TechSpot

Virus redirects Google search results, please help

Solved
By Scathez
Sep 8, 2011
  1. When I click on a Google search result, one in about 3-6 clicks will be redirected to various sites offering stuff for me to buy. It used to be that every single Google search result click was redirected, but after battling this issue with various anti-viruses and malware removal tools, I was able to minimize, yet not completely, eliminate this issue. I am appealing to you, the techspot community, to please help me.
     
  2. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    Malwarebytes' Anti-Malware 1.51.1.1800
    www.malwarebytes.org

    Database version: 7680

    Windows 6.0.6001 Service Pack 1
    Internet Explorer 7.0.6001.18000

    9/8/2011 7:38:12 PM
    mbam-log-2011-09-08 (19-38-12).txt

    Scan type: Quick scan
    Objects scanned: 171094
    Time elapsed: 4 minute(s), 29 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2011-09-08 20:51:49
    Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD12 rev.01.0
    Running: w4cuxfll.exe; Driver: C:\Users\Victor\AppData\Local\Temp\ufdiakow.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_27
    Run by Victor at 20:53:39 on 2011-09-08
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.1948 [GMT -4:00]
    .
    AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\conime.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.yahoo.com/
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
    BHO: {01c7cf0f-dc08-4458-b8c6-82bfd7319b5a} - c:\windows\system32\wscui32.dll
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
    mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
    mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVXV1UtV0JEWEMtVllGTjMtUURKTUgtNDJBT0EtSzZIVTk"&"inst=NzctNzE2NjkxOTk2LVNUMTJGT0krMS1ERFQrMC1FVUxBKzEtU1QxMkZBUFArMQ"&"prod=90"&"ver=2012.0.1796"&"mid=90677aaece9047d1934f13f94988ffe0-9581dd74e5f78007af15c41a9f2b377b615911ad
    dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    dPolicies-explorer: HideSCAHealth = 1 (0x1)
    IE: E&xport to Microsoft Excel
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A} : NameServer = 192.168.1.1
    TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A} : DhcpNameServer = 192.168.1.1
    Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\victor\appdata\roaming\mozilla\firefox\profiles\g349ce76.default\
    FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-9-8 136360]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-9-8 269480]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-9-8 66616]
    R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2010-1-30 12672]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-26 366640]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-26 22712]
    S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2006-11-2 9216]
    S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-20 16896]
    S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2008-1-20 19968]
    S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
    S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
    S4 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-3-2 1153368]
    .
    =============== Created Last 30 ================
    .
    2011-09-08 22:43:52 -------- d-----w- c:\users\victor\appdata\roaming\Avira
    2011-09-08 22:40:44 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-09-08 22:40:43 -------- d-----w- c:\programdata\Avira
    2011-09-08 22:38:58 -------- d-----w- c:\program files\Avira
    2011-09-08 22:23:19 332 ----a-w- C:\Start_.cmd
    2011-09-08 22:23:19 -------- d-----w- C:\ComboFix
    2011-09-08 20:28:04 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-09-07 02:23:40 -------- d-----w- c:\users\victor\appdata\roaming\Foxit Software
    2011-09-07 02:22:36 72960 ----a-w- c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
    2011-09-07 02:22:21 -------- d-----w- c:\program files\Foxit Software
    2011-09-07 02:21:24 -------- d-----w- c:\users\victor\appdata\local\COMODO
    2011-09-07 00:04:14 -------- d--h--w- C:\VritualRoot
    2011-09-07 00:03:34 467168 ----a-w- c:\windows\system32\drivers\sfi.dat
    2011-09-06 23:54:59 -------- d-----w- c:\programdata\Comodo
    2011-09-06 23:54:54 1700352 ----a-w- c:\windows\system32\gdiplus.dll
    2011-09-06 23:01:47 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-09-06 22:23:05 -------- d-----w- c:\windows\system32\catroot2
    2011-09-06 18:36:12 -------- d-----w- c:\users\victor\appdata\local\temp
    2011-09-06 18:29:50 -------- d-----w- C:\$RECYCLE.BIN
    2011-09-06 18:16:16 -------- d-----w- C:\Combo-Fix
    2011-09-06 16:53:03 -------- d-----w- c:\users\victor\appdata\roaming\AVG2012
    2011-09-06 16:43:16 0 ---ha-w- c:\windows\mmoewlmwpi.tmp
    2011-09-06 16:33:31 -------- d-----w- c:\program files\AVG
    2011-09-06 14:08:43 98816 ----a-w- c:\windows\sed.exe
    2011-09-06 14:08:43 518144 ----a-w- c:\windows\SWREG.exe
    2011-09-06 14:08:43 256000 ----a-w- c:\windows\PEV.exe
    2011-09-06 14:08:43 208896 ----a-w- c:\windows\MBR.exe
    2011-09-06 14:05:24 -------- d--h--w- c:\programdata\Common Files
    2011-09-06 14:00:09 -------- d-----w- c:\programdata\MFAData
    2011-09-06 12:18:20 0 ---ha-w- c:\windows\system32\mmoewlmwpi.tmp
    2011-09-06 11:22:06 240128 ----a-w- c:\windows\system32\wscui32.dll
    2011-09-06 00:04:05 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
    2011-09-06 00:04:04 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
    2011-09-06 00:03:56 -------- d-----w- c:\programdata\EPSON
    2011-09-05 03:42:56 -------- d-----w- c:\users\victor\riotsGamesLogs
    2011-09-02 00:52:14 -------- d-----w- c:\windows\system32\CSP
    2011-09-02 00:22:56 -------- d-----w- c:\users\victor\fontconfig
    2011-09-02 00:17:01 -------- d-----w- c:\users\victor\.smplayer
    2011-09-01 19:22:01 -------- d-----w- c:\program files\Microsoft ActiveSync
    2011-09-01 19:20:06 -------- d-----w- c:\program files\common files\L&H
    2011-09-01 16:59:39 -------- d-----w- c:\users\victor\Cisco Packet Tracer 5.3.2
    2011-09-01 15:59:08 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
    2011-09-01 02:19:53 -------- d-----w- c:\users\victor\appdata\local\Microsoft Help
    2011-08-31 12:51:00 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
    2011-08-27 16:50:47 -------- d-----w- C:\Dls
    2011-08-27 16:47:59 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2011-08-27 16:47:58 -------- d-----w- c:\users\victor\appdata\local\Conduit
    2011-08-27 16:47:50 -------- d-----w- c:\program files\uTorrent
    2011-08-27 16:47:15 -------- d-----w- c:\users\victor\appdata\roaming\uTorrent
    2011-08-27 16:47:15 -------- d-----w- c:\users\victor\appdata\local\uTorrent
    2011-08-27 11:58:37 -------- d-----w- c:\program files\RegClean 5.9 English
    2011-08-27 11:50:37 -------- d-----w- c:\program files\CCleaner
    2011-08-27 04:21:36 -------- d-----w- c:\users\victor\appdata\roaming\SUPERAntiSpyware.com
    2011-08-27 04:01:56 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-08-27 03:33:11 -------- d-----w- c:\users\victor\appdata\roaming\Malwarebytes
    2011-08-27 03:32:59 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-08-27 03:32:58 -------- d-----w- c:\programdata\Malwarebytes
    2011-08-27 03:32:53 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-27 03:32:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    .
    ==================== Find3M ====================
    .
    2011-09-08 21:13:28 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
    .
    ============= FINISH: 20:54:14.71 ===============

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 7/2/2008 3:52:07 AM
    System Uptime: 9/8/2011 7:29:20 PM (1 hours ago)
    .
    Motherboard: Quanta | | 30D2
    Processor: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz | U2E1 | 2000/667mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 100 GiB total, 10.085 GiB free.
    D: is FIXED (NTFS) - 12 GiB total, 1.995 GiB free.
    E: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Realtek RTL8101E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
    Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_30CC103C&REV_01\4&2EE70BA2&0&00E5
    Manufacturer: Realtek
    Name: Realtek RTL8101E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
    PNP Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_30CC103C&REV_01\4&2EE70BA2&0&00E5
    Service: RTL8169
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Cisco Systems VPN Adapter
    Device ID: ROOT\NET\0000
    Manufacturer: Cisco Systems
    Name: Cisco Systems VPN Adapter
    PNP Device ID: ROOT\NET\0000
    Service: CVirtA
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Installed Programs ======================
    .
    µTorrent
    Adobe Flash Player 10 Plugin
    Adobe Shockwave Player
    Adobe Shockwave Player 11
    AuthenTec Fingerprint Sensor Minimum Install
    Avira AntiVir Personal - Free Antivirus
    CCleaner
    Cisco Packet Tracer 5.3.2
    Cisco Systems VPN Client 5.0.00.0340
    CoreAVC Professional Edition (remove only)
    CPUID CPU-Z 1.53.1
    DigitalPersona Personal 3.0.0
    DVD Suite
    EPSON WorkForce 610 Series Printer Uninstall
    Foxit Phantom
    Google Chrome
    Google Update Helper
    Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
    Hewlett-Packard Active Check
    Hewlett-Packard Asset Agent for Health Check
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Active Support Library
    HP Product Detection
    HP Quick Launch Buttons 6.30 E1
    HP QuickPlay 3.6
    HP QuickTouch 1.00 C4
    HP Total Care Advisor
    HP Wireless Assistant
    HPNetworkAssistant
    Intel® Matrix Storage Manager
    Java Auto Updater
    Java(TM) 6 Update 26
    Java(TM) 6 Update 27
    K-Lite Codec Pack 4.5.3 (Standard)
    League of Legends
    Malwarebytes' Anti-Malware version 1.51.1.1800
    Microsoft .NET Framework 3.5 SP1
    Microsoft Money 98
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office XP Professional with FrontPage
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Motorola SM56 Data Fax Modem
    Mozilla Firefox 6.0.2 (x86 en-US)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB941833)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MV RegClean 5.9 English
    NVIDIA Display Control Panel
    NVIDIA Drivers
    Power2Go
    Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
    Realtek High Definition Audio Driver
    Revo Uninstaller 1.75
    RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
    Skype™ 5.0
    Spybot - Search & Destroy
    Synaptics Pointing Device Driver
    TuneUp Utilities 2007
    VBA (2627.01)
    VLC media player 1.1.0
    WeatherBug Gadget
    WinRAR archiver
    .
    ==== Event Viewer Messages From Past Week ========
    .
    9/8/2011 7:31:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    9/8/2011 6:46:16 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: The system cannot find the path specified.
    9/8/2011 6:46:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "3" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
    9/8/2011 11:24:34 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the stisvc service.
    9/7/2011 2:06:29 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
    9/6/2011 9:31:31 AM, Error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).
    9/6/2011 9:28:17 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    9/6/2011 9:25:00 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    9/6/2011 6:13:25 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
    9/6/2011 5:36:01 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
    9/6/2011 2:36:58 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
    9/6/2011 2:13:53 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    9/6/2011 12:57:18 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgtdix
    9/6/2011 12:34:23 PM, Error: Service Control Manager [7000] - The AVG TDI Driver service failed to start due to the following error: The system cannot find the file specified.
    9/6/2011 12:32:43 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    9/6/2011 12:32:24 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    9/6/2011 12:31:20 AM, Error: EventLog [6008] - The previous system shutdown at 12:27:14 AM on 9/6/2011 was unexpected.
    9/6/2011 12:06:47 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
    9/6/2011 12:06:47 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
    9/6/2011 12:06:39 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: epfwtdir
    9/6/2011 12:06:39 PM, Error: Service Control Manager [7000] - The RMCAST (Pgm) Protocol Driver service failed to start due to the following error: The system cannot find the path specified.
    9/6/2011 10:46:49 AM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC easdrv epfwtdir NetBIOS netbt nsiproxy PSched RasAcd rdbss SASDIFSV SASKUTIL Smb spldr tdx Wanarpv6
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    9/6/2011 10:45:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    9/6/2011 10:45:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    9/6/2011 10:41:43 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
    9/6/2011 10:41:41 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    9/6/2011 10:41:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    9/6/2011 10:41:30 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    9/6/2011 10:41:22 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    9/6/2011 10:13:03 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    9/6/2011 10:09:30 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
    9/6/2011 10:09:30 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/6/2011 10:09:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    9/6/2011 1:38:32 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service.
    9/6/2011 1:20:23 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: The system cannot find the file specified.
    9/6/2011 1:20:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "2" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
    9/6/2011 1:19:06 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: Access is denied.
    9/6/2011 1:09:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    9/6/2011 1:03:26 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 Avgtdix SASDIFSV SASKUTIL spldr Wanarpv6
    9/3/2011 8:43:49 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Eset Nod32 Boot service to connect.
    9/3/2011 8:43:49 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    9/3/2011 8:43:49 AM, Error: Service Control Manager [7000] - The Eset Nod32 Boot service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/1/2011 3:24:54 PM, Error: Service Control Manager [7030] - The Machine Debug Manager service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    9/1/2011 2:35:50 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the service.
    9/1/2011 12:55:01 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.11 for the Network Card with network address 00215C05D355 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
    .
    ==== End Of File ===========================
     
