Solved Alureon infection, BSODs on scans, AVG cannot detect

Logs

GMER:

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-02-12 13:15:17
Windows 6.1.7600
Running: 48b1k0ec.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE2 0x31 0x28 0x1D ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x52 0x34 0x97 0x55 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xC9 0x92 0x6C 0x4C ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE2 0x31 0x28 0x1D ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x52 0x34 0x97 0x55 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xC9 0x92 0x6C 0x4C ...

---- EOF - GMER 1.0.15 ----

(Image courtesy animationplayhouse.com)

Welcome to TechSpot!
'Ill help with the problem- when I find it! Your scans will take a while as will my checking of your logs> it appears that you have everything on your system running in the background!!

An FYI for you: Some security program will report out malware that is no longer active in the system- such as if malware is in a System Restore point. Then is becomes difficult to find if any malware if currently active.

It appears that you may have some overlapping security programs, so please run this: Security Check

Download Security Check by screen317 from HERE or HERE .

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

====================================
Then Run Eset NOD32 Online AntiVirus scan HEREhttp://www.eset.eu/online-scanner

1. Tick the box next to YES, I accept the Terms of Use.
2. Click Start
3. When asked, allow the Active X control to install
4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
5. Click Start
6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
7. Click Scan
8. Wait for the scan to finish
9. Re-enable your Antivirus software.
10. A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

I will determine he next step after I see those logs.

Logs

Hi Bobbye--thanks for your help!
I normally just have AVG and MBAM, but have been trying a few other things to try and sort this.

Security Check log:

