/10/2012 10:49:17 PM | Computer Name = YOUR-EF9D1E1329 | Source = MPSampleSubmission | ID = 5000
    Description = EventType avsubmit, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
    P2 1.1.7903.0, P3 1.117.2549.0, P4 1.117.2549.0, P5 20014db339ac731d_23e3cd005bae5141a8fddfb11b89d7590fc6b097,
    P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

    Error - 1/11/2012 12:20:39 AM | Computer Name = YOUR-EF9D1E1329 | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: The server name or address could not be resolved

    [ System Events ]
    Error - 1/11/2012 7:56:55 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7000
    Description = The Media Center Scheduler Service service failed to start due to
    the following error: %%1053

    Error - 1/11/2012 7:56:55 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7023
    Description = The Intel USB3 Device Service service terminated with the following
    error: %%126

    Error - 1/11/2012 7:56:55 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7000
    Description = The LVSrvLauncher service failed to start due to the following error:
    %%2

    Error - 1/11/2012 7:56:58 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p
    asc3550
    cbidf
    cd20xrnt
    CmdIde
    Cpqarray
    dac2w2k
    dac960nt
    dpti2o
    hpn
    i2omp
    iaStor
    ini910u
    IntelIde
    mraid35x
    perc2
    perc2hib
    ql1080
    Ql10wnt
    ql12160
    ql1240
    ql1280
    sisagp
    Sparrow
    symc810
    symc8xx
    sym_hi
    sym_u3
    TosIde
    ultra
    viaagp
    ViaIde

    Error - 1/11/2012 10:52:11 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7034
    Description = The Process Monitor service terminated unexpectedly. It has done
    this 1 time(s).

    Error - 1/11/2012 11:32:43 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Media Center Receiver
    Service service to connect.

    Error - 1/11/2012 11:32:43 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Media Center Scheduler
    Service service to connect.

    Error - 1/11/2012 11:32:43 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7000
    Description = The Media Center Scheduler Service service failed to start due to
    the following error: %%1053

    Error - 1/11/2012 11:32:43 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7023
    Description = The Intel USB3 Device Service service terminated with the following
    error: %%126

    Error - 1/11/2012 11:32:43 PM | Computer Name = YOUR-EF9D1E1329 | Source = Service Control Manager | ID = 7000
    Description = The LVSrvLauncher service failed to start due to the following error:
    %%2


    < End of report >
    Paquirris, Jan 11, 2012
    #19

  20. Broni Malware Annihilator

    Good news :)

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - No CLSID value found.
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll File not found
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O2 - BHO: (Superfiles Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Superfiles Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKU\S-1-5-21-3487969574-3620517906-821581102-1006\..\Toolbar\WebBrowser: (Superfiles Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O4 - HKLM..\Run: [JIHYyTpFFCbPF.exe] C:\Documents and Settings\All Users\Application Data\JIHYyTpFFCbPF.exe File not found
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm File not found
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx File not found
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
[2011/11/18 21:51:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Abby\Application Data\24C37
[2011/11/18 21:51:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Abby\Application Data\37EE8
[2008/08/14 15:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\iWin
[2011/11/19 02:10:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\24C37
[2008/08/14 14:44:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\iWin
[2011/11/18 21:17:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\K88fRRZ9hTXwUVl
[2011/11/18 21:17:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\vJJ6dEK8gR
[2011/11/18 21:17:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Liset\Application Data\WVVeelOOBtP0

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ==============================================================

    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Do NOT post JavaRa log.

    ==============================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

    2. Please download Farbar Service Scanner and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.


    3. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    4. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
    Broni, Jan 11, 2012
    #20
Page 1 of 2