  3. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==================================================================

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan:
    [​IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [​IMG]

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    =================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  4. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    Broni, thank you for your time; I appreciate your help greatly. I have done as instructed, and here are the logs:

    =================================================================

    aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
    Run date: 2011-09-09 00:21:07
    -----------------------------
    00:21:07.859 OS Version: Windows 6.0.6001 Service Pack 1
    00:21:07.859 Number of processors: 2 586 0xF0D
    00:21:07.860 ComputerName: VICTOR-LAPPY UserName: Victor
    00:21:08.571 Initialize success
    00:21:53.831 AVAST engine defs: 11090802
    00:22:46.095 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
    00:22:46.098 Disk 0 Vendor: WDC_WD12 01.0 Size: 114473MB BusType: 3
    00:22:46.152 Disk 0 MBR read successfully
    00:22:46.154 Disk 0 MBR scan
    00:22:46.161 Disk 0 unknown MBR code
    00:22:46.167 Disk 0 scanning sectors +234436545
    00:22:46.233 Disk 0 scanning C:\Windows\system32\drivers
    00:22:54.857 Service scanning
    00:22:56.075 Modules scanning
    00:23:00.821 Disk 0 trace - called modules:
    00:23:00.926 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
    00:23:00.930 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861150a0]
    00:23:00.934 3 CLASSPNP.SYS[8a5a9745] -> nt!IofCallDriver -> [0x8513e900]
    00:23:01.263 5 acpi.sys[8069b6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x85149028]
    00:23:02.886 AVAST engine scan C:\Windows
    00:23:05.767 AVAST engine scan C:\Windows\system32
    00:24:53.202 AVAST engine scan C:\Windows\system32\drivers
    00:25:02.074 AVAST engine scan C:\Users\Victor
    00:28:44.729 AVAST engine scan C:\ProgramData
    00:29:13.232 Scan finished successfully
    00:34:02.256 Disk 0 MBR has been saved successfully to "C:\Users\Victor\Desktop\Redirect POS\MBR.dat"
    00:34:02.261 The log file has been saved successfully to "C:\Users\Victor\Desktop\Redirect POS\aswMBR.txt"

    ComboFix 11-09-09.01 - Victor 09/09/2011 0:38.2.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.2014 [GMT -4:00]
    Running from: c:\users\Victor\Desktop\ComboFix.exe
    AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
    SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\chrome.manifest
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\chrome\xulcache.jar
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\defaults\preferences\xulcache.js
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\install.rdf
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\chrome.manifest
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\chrome\xulcache.jar
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\defaults\preferences\xulcache.js
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\install.rdf
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\chrome.manifest
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\chrome\xulcache.jar
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\defaults\preferences\xulcache.js
    c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\install.rdf
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
    .
    .
    2011-09-09 04:43 . 2011-09-09 04:43 -------- d-----w- c:\users\Victor\AppData\Local\temp
    2011-09-09 04:43 . 2011-09-09 04:43 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-09-08 22:43 . 2011-09-08 22:43 -------- d-----w- c:\users\Victor\AppData\Roaming\Avira
    2011-09-08 22:40 . 2011-07-21 16:15 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-09-08 22:40 . 2011-07-21 16:15 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-09-08 22:40 . 2011-09-08 22:40 -------- d-----w- c:\programdata\Avira
    2011-09-08 22:38 . 2011-09-08 22:44 -------- d-----w- c:\program files\Avira
    2011-09-08 20:28 . 2011-09-08 20:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-09-07 02:23 . 2011-09-07 02:23 -------- d-----w- c:\users\Victor\AppData\Roaming\Foxit Software
    2011-09-06 22:23 . 2011-09-06 22:26 -------- d-----w- c:\windows\system32\catroot2
    2011-09-06 18:16 . 2011-09-06 18:37 -------- d-----w- C:\Combo-Fix
    2011-09-06 16:53 . 2011-09-07 00:21 -------- d-----w- c:\users\Victor\AppData\Roaming\AVG2012
    2011-09-06 16:43 . 2011-09-06 16:43 0 ---ha-w- c:\windows\mmoewlmwpi.tmp
    2011-09-06 16:33 . 2011-09-06 16:33 -------- d-----w- c:\program files\AVG
    2011-09-06 14:05 . 2011-09-06 14:05 -------- d--h--w- c:\programdata\Common Files
    2011-09-06 14:00 . 2011-09-07 00:18 -------- d-----w- c:\programdata\MFAData
    2011-09-06 12:18 . 2011-09-06 12:18 0 ---ha-w- c:\windows\system32\mmoewlmwpi.tmp
    2011-09-06 11:22 . 2011-09-06 11:22 240128 ----a-w- c:\windows\system32\wscui32.dll
    2011-09-06 00:04 . 2008-11-12 07:00 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
    2011-09-06 00:04 . 2008-11-12 07:00 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
    2011-09-06 00:03 . 2011-09-06 00:04 -------- d-----w- c:\programdata\EPSON
    2011-09-05 03:42 . 2011-09-09 02:17 -------- d-----w- c:\users\Victor\riotsGamesLogs
    2011-09-02 00:52 . 2011-09-02 00:52 -------- d-----w- c:\windows\system32\CSP
    2011-09-02 00:22 . 2011-09-02 00:22 -------- d-----w- c:\users\Victor\fontconfig
    2011-09-02 00:17 . 2011-09-04 17:01 -------- d-----w- c:\users\Victor\.smplayer
    2011-09-01 19:22 . 2011-09-01 19:22 -------- d-----w- c:\program files\Microsoft ActiveSync
    2011-09-01 19:20 . 2011-09-01 19:20 -------- d-----w- c:\program files\Common Files\L&H
    2011-09-01 16:59 . 2011-09-01 17:00 -------- d-----w- c:\users\Victor\Cisco Packet Tracer 5.3.2
    2011-09-01 15:59 . 2011-09-01 16:00 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
    2011-09-01 03:09 . 2011-09-01 03:09 -------- d-----w- c:\users\Public\CyberLink
    2011-09-01 02:19 . 2011-09-01 02:19 -------- d-----w- c:\users\Victor\AppData\Local\Microsoft Help
    2011-08-31 12:51 . 2011-08-31 12:51 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
    2011-08-27 16:50 . 2011-09-08 18:32 -------- d-----w- C:\Dls
    2011-08-27 16:47 . 2011-08-27 16:47 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2011-08-27 16:47 . 2011-08-31 13:55 -------- d-----w- c:\users\Victor\AppData\Local\Conduit
    2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\program files\uTorrent
    2011-08-27 16:47 . 2011-09-09 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\uTorrent
    2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\users\Victor\AppData\Local\uTorrent
    2011-08-27 11:58 . 2011-09-08 22:42 -------- d-----w- c:\program files\RegClean 5.9 English
    2011-08-27 11:50 . 2011-08-27 11:50 -------- d-----w- c:\program files\CCleaner
    2011-08-27 04:21 . 2011-08-27 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\SUPERAntiSpyware.com
    2011-08-27 04:01 . 2011-08-27 04:01 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-08-27 03:33 . 2011-08-27 03:33 -------- d-----w- c:\users\Victor\AppData\Roaming\Malwarebytes
    2011-08-27 03:32 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-08-27 03:32 . 2011-08-27 03:32 -------- d-----w- c:\programdata\Malwarebytes
    2011-08-27 03:32 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-27 03:32 . 2011-08-27 03:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-08-26 23:23 . 2011-08-26 23:23 -------- d-----w- c:\users\Victor\AppData\Roaming\dvdcss
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-08 21:13 . 2008-01-21 02:24 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
    2011-09-03 06:01 . 2011-09-06 22:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01C7CF0F-DC08-4458-B8C6-82BFD7319B5a}]
    2011-09-06 11:22 240128 ----a-w- c:\windows\System32\wscui32.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
    "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVXV1UtV0JEWEMtVllGTjMtUURKTUgtNDJBT0EtSzZIVTk&inst=NzctNzE2NjkxOTk2LVNUMTJGT0krMS1ERFQrMC1FVUxBKzEtU1QxMkZBUFArMQ&prod=90&ver=2012.0.1796&mid=90677aaece9047d1934f13f94988ffe0-9581dd74e5f78007af15c41a9f2b377b615911ad" [?]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-11-02 8704]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "HideSCAHealth"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "DpAgent"=c:\program files\DigitalPersona\Bin\dpagent.exe
    "SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
    "OnScreenDisplay"=c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    "RtHDVCpl"=RtHDVCpl.exe
    "WAWifiMessage"=c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
    "EnableNotificationsRef"=dword:00000003
    .
    R2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2006-11-02 9216]
    R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
    R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2008-01-21 19968]
    R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
    R4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
    R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - ASWMBR
    *NewlyCreated* - SSMDRV
    *Deregistered* - aswMBR
    *Deregistered* - ufdiakow
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-09-02 c:\windows\Tasks\1-Click Maintenance.job
    - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-03 03:35]
    .
    2011-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
    .
    2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
    IE: E&xport to Microsoft Excel
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\
    .
    - - - - ORPHANS REMOVED - - - -
    .
    ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
    Notify-!SASWinLogon - c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    SafeBoot-04906191.sys
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-09 00:43
    Windows 6.0.6001 Service Pack 1 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    Completion time: 2011-09-09 00:45:43
    ComboFix-quarantined-files.txt 2011-09-09 04:45
    .
    Pre-Run: 11,091,349,504 bytes free
    Post-Run: 11,194,482,688 bytes free
    .
    - - End Of File - - 4DAF2080845F89CA93E2AD8FC3C21EFE
     
  5. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    How is redirection?