Results of screen317's Security Check version 0.99.8
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
AVG PC Tuneup 2011
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
AVG PC Tuneup 2011
Java(TM) 6 Update 23
Adobe Flash Player 10.1.102.64
Adobe Reader 9.4.2
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
Emsisoft Anti-Malware a2service.exe
``````````End of Log````````````



The Eset scanner reported no threats, and the log (in C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt) only had this:


ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK

Logs

Hi, I got impatient and successfully ran the AVG root-kit scan this morning. That's the first time it hasn't thrown a STOP error instantly. I decided not to remove any of the infections yet, and see if the log would help though (See below).

Also, the original Windows Action Center message about Alureon has gone completely, and there is nothing in archived messages. I did not do anything to 'okay it' or remove it. Not sure whether this is good or bad, clearly if there is something still there it is hiding fairly well!

Wondering whether to update Adobe Reader (noticed in previous thread) and disable&/remove the Emsisoft Anti-Malware/A2 Anti-virus program... but trying to resist the urge and hold off until I get futher instructions from you!


"Scan ""Anti-Rootkit scan"" completed."
"Rootkits";"28";"0";"28"
""
"Scan started:";"13 February 2011, 12:55:42"
"Scan finished:";"13 February 2011, 12:57:59 (2 minute(s) 16 second(s))"
"Total object scanned:";"419034"
"User who launched the scan:";"SYSTEM"

"Rootkits"
"";"File";"Infection";"Result"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_CREATE -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_CREATE_NAMED_PIPE -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_CLOSE -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_READ -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_WRITE -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_QUERY_INFORMATION -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_SET_INFORMATION -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_QUERY_EA -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_SET_EA -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_FLUSH_BUFFERS -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_QUERY_VOLUME_INFORMATION -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_SET_VOLUME_INFORMATION -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_DIRECTORY_CONTROL -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_FILE_SYSTEM_CONTROL -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_DEVICE_CONTROL -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_SHUTDOWN -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_LOCK_CONTROL -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_CLEANUP -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_CREATE_MAILSLOT -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_QUERY_SECURITY -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_SET_SECURITY -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_POWER -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_SYSTEM_CONTROL -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_DEVICE_CHANGE -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_QUERY_QUOTA -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_SET_QUOTA -> 0xFFFFFA8005DA18DD";"Object is hidden"
"";"<unknown>";"IRP hook, \Driver\mv91xx IRP_MJ_PNP -> 0xFFFFFA8005DA18DD";"Object is hidden"

Logs

The normal AVG scan picked up a few tracking cookies (nothing too unusual as far as I understand), I allowed it to heal/remove them. Log:


"Scan ""Scan specific files or folders"" completed."
"Warnings";"207";"207";"0"
"Information";"2"
"Folders selected for scanning:";"C:\;C:\Program Files;C:\Program Files (x86);C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files;C:\Users\Mark\AppData\Local\Temp;C:\Users\Mark\Documents;C:\Windows;C:\Windows\SysWOW64;C:\Windows\System32;"
"Scan started:";"13 February 2011, 13:02:47"
"Scan finished:";"13 February 2011, 13:09:40 (6 minute(s) 53 second(s))"
"Total object scanned:";"1839185"
"User who launched the scan:";"Mark"

"Warnings"
"";"File";"Infection";"Result"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@247realmedia[2].txt";"Found Tracking cookie.247realmedia";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@247realmedia[2].txt:\247realmedia.com.125a868c";"Found Tracking cookie.247realmedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@247realmedia[2].txt:\247realmedia.com.6b039dbe";"Found Tracking cookie.247realmedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@247realmedia[2].txt:\247realmedia.com.855b46d";"Found Tracking cookie.247realmedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@247realmedia[2].txt:\247realmedia.com.e14be39e";"Found Tracking cookie.247realmedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@247realmedia[2].txt:\247realmedia.com.fb81a031";"Found Tracking cookie.247realmedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@2o7[2].txt";"Found Tracking cookie.2o7";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@2o7[2].txt:\2o7.net.c7b585e6";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@7search[2].txt";"Found Tracking cookie.7search";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@7search[2].txt:\7search.com.5bc4302d";"Found Tracking cookie.7search";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@7search[2].txt:\7search.com.f2cc2494";"Found Tracking cookie.7search";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adbrite[1].txt";"Found Tracking cookie.Adbrite";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adbrite[1].txt:\adbrite.com.44f92a69";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adbrite[1].txt:\adbrite.com.71beeff9";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adbrite[1].txt:\adbrite.com.d5e309c2";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adbrite[1].txt:\adbrite.com.f796fd05";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt";"Found Tracking cookie.Adtech";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.2a854701";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.4cb5048b";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.5180539e";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.53b93bb1";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.91568bb6";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.9cbd4eca";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.9d5db0f5";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.a5279f16";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.a9245469";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.afa56ad1";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.ce2ad846";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.d32f3c9e";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.dd5bb7e";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.e2531618";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.ef259a5e";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adtech[2].txt:\adtech.de.fa8d0d40";"Found Tracking cookie.Adtech";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt";"Found Tracking