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box
    • Click OK
    Windows Vista/7 users: click Start, in "Start search" type notepad and press Enter.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\windows\mmoewlmwpi.tmp
    c:\windows\system32\mmoewlmwpi.tmp
    
    
    Folder::
    c:\users\Victor\AppData\Roaming\AVG2012
    c:\program files\AVG
    
    
    Driver::
    NOD32FiXTemDono
    
    
    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "AvgUninstallURL"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000000
    
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  6. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    Thank you for your assitance thus far, but unfortunately the redirects still occur. They are happening much less frequently now at a rate of about 1 redirect in every 20 clicks. The sites that I am redirected to look identical, although their URLs differ. xpertsuppliers d0t c0m and informationgetter d0t c0m are some of the examples.

    ===================================================================

    ComboFix 11-09-09.03 - Victor 09/09/2011 9:31.5.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.2084 [GMT -4:00]
    Running from: c:\users\Victor\Desktop\ComboFix.exe
    Command switches used :: c:\users\Victor\Desktop\CFScript.txt
    AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
    SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    FILE ::
    "c:\windows\mmoewlmwpi.tmp"
    "c:\windows\system32\mmoewlmwpi.tmp"
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
    .
    .
    2011-09-09 13:35 . 2011-09-09 13:35 -------- d-----w- c:\users\Victor\AppData\Local\temp
    2011-09-09 13:35 . 2011-09-09 13:35 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-09-08 22:43 . 2011-09-08 22:43 -------- d-----w- c:\users\Victor\AppData\Roaming\Avira
    2011-09-08 22:40 . 2011-07-21 16:15 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-09-08 22:40 . 2011-07-21 16:15 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-09-08 22:40 . 2011-09-08 22:40 -------- d-----w- c:\programdata\Avira
    2011-09-08 22:38 . 2011-09-08 22:44 -------- d-----w- c:\program files\Avira
    2011-09-08 20:28 . 2011-09-08 20:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-09-07 02:23 . 2011-09-07 02:23 -------- d-----w- c:\users\Victor\AppData\Roaming\Foxit Software
    2011-09-06 22:23 . 2011-09-06 22:26 -------- d-----w- c:\windows\system32\catroot2
    2011-09-06 18:16 . 2011-09-06 18:37 -------- d-----w- C:\Combo-Fix
    2011-09-06 14:05 . 2011-09-06 14:05 -------- d--h--w- c:\programdata\Common Files
    2011-09-06 14:00 . 2011-09-07 00:18 -------- d-----w- c:\programdata\MFAData
    2011-09-06 11:22 . 2011-09-06 11:22 240128 ----a-w- c:\windows\system32\wscui32.dll
    2011-09-06 00:04 . 2008-11-12 07:00 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
    2011-09-06 00:04 . 2008-11-12 07:00 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
    2011-09-06 00:03 . 2011-09-06 00:04 -------- d-----w- c:\programdata\EPSON
    2011-09-05 03:42 . 2011-09-09 02:17 -------- d-----w- c:\users\Victor\riotsGamesLogs
    2011-09-02 00:52 . 2011-09-02 00:52 -------- d-----w- c:\windows\system32\CSP
    2011-09-02 00:22 . 2011-09-02 00:22 -------- d-----w- c:\users\Victor\fontconfig
    2011-09-02 00:17 . 2011-09-04 17:01 -------- d-----w- c:\users\Victor\.smplayer
    2011-09-01 19:22 . 2011-09-01 19:22 -------- d-----w- c:\program files\Microsoft ActiveSync
    2011-09-01 19:20 . 2011-09-01 19:20 -------- d-----w- c:\program files\Common Files\L&H
    2011-09-01 16:59 . 2011-09-01 17:00 -------- d-----w- c:\users\Victor\Cisco Packet Tracer 5.3.2
    2011-09-01 15:59 . 2011-09-01 16:00 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
    2011-09-01 03:09 . 2011-09-01 03:09 -------- d-----w- c:\users\Public\CyberLink
    2011-09-01 02:19 . 2011-09-01 02:19 -------- d-----w- c:\users\Victor\AppData\Local\Microsoft Help
    2011-08-31 12:51 . 2011-08-31 12:51 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
    2011-08-27 16:50 . 2011-09-08 18:32 -------- d-----w- C:\Dls
    2011-08-27 16:47 . 2011-08-27 16:47 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2011-08-27 16:47 . 2011-08-31 13:55 -------- d-----w- c:\users\Victor\AppData\Local\Conduit
    2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\program files\uTorrent
    2011-08-27 16:47 . 2011-09-09 12:58 -------- d-----w- c:\users\Victor\AppData\Roaming\uTorrent
    2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\users\Victor\AppData\Local\uTorrent
    2011-08-27 11:58 . 2011-09-08 22:42 -------- d-----w- c:\program files\RegClean 5.9 English
    2011-08-27 11:50 . 2011-08-27 11:50 -------- d-----w- c:\program files\CCleaner
    2011-08-27 04:21 . 2011-08-27 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\SUPERAntiSpyware.com
    2011-08-27 04:01 . 2011-08-27 04:01 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-08-27 03:33 . 2011-08-27 03:33 -------- d-----w- c:\users\Victor\AppData\Roaming\Malwarebytes
    2011-08-27 03:32 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-08-27 03:32 . 2011-08-27 03:32 -------- d-----w- c:\programdata\Malwarebytes
    2011-08-27 03:32 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-27 03:32 . 2011-08-27 03:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-08-26 23:23 . 2011-08-26 23:23 -------- d-----w- c:\users\Victor\AppData\Roaming\dvdcss
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-08 21:13 . 2008-01-21 02:24 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
    2011-09-03 06:01 . 2011-09-06 22:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01C7CF0F-DC08-4458-B8C6-82BFD7319B5a}]
    2011-09-06 11:22 240128 ----a-w- c:\windows\System32\wscui32.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
    "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-11-02 8704]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "HideSCAHealth"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "DpAgent"=c:\program files\DigitalPersona\Bin\dpagent.exe
    "SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
    "OnScreenDisplay"=c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    "RtHDVCpl"=RtHDVCpl.exe
    "WAWifiMessage"=c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
    "EnableNotificationsRef"=dword:00000003
    .
    R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
    R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2008-01-21 19968]
    R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
    R4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
    R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
    .
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-09-02 c:\windows\Tasks\1-Click Maintenance.job
    - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-03 03:35]
    .
    2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
    .
    2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
    IE: E&xport to Microsoft Excel
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-09 09:35
    Windows 6.0.6001 Service Pack 1 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    Completion time: 2011-09-09 09:37:30
    ComboFix-quarantined-files.txt 2011-09-09 13:37
    ComboFix2.txt 2011-09-09 13:28
    .
    Pre-Run: 11,245,846,528 bytes free
    Post-Run: 11,202,617,344 bytes free
    .
    - - End Of File - - 5F5CA3098020F08141D0887F458EDAA6
     
  7. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    Regarding the websites that I get redirected too, they are actually quite different, and depend on my original search keywords.
     
  8. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    Which browser is affected?

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  9. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    2011/09/09 23:07:59.0926 4056 TDSS rootkit removing tool 2.5.20.0 Sep 7 2011 16:44:34
    2011/09/09 23:08:00.0160 4056 ================================================================================
    2011/09/09 23:08:00.0160 4056 SystemInfo:
    2011/09/09 23:08:00.0160 4056
    2011/09/09 23:08:00.0160 4056 OS Version: 6.0.6001 ServicePack: 1.0
    2011/09/09 23:08:00.0160 4056 Product type: Workstation
    2011/09/09 23:08:00.0160 4056 ComputerName: VICTOR-LAPPY
    2011/09/09 23:08:00.0160 4056 UserName: Victor
    2011/09/09 23:08:00.0160 4056 Windows directory: C:\Windows
    2011/09/09 23:08:00.0160 4056 System windows directory: C:\Windows
    2011/09/09 23:08:00.0160 4056 Processor architecture: Intel x86
    2011/09/09 23:08:00.0160 4056 Number of processors: 2
    2011/09/09 23:08:00.0160 4056 Page size: 0x1000
    2011/09/09 23:08:00.0160 4056 Boot type: Normal boot
    2011/09/09 23:08:00.0160 4056 ================================================================================
    2011/09/09 23:08:00.0550 4056 Initialize success
    2011/09/09 23:08:05.0542 3844 ================================================================================
    2011/09/09 23:08:05.0542 3844 Scan started
    2011/09/09 23:08:05.0542 3844 Mode: Manual;
    2011/09/09 23:08:05.0542 3844 ================================================================================
    2011/09/09 23:08:05.0994 3844 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
    2011/09/09 23:08:06.0088 3844 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
    2011/09/09 23:08:06.0134 3844 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
    2011/09/09 23:08:06.0181 3844 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
    2011/09/09 23:08:06.0228 3844 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
    2011/09/09 23:08:06.0306 3844 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
    2011/09/09 23:08:06.0368 3844 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
    2011/09/09 23:08:06.0415 3844 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
    2011/09/09 23:08:06.0446 3844 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
    2011/09/09 23:08:06.0493 3844 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
    2011/09/09 23:08:06.0524 3844 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
    2011/09/09 23:08:06.0571 3844 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
    2011/09/09 23:08:06.0602 3844 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
    2011/09/09 23:08:06.0696 3844 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
    2011/09/09 23:08:06.0743 3844 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
    2011/09/09 23:08:06.0805 3844 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
    2011/09/09 23:08:06.0836 3844 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
    2011/09/09 23:08:06.0899 3844 ATSWPDRV (69e65a2ce11619f0c868967ca9540b80) C:\Windows\system32\DRIVERS\ATSwpDrv.sys
    2011/09/09 23:08:06.0992 3844 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
    2011/09/09 23:08:07.0039 3844 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
    2011/09/09 23:08:07.0133 3844 BCM43XV (cf6a67c90951e3e763d2135dede44b85) C:\Windows\system32\DRIVERS\bcmwl6.sys
    2011/09/09 23:08:07.0195 3844 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
    2011/09/09 23:08:07.0258 3844 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
    2011/09/09 23:08:07.0304 3844 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
    2011/09/09 23:08:07.0351 3844 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
    2011/09/09 23:08:07.0382 3844 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
    2011/09/09 23:08:07.0429 3844 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
    2011/09/09 23:08:07.0460 3844 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
    2011/09/09 23:08:07.0492 3844 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
    2011/09/09 23:08:07.0538 3844 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
    2011/09/09 23:08:07.0570 3844 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
    2011/09/09 23:08:07.0726 3844 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
    2011/09/09 23:08:07.0757 3844 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
    2011/09/09 23:08:07.0804 3844 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
    2011/09/09 23:08:07.0850 3844 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
    2011/09/09 23:08:07.0913 3844 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
    2011/09/09 23:08:07.0944 3844 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
    2011/09/09 23:08:08.0006 3844 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
    2011/09/09 23:08:08.0084 3844 cpuz132 (097a0a4899b759a4f032bd464963b4be) C:\Windows\system32\drivers\cpuz132_x32.sys
    2011/09/09 23:08:08.0100 3844 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
    2011/09/09 23:08:08.0131 3844 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
    2011/09/09 23:08:08.0225 3844 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
    2011/09/09 23:08:08.0303 3844 CVPNDRVA (1c2999966f0f36aa44eaecbee70cf770) C:\Windows\system32\Drivers\CVPNDRVA.sys
    2011/09/09 23:08:08.0350 3844 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
    2011/09/09 23:08:08.0412 3844 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
    2011/09/09 23:08:08.0474 3844 DNE (7b4fdfbe97c047175e613aa96f3de987) C:\Windows\system32\DRIVERS\dne2000.sys
    2011/09/09 23:08:08.0552 3844 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
    2011/09/09 23:08:08.0630 3844 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
    2011/09/09 23:08:08.0662 3844 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
    2011/09/09 23:08:08.0755 3844 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
    2011/09/09 23:08:08.0833 3844 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
    2011/09/09 23:08:08.0864 3844 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
    2011/09/09 23:08:08.0942 3844 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
    2011/09/09 23:08:08.0974 3844 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
    2011/09/09 23:08:09.0005 3844 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
    2011/09/09 23:08:09.0083 3844 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
    2011/09/09 23:08:09.0114 3844 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
    2011/09/09 23:08:09.0145 3844 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
    2011/09/09 23:08:09.0161 3844 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
    2011/09/09 23:08:09.0192 3844 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
    2011/09/09 23:08:09.0223 3844 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
    2011/09/09 23:08:09.0317 3844 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
    2011/09/09 23:08:09.0348 3844 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
    2011/09/09 23:08:09.0379 3844 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
    2011/09/09 23:08:09.0395 3844 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
    2011/09/09 23:08:09.0457 3844 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
    2011/09/09 23:08:09.0520 3844 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
    2011/09/09 23:08:09.0551 3844 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys
    2011/09/09 23:08:09.0582 3844 HpqRemHid (115c0933b3ed51dfbec4449348c8065b) C:\Windows\system32\DRIVERS\HpqRemHid.sys
    2011/09/09 23:08:09.0660 3844 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
    2011/09/09 23:08:09.0722 3844 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
    2011/09/09 23:08:09.0785 3844 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
    2011/09/09 23:08:09.0816 3844 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
    2011/09/09 23:08:09.0894 3844 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
    2011/09/09 23:08:09.0972 3844 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys
    2011/09/09 23:08:10.0003 3844 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
    2011/09/09 23:08:10.0050 3844 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
    2011/09/09 23:08:10.0175 3844 IntcAzAudAddService (8d7eb1fd498fd0a34c95a298685ec1c7) C:\Windows\system32\drivers\RTKVHDA.sys
    2011/09/09 23:08:10.0253 3844 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
    2011/09/09 23:08:10.0300 3844 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
    2011/09/09 23:08:10.0362 3844 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
    2011/09/09 23:08:10.0409 3844 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
    2011/09/09 23:08:10.0456 3844 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
    2011/09/09 23:08:10.0471 3844 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
    2011/09/09 23:08:10.0487 3844 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
    2011/09/09 23:08:10.0534 3844 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
    2011/09/09 23:08:10.0565 3844 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
    2011/09/09 23:08:10.0612 3844 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
    2011/09/09 23:08:10.0658 3844 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
    2011/09/09 23:08:10.0690 3844 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
    2011/09/09 23:08:10.0768 3844 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
    2011/09/09 23:08:10.0814 3844 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
    2011/09/09 23:08:10.0861 3844 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
    2011/09/09 23:08:10.0892 3844 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
    2011/09/09 23:08:10.0924 3844 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
    2011/09/09 23:08:10.0955 3844 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
    2011/09/09 23:08:11.0048 3844 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\Windows\system32\drivers\mbam.sys
    2011/09/09 23:08:11.0126 3844 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
    2011/09/09 23:08:11.0189 3844 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
    2011/09/09 23:08:11.0220 3844 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
    2011/09/09 23:08:11.0282 3844 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
    2011/09/09 23:08:11.0314 3844 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
    2011/09/09 23:08:11.0345 3844 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
    2011/09/09 23:08:11.0360 3844 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
    2011/09/09 23:08:11.0423 3844 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
    2011/09/09 23:08:11.0470 3844 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
    2011/09/09 23:08:11.0516 3844 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
    2011/09/09 23:08:11.0563 3844 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
    2011/09/09 23:08:11.0626 3844 mrxsmb (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
    2011/09/09 23:08:11.0688 3844 mrxsmb10 (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
    2011/09/09 23:08:11.0766 3844 mrxsmb20 (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
    2011/09/09 23:08:11.0813 3844 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
    2011/09/09 23:08:11.0860 3844 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
    2011/09/09 23:08:11.0875 3844 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
    2011/09/09 23:08:11.0938 3844 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
    2011/09/09 23:08:12.0000 3844 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
    2011/09/09 23:08:12.0062 3844 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
    2011/09/09 23:08:12.0094 3844 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
    2011/09/09 23:08:12.0125 3844 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
    2011/09/09 23:08:12.0140 3844 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
    2011/09/09 23:08:12.0187 3844 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
    2011/09/09 23:08:12.0203 3844 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
    2011/09/09 23:08:12.0296 3844 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
    2011/09/09 23:08:12.0359 3844 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
    2011/09/09 23:08:12.0390 3844 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
    2011/09/09 23:08:12.0437 3844 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
    2011/09/09 23:08:12.0468 3844 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
    2011/09/09 23:08:12.0484 3844 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
    2011/09/09 23:08:12.0515 3844 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
    2011/09/09 23:08:12.0546 3844 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
    2011/09/09 23:08:12.0671 3844 NETw4v32 (6522dd40a5f67ced020bd81b856613fb) C:\Windows\system32\DRIVERS\NETw4v32.sys
    2011/09/09 23:08:12.0718 3844 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
    2011/09/09 23:08:12.0749 3844 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
    2011/09/09 23:08:12.0780 3844 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
    2011/09/09 23:08:12.0842 3844 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
    2011/09/09 23:08:12.0874 3844 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
    2011/09/09 23:08:12.0905 3844 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
    2011/09/09 23:08:12.0983 3844 NVENETFD (1657f3fbd9061526c14ff37e79306f98) C:\Windows\system32\DRIVERS\nvm60x32.sys
    2011/09/09 23:08:13.0295 3844 nvlddmkm (377140a534d013bd661c69f1741de43c) C:\Windows\system32\DRIVERS\nvlddmkm.sys
    2011/09/09 23:08:13.0451 3844 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
    2011/09/09 23:08:13.0466 3844 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
    2011/09/09 23:08:13.0560 3844 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
    2011/09/09 23:08:13.0654 3844 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
    2011/09/09 23:08:13.0685 3844 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
    2011/09/09 23:08:13.0732 3844 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
    2011/09/09 23:08:13.0763 3844 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
    2011/09/09 23:08:13.0794 3844 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
    2011/09/09 23:08:13.0856 3844 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
    2011/09/09 23:08:13.0888 3844 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
    2011/09/09 23:08:13.0966 3844 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
    2011/09/09 23:08:14.0044 3844 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
    2011/09/09 23:08:14.0075 3844 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
    2011/09/09 23:08:14.0153 3844 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
    2011/09/09 23:08:14.0246 3844 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
    2011/09/09 23:08:14.0278 3844 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
    2011/09/09 23:08:14.0324 3844 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
    2011/09/09 23:08:14.0340 3844 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
    2011/09/09 23:08:14.0371 3844 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
    2011/09/09 23:08:14.0402 3844 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
    2011/09/09 23:08:14.0434 3844 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
    2011/09/09 23:08:14.0465 3844 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
    2011/09/09 23:08:14.0480 3844 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
    2011/09/09 23:08:14.0527 3844 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
    2011/09/09 23:08:14.0543 3844 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
    2011/09/09 23:08:14.0590 3844 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
    2011/09/09 23:08:14.0668 3844 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys
    2011/09/09 23:08:14.0730 3844 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys
    2011/09/09 23:08:14.0855 3844 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
    2011/09/09 23:08:14.0917 3844 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys
    2011/09/09 23:08:14.0980 3844 RMCAST (fdeb76bed9c0a75329ca426623297158) C:\Windows\system32\DRIVERS\RMCAST.sys
    2011/09/09 23:08:15.0011 3844 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
    2011/09/09 23:08:15.0042 3844 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
    2011/09/09 23:08:15.0120 3844 RTL8169 (9a929308a64183d3d9dccbb6df4badae) C:\Windows\system32\DRIVERS\Rtlh86.sys
    2011/09/09 23:08:15.0167 3844 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
    2011/09/09 23:08:15.0260 3844 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
    2011/09/09 23:08:15.0292 3844 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
    2011/09/09 23:08:15.0338 3844 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
    2011/09/09 23:08:15.0385 3844 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
    2011/09/09 23:08:15.0416 3844 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
    2011/09/09 23:08:15.0479 3844 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
    2011/09/09 23:08:15.0510 3844 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
    2011/09/09 23:08:15.0541 3844 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\DRIVERS\sffp_sd.sys
    2011/09/09 23:08:15.0572 3844 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
    2011/09/09 23:08:15.0619 3844 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
    2011/09/09 23:08:15.0650 3844 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
    2011/09/09 23:08:15.0682 3844 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
    2011/09/09 23:08:15.0728 3844 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
    2011/09/09 23:08:15.0775 3844 smserial (63b3b77bdb67ee674771c0e6fb96da9e) C:\Windows\system32\DRIVERS\smserial.sys
    2011/09/09 23:08:15.0822 3844 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
    2011/09/09 23:08:15.0884 3844 srv (8e5fc19b3b38364c5f44ccecec5248e9) C:\Windows\system32\DRIVERS\srv.sys
    2011/09/09 23:08:15.0947 3844 srv2 (4ceeb95e0b79e48b81f2da0a6c24c64b) C:\Windows\system32\DRIVERS\srv2.sys
    2011/09/09 23:08:16.0009 3844 srvnet (f9c65e1e00a6bbf7c57d9b8ea068c525) C:\Windows\system32\DRIVERS\srvnet.sys
    2011/09/09 23:08:16.0072 3844 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
    2011/09/09 23:08:16.0150 3844 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
    2011/09/09 23:08:16.0196 3844 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
    2011/09/09 23:08:16.0274 3844 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
    2011/09/09 23:08:16.0306 3844 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
    2011/09/09 23:08:16.0337 3844 SynTP (f5d926807bd9bc0af68f9376144de425) C:\Windows\system32\DRIVERS\SynTP.sys
    2011/09/09 23:08:16.0446 3844 Tcpip (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\drivers\tcpip.sys
    2011/09/09 23:08:16.0508 3844 Tcpip6 (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\DRIVERS\tcpip.sys
    2011/09/09 23:08:16.0540 3844 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
    2011/09/09 23:08:16.0555 3844 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
    2011/09/09 23:08:16.0586 3844 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
    2011/09/09 23:08:16.0618 3844 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
    2011/09/09 23:08:16.0649 3844 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
    2011/09/09 23:08:16.0711 3844 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
    2011/09/09 23:08:16.0758 3844 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
    2011/09/09 23:08:16.0820 3844 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
    2011/09/09 23:08:16.0852 3844 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
    2011/09/09 23:08:16.0883 3844 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
    2011/09/09 23:08:16.0930 3844 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
    2011/09/09 23:08:16.0961 3844 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
    2011/09/09 23:08:16.0992 3844 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
    2011/09/09 23:08:17.0023 3844 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
    2011/09/09 23:08:17.0054 3844 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
    2011/09/09 23:08:17.0101 3844 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
    2011/09/09 23:08:17.0148 3844 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
    2011/09/09 23:08:17.0195 3844 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
    2011/09/09 23:08:17.0226 3844 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
    2011/09/09 23:08:17.0257 3844 usbohci (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
    2011/09/09 23:08:17.0288 3844 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
    2011/09/09 23:08:17.0335 3844 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
    2011/09/09 23:08:17.0351 3844 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
    2011/09/09 23:08:17.0429 3844 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
    2011/09/09 23:08:17.0507 3844 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
    2011/09/09 23:08:17.0522 3844 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
    2011/09/09 23:08:17.0554 3844 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
    2011/09/09 23:08:17.0585 3844 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
    2011/09/09 23:08:17.0616 3844 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
    2011/09/09 23:08:17.0647 3844 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
    2011/09/09 23:08:17.0678 3844 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
    2011/09/09 23:08:17.0694 3844 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
    2011/09/09 23:08:17.0756 3844 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
    2011/09/09 23:08:17.0803 3844 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
    2011/09/09 23:08:17.0819 3844 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/09/09 23:08:17.0866 3844 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/09/09 23:08:17.0912 3844 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
    2011/09/09 23:08:17.0944 3844 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
    2011/09/09 23:08:18.0037 3844 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
    2011/09/09 23:08:18.0100 3844 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
    2011/09/09 23:08:18.0162 3844 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
    2011/09/09 23:08:18.0209 3844 WSDPrintDevice (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
    2011/09/09 23:08:18.0256 3844 WSDScan (9f6fa85e84d0a42d86a9dbb79d76b0ed) C:\Windows\system32\DRIVERS\WSDScan.sys
    2011/09/09 23:08:18.0302 3844 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
    2011/09/09 23:08:18.0380 3844 MBR (0x1B8) (1a1a06f62e891045814007163c1c76c3) \Device\Harddisk0\DR0
    2011/09/09 23:08:18.0412 3844 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
    2011/09/09 23:08:18.0427 3844 Boot (0x1200) (9476977f60eef92252fb08c3beba1463) \Device\Harddisk0\DR0\Partition0
    2011/09/09 23:08:18.0443 3844 Boot (0x1200) (f2db4dd8ef2ebc3f34ad7c1a781b65b5) \Device\Harddisk0\DR0\Partition1
    2011/09/09 23:08:18.0458 3844 Boot (0x1200) (85bf0a42c1bf840de30cb25976ec98d9) \Device\Harddisk1\DR1\Partition0
    2011/09/09 23:08:18.0474 3844 ================================================================================
    2011/09/09 23:08:18.0474 3844 Scan finished
    2011/09/09 23:08:18.0474 3844 ================================================================================
    2011/09/09 23:08:18.0490 3328 Detected object count: 0
    2011/09/09 23:08:18.0490 3328 Actual detected object count: 0
     