cookie.Advertising";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt:\advertising.com.1820df7a";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt:\advertising.com.1dfa2206";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt:\advertising.com.203aa218";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt:\advertising.com.525a5fb9";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt:\advertising.com.893d35c2";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt:\advertising.com.b624fa46";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@advertising[1].txt:\advertising.com.f62113d5";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adviva[1].txt";"Found Tracking cookie.Adviva";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adviva[1].txt:\adviva.net.39ec90c";"Found Tracking cookie.Adviva";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@adviva[1].txt:\adviva.net.85256b16";"Found Tracking cookie.Adviva";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@atdmt[1].txt";"Found Tracking cookie.Atdmt";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@atdmt[1].txt:\atdmt.com.7247c262";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@atdmt[1].txt:\atdmt.com.74c5668";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@atdmt[1].txt:\atdmt.com.9e6d7fd3";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@atdmt[1].txt:\atdmt.com.b3e33b5f";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt";"Found Tracking cookie.Serving-sys";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt:\bs.serving-sys.com.5bf1f00f";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt";"Found Tracking cookie.Casalemedia";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.156cbc67";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.1773afc";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.2d37ad26";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.350339d4";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.3a28db8d";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.650648e8";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.80ad4799";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.8c65eddd";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.987e6b46";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@casalemedia[2].txt:\casalemedia.com.e1f88397";"Found Tracking cookie.Casalemedia";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@fastclick[1].txt";"Found Tracking cookie.Fastclick";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@fastclick[1].txt:\fastclick.net.57e8da10";"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@fastclick[1].txt:\fastclick.net.6fd479aa";"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@fastclick[1].txt:\fastclick.net.8a6435e9";"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@fastclick[1].txt:\fastclick.net.8dd1284a";"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@fastclick[1].txt:\fastclick.net.94ca190b";"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@fastclick[1].txt:\fastclick.net.9b41aa53";"Found Tracking cookie.Fastclick";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@gamershell[1].txt";"Found Tracking cookie.Gamershell";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@gamershell[1].txt:\gamershell.com.13a6979d";"Found Tracking cookie.Gamershell";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@gamershell[1].txt:\gamershell.com.8aafc627";"Found Tracking cookie.Gamershell";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@gamershell[1].txt:\gamershell.com.99c35e71";"Found Tracking cookie.Gamershell";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@gamershell[1].txt:\gamershell.com.ce59db3e";"Found Tracking cookie.Gamershell";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@liveperson[1].txt";"Found Tracking cookie.Liveperson";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@liveperson[1].txt:\liveperson.net.8db0737c";"Found Tracking cookie.Liveperson";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt";"Found Tracking cookie.Webtrends";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt:\m.webtrends.com.b4ca7df0";"Found Tracking cookie.Webtrends";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@mediaplex[1].txt";"Found Tracking cookie.Mediaplex";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@mediaplex[1].txt:\mediaplex.com.dc30fb3c";"Found Tracking cookie.Mediaplex";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@mediaplex[1].txt:\mediaplex.com.f652b123";"Found Tracking cookie.Mediaplex";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt";"Found Tracking cookie.2o7";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt:\msnportal.112.2o7.net.7225be6f";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@pro-market[2].txt";"Found Tracking cookie.Pro-market";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@pro-market[2].txt:\pro-market.net.bbf67f2d";"Found Tracking cookie.Pro-market";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@questionmarket[2].txt";"Found Tracking cookie.Questionmarket";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@questionmarket[2].txt:\questionmarket.com.3eb5a9f1";"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@questionmarket[2].txt:\questionmarket.com.4dd5e426";"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@questionmarket[2].txt:\questionmarket.com.767e4302";"Found Tracking cookie.Questionmarket";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt";"Found Tracking cookie.Revsci";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.18a1d1b2";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.265d6617";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.26b016c3";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.4260287e";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.4fdfee8f";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.50e13b1b";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.55564293";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.5d94181c";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.6ac59ebd";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.8d22fa22";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.8edf9499";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.b9b08de6";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.e936b9b1";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.f0067737";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.f3475212";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.f7ac007f";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@revsci[1].txt:\revsci.net.fb487293";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@ru4[1].txt";"Found Tracking cookie.Ru4";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@ru4[1].txt:\ru4.com.5a5e0633";"Found Tracking cookie.Ru4";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@ru4[1].txt:\ru4.com.82a499d7";"Found Tracking cookie.Ru4";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@ru4[1].txt:\ru4.com.83b89ffa";"Found Tracking cookie.Ru4";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@serving-sys[1].txt";"Found Tracking