  10. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    ...
     
  11. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    TDS killer found nothing but then I believe I have solved the issue.

    I went back to the original instructions and started following them from step one all over. Originally, I did not run aswMBR from desktop but from a folder on the desktop (not sure if it made a differnce)

    So, I have re-downloaded all of the files onto the desktop and exited all of my programs and disabled Avira AntiVir. Then I ran aswMBR from desktop, and it produced one detection "c:\windows\system32\wscui32.dll". Then, Immediately after I ran Combofix from my desktop. After this, I have made a notepad file that you suggested and I added "c:\windows\system32\wscui32.dll" line after the "File:" and named it CFScript.txt and dragged and dropped it onto Combofix.exe immediately after the first combofix.exe scan was completed. After the 2nd Combofix scan, I ran TDSKiller and it produced 0 detections, which i sort of expected.

    I restarted windows, tried clicking about 100 google search results with various keywords, and so far no redirects! Ran MBAM quick scan again, which previously has been producing the one detection "HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO)" after every restart, even though it claimed to remove it every time.
    This time, MBAM produced 0 detections!

    Two questions arise:
    1. I have an external USB HDD which I plug in and out all the time, and Avira AntiVir blocks its autorun.inf. Could the redirect virus have spread onto the external HDD prior to me having Avira AntiVir? And if I were to disable the autorun.inf block, could it comeback and spread again?
    2. Could this virus have had access to my stored passwords, and/or other passwords which I may have entered to log into banking/credit card sites?

    Thank you again. My gratitude is enormous.
     
     
  12. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    It was only firefox that was affected. I tried chrome and ie, and those were not affected.
     
  13. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    Good news then :)

    1. Install this on your computer. Then plug the drive in and scan it with Avira.
    Download, and run Flash Disinfector, and save it to your desktop (Windows Vista and Windows 7 users, scroll down)

    *Please disable any AV / ScriptBlockers as they might detect Flash Disinfector to be malicious and block it. Hence, the failure in executing. You can enable them back after the cleaning process*

    • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
    • The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
    • Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
    • Wait until it has finished scanning and then exit the program.
    • Reboot your computer when done.
    Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

    Windows Vista and Windows 7 users
    Flash Disinfector is not compatible with the above Windows version.
    Please, use Panda USB Vaccine, or BitDefender’s USB Immunizer

    2. Yes. You should change all your passwords, but wait with that, because I want you to run couple more scans for me....

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  14. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    OTL logfile created on: 9/10/2011 10:48:22 AM - Run 1
    OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Victor\Desktop
    Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6001.18000)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.00 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 69.29% Memory free
    6.19 Gb Paging File | 5.36 Gb Available in Paging File | 86.48% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 99.72 Gb Total Space | 10.98 Gb Free Space | 11.01% Space Free | Partition Type: NTFS
    Drive D: | 12.07 Gb Total Space | 1.99 Gb Free Space | 16.53% Space Free | Partition Type: NTFS
    Drive F: | 465.11 Gb Total Space | 53.70 Gb Free Space | 11.54% Space Free | Partition Type: NTFS

    Computer Name: VICTOR-LAPPY | User Name: Victor | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
    PRC - [2011/09/03 02:01:45 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
    PRC - [2011/07/21 12:12:18 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2011/04/21 07:54:06 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    PRC - [2011/04/21 07:53:50 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
    PRC - [2011/04/21 07:53:34 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    PRC - [2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
    PRC - [2008/04/15 20:54:40 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    PRC - [2008/01/20 22:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe


    ========== Modules (No Company Name) ==========

    MOD - [2011/09/03 02:01:45 | 001,846,232 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
    MOD - [2008/09/16 20:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- -- (MDM)
    SRV - [2011/07/21 12:12:18 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
    SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011/04/21 07:53:50 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
    SRV - [2010/07/09 19:20:06 | 001,469,544 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Windows\System32\nvsvc.dll -- (nvsvc)
    SRV - [2009/01/26 19:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Disabled | Stopped] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
    SRV - [2008/04/15 20:54:42 | 000,354,840 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
    SRV - [2007/09/20 14:02:58 | 000,299,008 | ---- | M] (DigitalPersona, Inc.) [Disabled | Stopped] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
    SRV - [2007/05/16 13:41:18 | 000,029,704 | ---- | M] (TuneUp Software GmbH) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
    SRV - [2007/04/03 19:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Disabled | Stopped] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
    SRV - [2007/03/05 13:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Disabled | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)


    ========== Driver Services (SafeList) ==========

    DRV - [2011/07/21 12:15:22 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
    DRV - [2011/07/21 12:15:20 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
    DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2010/07/09 18:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
    DRV - [2010/06/17 15:27:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
    DRV - [2009/03/27 05:16:28 | 000,012,672 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz132_x32.sys -- (cpuz132)
    DRV - [2008/05/09 21:33:10 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) RMCAST (Pgm)
    DRV - [2008/01/20 22:23:27 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
    DRV - [2008/01/20 22:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
    DRV - [2007/09/26 16:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
    DRV - [2007/09/17 19:17:36 | 000,098,816 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
    DRV - [2007/08/28 18:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
    DRV - [2007/07/11 13:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid)
    DRV - [2007/06/18 20:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
    DRV - [2007/04/03 19:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
    DRV - [2007/01/31 16:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
    DRV - [2007/01/18 17:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
    DRV - [2007/01/17 09:38:52 | 000,983,936 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
    DRV - [2006/11/16 12:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
    DRV - [2006/11/16 07:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
    DRV - [2006/11/16 05:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
    DRV - [2006/11/02 03:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop


    IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]

    IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]

    IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
    IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========


    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/06 18:44:30 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/06 22:22:36 | 000,000,000 | ---D | M]

    [2009/11/23 02:22:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Victor\AppData\Roaming\Mozilla\Extensions
    [2011/09/09 22:56:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions
    [2011/09/07 11:02:39 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{aa7b9bfa-4feb-4f84-bfb3-6cdcfc6e4a2c}
    [2011/09/06 19:05:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2011/09/06 19:05:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
    [2011/09/06 19:01:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
    [2011/09/03 02:01:45 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2008/12/23 12:06:38 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
    [2011/09/02 19:25:59 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

    O1 HOSTS File: ([2011/09/09 23:05:04 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 4
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
    O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
    O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
    O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
    O15 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
    O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
    O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
    O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: DhcpNameServer = 192.168.1.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\HPTimewarp.jpg
    O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\HPTimewarp.jpg
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2008/07/01 09:18:01 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2011/09/10 10:32:00 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
    O32 - AutoRun File - [2005/09/11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
    O32 - AutoRun File - [2011/09/10 10:32:01 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
    O32 - AutoRun File - [2010/03/21 14:51:12 | 000,000,000 | ---D | M] - F:\AUTORUN_.INF -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
    NetSvcs: FastUserSwitchingCompatibility - File not found
    NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
    NetSvcs: Nla - File not found
    NetSvcs: Ntmssvc - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: SRService - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: LogonHours - File not found
    NetSvcs: PCAudit - File not found
    NetSvcs: helpsvc - File not found
    NetSvcs: uploadmgr - File not found

    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: MSACM.MSNAUDIO - C:\Windows\System32\msnaudio.acm (Microsoft Corporation)
    Drivers32: msacm.sl_anet - C:\Windows\System32\SL_ANET.ACM (Sipro Lab Telecom Inc.)
    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/09/10 10:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
    [2011/09/10 10:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
    [2011/09/10 10:37:04 | 000,000,000 | ---D | C] -- C:\Program Files\Panda USB Vaccine
    [2011/09/10 10:32:00 | 000,000,000 | RHSD | C] -- C:\autorun.inf
    [2011/09/10 10:26:21 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
    [2011/09/09 23:06:57 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011/09/09 23:06:56 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011/09/09 23:06:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\temp
    [2011/09/09 22:59:15 | 000,000,000 | ---D | C] -- C:\ComboFix
    [2011/09/09 21:42:32 | 004,201,039 | R--- | C] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
    [2011/09/09 21:35:52 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
    [2011/09/09 21:35:28 | 001,402,672 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
    [2011/09/09 09:19:20 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/09/08 18:43:52 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Avira
    [2011/09/08 18:40:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
    [2011/09/08 18:40:44 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
    [2011/09/08 18:40:44 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
    [2011/09/08 18:40:44 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
    [2011/09/08 18:40:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
    [2011/09/08 18:38:58 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
    [2011/09/08 18:36:13 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Redirect POS
    [2011/09/08 18:27:28 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2011/09/06 22:23:40 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Foxit Software
    [2011/09/06 22:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
    [2011/09/06 22:22:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Phantom
    [2011/09/06 22:21:24 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\COMODO
    [2011/09/06 20:04:16 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
    [2011/09/06 19:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
    [2011/09/06 19:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
    [2011/09/06 18:44:34 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Mozilla
    [2011/09/06 18:44:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
    [2011/09/06 18:23:05 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
    [2011/09/06 10:44:55 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
    [2011/09/06 10:08:43 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/09/06 10:08:43 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/09/06 10:08:43 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011/09/06 10:08:39 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/09/06 10:05:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
    [2011/09/06 10:00:09 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
    [2011/09/05 20:04:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
    [2011/09/05 20:03:56 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
    [2011/09/04 23:42:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\riotsGamesLogs
    [2011/09/01 20:52:14 | 000,000,000 | ---D | C] -- C:\Windows\System32\CSP
    [2011/09/01 20:22:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\fontconfig
    [2011/09/01 20:17:01 | 000,000,000 | ---D | C] -- C:\Users\Victor\.smplayer
    [2011/09/01 19:13:37 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Music
    [2011/09/01 15:22:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
    [2011/09/01 15:21:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
    [2011/09/01 15:20:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\L&H
    [2011/09/01 15:19:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
    [2011/09/01 12:59:39 | 000,000,000 | ---D | C] -- C:\Users\Victor\Cisco Packet Tracer 5.3.2
    [2011/09/01 12:00:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Packet Tracer
    [2011/09/01 11:59:08 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco Packet Tracer 5.3.2
    [2011/08/31 22:19:53 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Microsoft Help
    [2011/08/31 14:40:19 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\WinRAR
    [2011/08/31 14:40:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
    [2011/08/31 14:40:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
    [2011/08/31 14:40:00 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
    [2011/08/27 12:50:47 | 000,000,000 | ---D | C] -- C:\Dls
    [2011/08/27 12:47:58 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Conduit
    [2011/08/27 12:47:50 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
    [2011/08/27 12:47:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\uTorrent
    [2011/08/27 12:47:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\uTorrent
    [2011/08/27 07:58:37 | 000,000,000 | ---D | C] -- C:\Program Files\RegClean 5.9 English
    [2011/08/27 07:50:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    [2011/08/27 07:50:37 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
    [2011/08/27 00:21:36 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\SUPERAntiSpyware.com
    [2011/08/27 00:01:56 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
    [2011/08/26 23:46:35 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Security
    [2011/08/26 23:33:11 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Malwarebytes
    [2011/08/26 23:32:59 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2011/08/26 23:32:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/08/26 23:32:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/08/26 23:32:53 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2011/08/26 23:32:52 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/08/26 19:23:18 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\dvdcss
    [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/09/10 10:48:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/09/10 10:47:05 | 000,595,684 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2011/09/10 10:47:05 | 000,101,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2011/09/10 10:41:49 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/09/10 10:41:44 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/09/10 10:41:44 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/09/10 10:41:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/09/10 10:41:21 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys
    [2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
    [2011/09/09 23:22:40 | 000,036,650 | ---- | M] () -- C:\Users\Victor\Desktop\aesetup2.2.exe.htm
    [2011/09/09 23:05:04 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2011/09/09 21:42:40 | 004,201,039 | R--- | M] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
    [2011/09/09 21:36:00 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
    [2011/09/09 21:35:41 | 001,402,672 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
    [2011/09/09 18:26:40 | 000,000,178 | ---- | M] () -- C:\Users\Victor\.packettracer
    [2011/09/09 17:15:46 | 000,000,392 | ---- | M] () -- C:\Windows\tasks\1-Click Maintenance.job
    [2011/09/08 19:30:44 | 000,305,888 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2011/09/08 18:40:48 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
    [2011/09/08 18:28:11 | 000,001,324 | ---- | M] () -- C:\Windows\System32\.ini
    [2011/09/07 13:32:00 | 000,002,337 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
    [2011/09/07 12:22:37 | 000,002,361 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
    [2011/09/07 09:58:33 | 000,467,168 | ---- | M] () -- C:\Windows\System32\drivers\sfi.dat
    [2011/09/06 22:25:13 | 000,002,029 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2011/09/06 22:22:28 | 000,001,926 | ---- | M] () -- C:\Users\Public\Desktop\Foxit Phantom.lnk
    [2011/09/06 18:44:31 | 000,000,870 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/09/06 18:00:52 | 000,000,979 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer (No Add-ons).lnk
    [2011/09/06 14:29:48 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110907-141548.backup
    [2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.dat
    [2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.001
    [2011/09/06 12:26:04 | 000,002,579 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
    [2011/09/06 10:17:08 | 000,000,121 | ---- | M] () -- C:\Windows\wininit.ini
    [2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
    [2011/09/05 23:10:36 | 000,179,273 | ---- | M] () -- C:\Users\Victor\Desktop\Amazon.jpg
    [2011/09/04 13:00:48 | 000,000,435 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\System - Shortcut.lnk
    [2011/09/02 20:10:12 | 000,003,584 | ---- | M] () -- C:\Users\Victor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2011/09/01 20:45:04 | 000,000,075 | ---- | M] () -- C:\ProgramData\nvUnsupRes.dat
    [2011/09/01 15:24:54 | 000,000,376 | ---- | M] () -- C:\Windows\ODBC.INI
    [2011/09/01 12:00:34 | 000,001,036 | ---- | M] () -- C:\Users\Victor\Desktop\Cisco Packet Tracer.lnk
    [2011/08/31 23:10:25 | 000,000,974 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Power2Go.lnk
    [2011/08/31 08:51:00 | 000,000,762 | ---- | M] () -- C:\Windows\System32\ealregsnapshot1.reg
    [2011/08/30 22:23:54 | 000,000,104 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Computer - Shortcut.lnk
    [2011/08/27 12:48:00 | 000,000,816 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
    [2011/08/27 07:57:16 | 000,214,054 | ---- | M] () -- C:\Users\Victor\Documents\cc_20110827_075650.reg
    [2011/08/26 23:14:09 | 000,008,268 | ---- | M] () -- C:\Users\Victor\AppData\Local\d3d9caps.dat
    [2011/08/26 18:53:16 | 000,000,872 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\lol.launcher.exe - Shortcut.lnk
    [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/09/09 23:22:39 | 000,036,650 | ---- | C] () -- C:\Users\Victor\Desktop\aesetup2.2.exe.htm
    [2011/09/08 18:40:48 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
    [2011/09/08 18:28:11 | 000,001,324 | ---- | C] () -- C:\Windows\System32\.ini
    [2011/09/07 12:22:35 | 000,002,337 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
    [2011/09/06 22:25:13 | 000,002,029 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2011/09/06 22:22:28 | 000,001,926 | ---- | C] () -- C:\Users\Public\Desktop\Foxit Phantom.lnk
    [2011/09/06 20:03:34 | 000,467,168 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
    [2011/09/06 18:44:31 | 000,000,870 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/09/06 18:44:31 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    [2011/09/06 18:00:52 | 000,000,979 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer (No Add-ons).lnk
    [2011/09/06 13:15:58 | 3219,578,880 | -HS- | C] () -- C:\hiberfil.sys
    [2011/09/06 10:17:08 | 000,000,121 | ---- | C] () -- C:\Windows\wininit.ini
    [2011/09/06 10:08:43 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/09/06 10:08:43 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/09/06 10:08:43 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/09/06 10:08:43 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/09/06 10:08:43 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/09/06 04:54:43 | 000,001,244 | -HS- | C] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
    [2011/09/05 22:26:56 | 000,179,273 | ---- | C] () -- C:\Users\Victor\Desktop\Amazon.jpg
    [2011/09/04 13:00:48 | 000,000,435 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\System - Shortcut.lnk
    [2011/09/02 20:10:12 | 000,003,584 | ---- | C] () -- C:\Users\Victor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2011/09/01 20:45:04 | 000,000,075 | ---- | C] () -- C:\ProgramData\nvUnsupRes.dat
    [2011/09/01 15:22:05 | 000,002,579 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
    [2011/09/01 15:22:04 | 000,002,046 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Outlook.lnk
    [2011/09/01 15:22:04 | 000,002,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint.lnk
    [2011/09/01 15:22:03 | 000,002,030 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
    [2011/09/01 15:22:03 | 000,001,998 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft FrontPage.lnk
    [2011/09/01 15:22:03 | 000,001,990 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Access.lnk
    [2011/09/01 12:59:39 | 000,000,178 | ---- | C] () -- C:\Users\Victor\.packettracer
    [2011/09/01 12:00:34 | 000,001,036 | ---- | C] () -- C:\Users\Victor\Desktop\Cisco Packet Tracer.lnk
    [2011/08/31 23:10:25 | 000,000,974 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Power2Go.lnk
    [2011/08/31 08:51:00 | 000,000,762 | ---- | C] () -- C:\Windows\System32\ealregsnapshot1.reg
    [2011/08/27 12:48:00 | 000,000,816 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
    [2011/08/27 07:56:58 | 000,214,054 | ---- | C] () -- C:\Users\Victor\Documents\cc_20110827_075650.reg
    [2011/08/26 18:53:16 | 000,000,872 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\lol.launcher.exe - Shortcut.lnk
    [2010/12/27 01:37:55 | 000,000,000 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\wklnhst.dat
    [2010/12/24 03:25:43 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
    [2010/07/20 04:21:28 | 000,595,353 | ---- | C] () -- C:\ProgramData\nvModes.001
    [2010/07/20 04:21:15 | 000,595,353 | ---- | C] () -- C:\ProgramData\nvModes.dat
    [2009/11/23 02:22:45 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
    [2009/09/30 00:25:00 | 000,008,268 | ---- | C] () -- C:\Users\Victor\AppData\Local\d3d9caps.dat
    [2009/02/10 19:46:45 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll
    [2009/02/07 21:59:00 | 000,000,024 | ---- | C] () -- C:\Windows\winamp.ini
    [2008/07/26 17:34:28 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
    [2008/07/24 23:21:37 | 000,269,014 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\nvModes.001
    [2008/07/24 23:21:35 | 000,269,014 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\nvModes.dat
    [2008/07/24 22:18:33 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
    [2008/07/24 22:18:33 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
    [2008/07/02 03:59:07 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat
    [2008/07/02 03:59:07 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat
    [2008/07/02 03:58:37 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
    [2008/07/01 09:33:22 | 000,101,605 | ---- | C] () -- C:\Windows\hpqins13.dat
    [2007/04/03 19:18:26 | 000,197,672 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
    [2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2006/11/02 08:47:37 | 000,305,888 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
    [2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/02 06:33:01 | 000,595,684 | ---- | C] () -- C:\Windows\System32\perfh009.dat
    [2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
    [2006/11/02 06:33:01 | 000,101,350 | ---- | C] () -- C:\Windows\System32\perfc009.dat
    [2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
    [2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
    [2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
    [2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
    [2006/03/09 05:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

    ========== LOP Check ==========

    [2011/08/31 14:44:23 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Autodesk
    [2008/07/24 10:07:27 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\DigitalPersona
    [2011/09/06 22:23:40 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Foxit Software
    [2010/07/20 02:59:52 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\LolClient
    [2010/12/27 01:38:01 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Template
    [2010/03/02 22:24:47 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\TuneUp Software
    [2011/09/09 21:47:05 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\uTorrent
    [2008/11/21 20:21:52 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\WarZone
    [2011/09/09 17:15:46 | 000,000,392 | ---- | M] () -- C:\Windows\Tasks\1-Click Maintenance.job
    [2011/09/10 10:40:36 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < >

    < %SYSTEMDRIVE%\*.* >
    [2008/07/01 09:18:01 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
    [2008/01/20 22:24:42 | 000,333,203 | RHS- | M] () -- C:\bootmgr
    [2011/09/09 23:06:54 | 000,011,038 | ---- | M] () -- C:\ComboFix.txt
    [2006/09/18 17:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
    [2011/09/10 10:41:21 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys
    [2008/07/26 21:06:03 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2008/07/26 21:06:03 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2011/09/10 10:41:19 | 3533,369,344 | -HS- | M] () -- C:\pagefile.sys
    [2011/09/09 23:07:56 | 000,063,904 | ---- | M] () -- C:\TDSSKiller.2.5.20.0_09.09.2011_23.07.23_log.txt
    [2011/09/09 23:10:23 | 000,063,904 | ---- | M] () -- C:\TDSSKiller.2.5.20.0_09.09.2011_23.07.59_log.txt

    < %systemroot%\Fonts\*.com >
    [2006/11/02 08:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2006/11/02 08:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2006/11/02 08:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2006/11/02 08:37:12 | 000,030,808 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2006/09/18 17:37:34 | 000,000,065 | -H-- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008/01/20 22:23:14 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
    [2006/11/02 08:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
    [2006/10/26 22:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2008/01/20 22:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2008/01/20 23:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
    [2008/01/20 23:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
    [2008/01/20 23:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
    [2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
    [2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2011/09/08 14:34:57 | 000,000,359 | -HS- | M] () -- C:\Users\Victor\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2011/09/09 21:36:00 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
    [2011/09/09 21:42:40 | 004,201,039 | R--- | M] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
    [2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
    [2011/09/09 21:35:41 | 001,402,672 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2008/07/24 10:07:20 | 000,000,402 | -HS- | M] () -- C:\Users\Victor\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
    [2008/07/01 09:34:28 | 000,000,371 | ---- | M] () -- C:\ProgramData\hpzinstall.log
    [2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.001

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
  15. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    OTL Extras logfile created on: 9/10/2011 10:48:22 AM - Run 1
    OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Victor\Desktop
    Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6001.18000)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.00 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 69.29% Memory free
    6.19 Gb Paging File | 5.36 Gb Available in Paging File | 86.48% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 99.72 Gb Total Space | 10.98 Gb Free Space | 11.01% Space Free | Partition Type: NTFS
    Drive D: | 12.07 Gb Total Space | 1.99 Gb Free Space | 16.53% Space Free | Partition Type: NTFS
    Drive F: | 465.11 Gb Total Space | 53.70 Gb Free Space | 11.54% Space Free | Partition Type: NTFS

    Computer Name: VICTOR-LAPPY | User Name: Victor | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    [HKEY_USERS\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- Reg Error: Key error.
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    "DisableMonitoring" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
    "EnableNotifications" = 0
    "EnableNotificationsRef" = 3

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall" = 0
    "DisableNotifications" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{0A521A31-0CEC-4C34-A529-86B71AA744AB}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |
    "{0C567C69-62A2-4569-BDD7-A09BFF189925}" = lport=6939 | protocol=17 | dir=in | name=league of legends launcher |
    "{0C70251B-B1B0-491F-96F2-726B23ABFE3C}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher |
    "{0DC6D33F-13B8-431D-8707-6C68115D3B41}" = lport=6915 | protocol=17 | dir=in | name=league of legends launcher |
    "{10EBA7D3-7B94-4A03-A95E-1C8D32698D27}" = lport=8382 | protocol=6 | dir=in | name=league of legends launcher |
    "{1E00D2AA-67C1-417E-BB50-B66BFC625674}" = lport=6985 | protocol=6 | dir=in | name=league of legends launcher |
    "{1F06BE27-982D-4976-B258-7A945253991F}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher |
    "{2129E83F-F5E1-4D0E-9993-720A729675EC}" = lport=6887 | protocol=17 | dir=in | name=league of legends launcher |
    "{2493F93E-ABA5-4E36-B390-9156AC1E7E84}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby |
    "{2C5FC9BF-787D-4334-A7D3-F02070EBE9EE}" = lport=139 | protocol=6 | dir=in | app=system |
    "{2F65D0D3-87EF-4EBA-B116-C87DE5384E08}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher |
    "{30EEF6C2-34EA-4132-8469-10A0EC73663F}" = lport=8383 | protocol=17 | dir=in | name=league of legends launcher |
    "{3664EF17-CD01-41C9-8901-01620419AA39}" = lport=6945 | protocol=6 | dir=in | name=league of legends launcher |
    "{41F37E40-7B3D-4C00-B7C8-A5DA5660F6E6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{480D5559-AAEC-4A0A-B867-3D54DD1C7276}" = lport=6973 | protocol=6 | dir=in | name=league of legends launcher |
    "{4FE81F4B-3E2B-4B67-B78F-99FE65D76842}" = lport=6939 | protocol=6 | dir=in | name=league of legends launcher |
    "{6140199A-0B06-4BE7-96C9-1763A19F3EAF}" = rport=139 | protocol=6 | dir=out | app=system |
    "{62815315-237E-4199-BA39-6071669D4ACC}" = lport=6887 | protocol=6 | dir=in | name=league of legends launcher |
    "{6AFF6A58-3A69-4878-8AD2-BA627E6B4F26}" = lport=138 | protocol=17 | dir=in | app=system |
    "{720345A5-6CB7-4CB9-8C95-F5064BBE0531}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |
    "{79C17C62-3B8E-4E04-91A0-BA69086E3D7D}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |
    "{80999A0B-E893-46AB-8557-D8DC8F5861E5}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client |
    "{90131E6F-46A6-4A7D-8528-2983BD886CCD}" = lport=6969 | protocol=6 | dir=in | name=league of legends launcher |
    "{95408A78-53DD-453A-9F32-1A122F6A1E0F}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
    "{97CF301E-C371-4490-B075-B93162D0F58F}" = lport=6958 | protocol=17 | dir=in | name=league of legends launcher |
    "{A71F4CF6-7AED-4095-814F-300BE1EEF980}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
    "{A989FD17-538D-4533-A830-8423CE1F6B95}" = rport=137 | protocol=17 | dir=out | app=system |
    "{AD2CB4E3-6A5A-48CA-A1C0-B71B8E395DCD}" = rport=445 | protocol=6 | dir=out | app=system |
    "{ADBFB0B7-78B0-4163-94A0-21E7C7207919}" = lport=6975 | protocol=6 | dir=in | name=league of legends launcher |
    "{BD726FEA-480E-4EE6-A8CD-9462F88941AA}" = lport=6969 | protocol=17 | dir=in | name=league of legends launcher |
    "{BDE4BA31-E55C-4B6F-8CDA-C6336A6672F0}" = lport=6945 | protocol=17 | dir=in | name=league of legends launcher |
    "{BE1FE395-76DB-46A2-A05B-37718A29C5D4}" = lport=8383 | protocol=6 | dir=in | name=league of legends launcher |
    "{CB65A7B6-CC6D-4277-9B38-B8505D62B803}" = lport=445 | protocol=6 | dir=in | app=system |
    "{CB9A2141-084E-45B5-99B7-C55E7924983A}" = lport=8378 | protocol=6 | dir=in | name=league of legends launcher |
    "{CDA8DA27-FE48-489E-8740-A8D8CC70CE65}" = lport=6985 | protocol=17 | dir=in | name=league of legends launcher |
    "{D098CDD7-21CE-43A1-B285-8A10FB83310C}" = lport=6915 | protocol=6 | dir=in | name=league of legends launcher |
    "{D67FE716-EDF2-4E77-B44F-908FA89E60B4}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client |
    "{D8A37A6F-F504-44A8-A419-53E4870093DB}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby |
    "{DA5A9F53-0ED4-4CAE-AFFA-43BD56FABD98}" = lport=6973 | protocol=17 | dir=in | name=league of legends launcher |
    "{DD93CF6E-FDDA-48FB-915F-0732B4545059}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher |
    "{DDB6C156-AA81-4F46-844B-BC2BF7FDF4B5}" = rport=138 | protocol=17 | dir=out | app=system |
    "{E0EC921C-FD69-4C25-9683-001202F0A876}" = lport=8378 | protocol=17 | dir=in | name=league of legends launcher |
    "{E9A4A6F6-2740-4753-9AA9-D4CC323E3135}" = lport=6975 | protocol=17 | dir=in | name=league of legends launcher |
    "{EB742E87-D7AA-4E08-BADC-C9940CBF3008}" = lport=6958 | protocol=6 | dir=in | name=league of legends launcher |
    "{ED4DC38D-8814-4ED1-806B-00BEF6A81DA2}" = lport=8382 | protocol=17 | dir=in | name=league of legends launcher |
    "{F986F0C9-532B-4C95-AD74-6C3A5DF962DC}" = lport=137 | protocol=17 | dir=in | app=system |
    "{FA5119D1-29F7-4DF0-8543-A2B4F38737C0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{FEC24560-75B6-4EEB-A398-52EC66ECFD8A}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{03AB5076-B967-4346-A3DA-707B4CEA0614}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{0ABA2273-5D10-4F0B-9DAF-3F94E5EDFE38}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
    "{2F8E9585-51DC-4AEE-89A1-C01A2DA9B7D7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{35519B5D-59B3-4E70-964B-541EBAF6DAFC}" = protocol=6 | dir=in | app=c:\program files\league\lol.launcher.exe |
    "{5D0506C7-BEC9-4CEB-9483-E92BC89348AF}" = protocol=17 | dir=in | app=c:\program files\league\lol.launcher.exe |
    "{D5168629-58AB-458A-A2A5-85858A480B4D}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
    "{D73318BE-A9CE-45A2-8EF8-048ABDC2203F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{E3D16098-FFE7-403E-AF72-62F79B69D238}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
    "{E6350F94-0E85-425B-8317-2CC21404F6F1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{FEC19BE9-4A1E-4682-BD68-A8DDC8EC02EE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
    "{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
    "{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
    "{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
    "{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
    "{26A24AE4-039D-4CA4-87B4-2F83216026F0}" = Java(TM) 6 Update 26
    "{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
    "{31753CDD-A7DA-4667-BEFC-B3EA3BDF366E}" = Foxit Phantom
    "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E1
    "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
    "{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.6
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
    "{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.16
    "{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
    "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{7DC4A410-9986-4329-9E5D-687B2C42CA39}" = HP QuickTouch 1.00 C4
    "{7F362F06-A9A3-440F-8B19-6A01A72723C4}" = AuthenTec Fingerprint Sensor Minimum Install
    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
    "{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
    "{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
    "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{b02df929-29a7-4fd2-9a70-81a644b635f7}" = HP Total Care Advisor
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B9CA59A0-3B70-48F8-9054-67595DE6E72B}" = League of Legends
    "{C7AF7F33-9092-997E-2D29-DE8095863FE3}" = DigitalPersona Personal 3.0.0
    "{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
    "{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
    "{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}" = HP Wireless Assistant
    "{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}" = Cisco Systems VPN Client 5.0.00.0340
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11
    "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
    "CCleaner" = CCleaner
    "Cisco Packet Tracer 5.3.2_is1" = Cisco Packet Tracer 5.3.2
    "CoreAVC Professional Edition" = CoreAVC Professional Edition (remove only)
    "CPUID CPU-Z_is1" = CPUID CPU-Z 1.53.1
    "EPSON WorkForce 610 Series" = EPSON WorkForce 610 Series Printer Uninstall
    "Google Chrome" = Google Chrome
    "Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
    "KLiteCodecPack_is1" = K-Lite Codec Pack 4.5.3 (Standard)
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Mozilla Firefox 6.0.2 (x86 en-US)" = Mozilla Firefox 6.0.2 (x86 en-US)
    "MSMONEYV60" = Microsoft Money 98
    "MV RegClean 5.9 English_is1" = MV RegClean 5.9 English
    "NVIDIA Display Control Panel" = NVIDIA Display Control Panel
    "NVIDIA Drivers" = NVIDIA Drivers
    "Revo Uninstaller" = Revo Uninstaller 1.75
    "SMSERIAL" = Motorola SM56 Data Fax Modem
    "SynTPDeinstKey" = Synaptics Pointing Device Driver
    "uTorrent" = µTorrent
    "VLC media player" = VLC media player 1.1.0
    "WinRAR archiver" = WinRAR archiver

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 9/9/2011 9:09:42 AM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
    Description =

    Error - 9/9/2011 9:16:52 AM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
    Description =

    Error - 9/9/2011 9:23:43 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
    Description =

    Error - 9/9/2011 9:24:09 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
    Description =

    Error - 9/9/2011 9:24:09 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
    Description =

    Error - 9/9/2011 9:24:59 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
    Description =

    Error - 9/9/2011 9:24:59 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
    Description =

    Error - 9/9/2011 9:25:33 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
    Description =

    Error - 9/9/2011 9:25:33 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
    Description =

    Error - 9/9/2011 12:38:03 PM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
    Description =

    [ DigitalPersona Pro Events ]
    Error - 1/23/2010 5:25:56 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 1/25/2010 1:07:59 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 1/26/2010 1:41:06 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 1/27/2010 1:57:47 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 1/28/2010 2:20:04 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 1/29/2010 4:53:43 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 2/10/2010 1:29:23 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 2/12/2010 1:47:35 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 3/2/2010 9:33:51 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    Error - 3/2/2010 9:42:59 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
    Description = Agent cannot start. Description: Found other running Agent.

    [ Media Center Events ]
    Error - 6/17/2009 1:32:10 AM | Computer Name = Victor-Lappy | Source = MCUpdate | ID = 0
    Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

    Error - 9/22/2009 1:25:24 PM | Computer Name = Victor-Lappy | Source = MCUpdate | ID = 0
    Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

    [ System Events ]
    Error - 9/9/2011 11:12:06 PM | Computer Name = Victor-Lappy | Source = HTTP | ID = 15016
    Description =

    Error - 9/9/2011 11:13:10 PM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
    Description =

    Error - 9/9/2011 11:13:13 PM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
    Description =

    Error - 9/9/2011 11:13:29 PM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
    Description =

    Error - 9/9/2011 11:13:29 PM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
    Description =

    Error - 9/10/2011 10:41:42 AM | Computer Name = Victor-Lappy | Source = HTTP | ID = 15016
    Description =

    Error - 9/10/2011 10:42:45 AM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
    Description =

    Error - 9/10/2011 10:42:49 AM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
    Description =

    Error - 9/10/2011 10:43:06 AM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
    Description =

    Error - 9/10/2011 10:43:06 AM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
    Description =


    < End of report >
     
  16. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    The Immunization was successful with Panda; BitDefender did not even see my USB HDD. It may have been due to the drive running NTFS file system and Panda had NTFS support.
     
  17. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    We need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    ===================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
      O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
      O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
      O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
      O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
      O15 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
      O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
      [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
      [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
      [2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
      
      
      :Services
      
      :Reg
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
      "DisableMonitoring" =-
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  18. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
    Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
    Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http not found.
    Registry value HKEY_USERS\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
    Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
    C:\Windows\Downloaded Program Files\erma.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    C:\Windows\System32\ConduitEngine.tmp deleted successfully.
    C:\Windows\msdownld.tmp folder deleted successfully.
    C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33 moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Nata
    ->Temp folder emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: Victor
    ->Temp folder emptied: 3181 bytes
    ->Temporary Internet Files folder emptied: 252033 bytes
    ->Java cache emptied: 1 bytes
    ->FireFox cache emptied: 161311693 bytes
    ->Google Chrome cache emptied: 67058813 bytes
    ->Flash cache emptied: 11926 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 218.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: Nata

    User: Public

    User: Victor
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.27.0 log created on 09102011_162759

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
  19. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    Results of screen317's Security Check version 0.99.7
    Windows Vista Service Pack 1 (UAC is disabled!)
    Out of date service pack!!
    Internet Explorer 7 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Disabled!
    Avira AntiVir Personal - Free Antivirus
    WMI entry may not exist for antivirus; attempting automatic update.
    Avira successfully updated!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    TuneUp Utilities 2007
    CCleaner
    Java(TM) 6 Update 26
    Java(TM) 6 Update 27
    Out of date Java installed!
    Adobe Flash Player 10.3.183.7
    Mozilla Firefox (x86 en-US..) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Malwarebytes' Anti-Malware mbamservice.exe
    Avira Antivir avgnt.exe
    Avira Antivir avguard.exe
    ``````````End of Log````````````
     
  20. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    ESET is scanning right now. I will post the results in a moment.
     
  21. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    Here is what ESET found

    C:\Documents and Settings\Victor\AppData\Local\Google\Chrome\User Data\Default\Default\ockadbodpbkcggncpellnpfpmknldgga\contentscript.js Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\Documents and Settings\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{aa7b9bfa-4feb-4f84-bfb3-6cdcfc6e4a2c}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{5936b4c6-e34a-404d-81e8-b9a113182aa8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{5936b4c6-e34a-404d-81e8-b9a113182aa8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
     
  22. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    Uninstall Java(TM) 6 Update 26
     
  23. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    OK, Done! Just used Revo Uninstaller to uninstall that.
     
  24. Broni

    Broni Malware Annihilator Posts: 47,163   +264

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current (including Service Pack 2 installation and upgrading Internet Explorer to version 9!!!)

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
     
  25. Scathez

    Scathez TS Rookie Topic Starter Posts: 21

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Nata
    ->Temp folder emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: Victor
    ->Temp folder emptied: 46941624 bytes
    ->Temporary Internet Files folder emptied: 46689261 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 104153204 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 2379 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 4695583766 bytes

    Total Files Cleaned = 4,667.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: Nata

    User: Public

    User: Victor
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb



    OTL by OldTimer - Version 3.2.27.0 log created on 09102011_234654

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.