cookie.Serving-sys";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@serving-sys[1].txt:\serving-sys.com.176b0dad";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@serving-sys[1].txt:\serving-sys.com.3c465e6e";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@serving-sys[1].txt:\serving-sys.com.bb39fa8c";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@serving-sys[1].txt:\serving-sys.com.db46cecc";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@smartadserver[2].txt";"Found Tracking cookie.Smartadserver";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@smartadserver[2].txt:\smartadserver.com.321a5cf8";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@smartadserver[2].txt:\smartadserver.com.5550c4ed";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@smartadserver[2].txt:\smartadserver.com.bf8b766";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@smartadserver[2].txt:\smartadserver.com.c5827141";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt";"Found Tracking cookie.Dealtime";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt:\stat.dealtime.com.f58c396a";"Found Tracking cookie.Dealtime";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt";"Found Tracking cookie.Webtrendslive";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt:\statse.webtrendslive.com.b4ca7df0";"Found Tracking cookie.Webtrendslive";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tradedoubler[1].txt";"Found Tracking cookie.Tradedoubler";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tradedoubler[1].txt:\tradedoubler.com.a0d950bb";"Found Tracking cookie.Tradedoubler";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tradedoubler[1].txt:\tradedoubler.com.ba12c0e9";"Found Tracking cookie.Tradedoubler";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tradedoubler[1].txt:\tradedoubler.com.eab0972e";"Found Tracking cookie.Tradedoubler";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tradedoubler[1].txt:\tradedoubler.com.ef90aa95";"Found Tracking cookie.Tradedoubler";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@trafficmp[1].txt";"Found Tracking cookie.Trafficmp";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@trafficmp[1].txt:\trafficmp.com.4a13119";"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@trafficmp[1].txt:\trafficmp.com.a00e30b4";"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@trafficmp[1].txt:\trafficmp.com.f3e5803e";"Found Tracking cookie.Trafficmp";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tribalfusion[1].txt";"Found Tracking cookie.Tribalfusion";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tribalfusion[1].txt:\tribalfusion.com.5eef93d0";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tribalfusion[1].txt:\tribalfusion.com.7610f0e0";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tribalfusion[1].txt:\tribalfusion.com.8b22ad8c";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tribalfusion[1].txt:\tribalfusion.com.9bc3e98f";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tribalfusion[1].txt:\tribalfusion.com.dcc03271";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@tribalfusion[1].txt:\tribalfusion.com.ff8546b9";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@yadro[2].txt";"Found Tracking cookie.Yadro";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@yadro[2].txt:\yadro.ru.c77afad5";"Found Tracking cookie.Yadro";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@zedo[1].txt";"Found Tracking cookie.Zedo";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@zedo[1].txt:\zedo.com.27f1639b";"Found Tracking cookie.Zedo";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@zedo[1].txt:\zedo.com.a5b6a132";"Found Tracking cookie.Zedo";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@zedo[1].txt:\zedo.com.c1dd09f2";"Found Tracking cookie.Zedo";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@zedo[1].txt:\zedo.com.cef1c7af";"Found Tracking cookie.Zedo";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@zedo[1].txt:\zedo.com.dab23eee";"Found Tracking cookie.Zedo";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@zedo[1].txt:\zedo.com.dd15d628";"Found Tracking cookie.Zedo";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@2o7[2].txt";"Found Tracking cookie.2o7";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@2o7[2].txt:\2o7.net.87f47d84";"Found Tracking cookie.2o7";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt";"Found Tracking cookie.Yieldmanager";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\ad.yieldmanager.com.830b6f08";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\ad.yieldmanager.com.e626e6be";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@adbrite[1].txt";"Found Tracking cookie.Adbrite";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@adbrite[1].txt:\adbrite.com.44f92a69";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@adbrite[1].txt:\adbrite.com.d5e309c2";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@adbrite[1].txt:\adbrite.com.f796fd05";"Found Tracking cookie.Adbrite";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@advertising[2].txt";"Found Tracking cookie.Advertising";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@advertising[2].txt:\advertising.com.1dfa2206";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@advertising[2].txt:\advertising.com.525a5fb9";"Found Tracking cookie.Advertising";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[1].txt";"Found Tracking cookie.Atdmt";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[1].txt:\atdmt.com.7247c262";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[1].txt:\atdmt.com.b3e33b5f";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[2].txt";"Found Tracking cookie.Atdmt";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[2].txt:\atdmt.com.7247c262";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[2].txt:\atdmt.com.74c5668";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[2].txt:\atdmt.com.9e6d7fd3";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@atdmt[2].txt:\atdmt.com.b3e33b5f";"Found Tracking cookie.Atdmt";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt";"Found Tracking cookie.Serving-sys";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt:\bs.serving-sys.com.5bf1f00f";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt";"Found Tracking cookie.Webtrends";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt:\m.webtrends.com.b4ca7df0";"Found Tracking cookie.Webtrends";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@mediaplex[1].txt";"Found Tracking cookie.Mediaplex";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@mediaplex[1].txt:\mediaplex.com.dc30fb3c";"Found Tracking cookie.Mediaplex";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@mediaplex[1].txt:\mediaplex.com.f652b123";"Found Tracking cookie.Mediaplex";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt";"Found Tracking cookie.Revsci";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.18a1d1b2";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.50e13b1b";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.5d94181c";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.730f4d3f";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.f0067737";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@revsci[2].txt:\revsci.net.f7ac007f";"Found Tracking cookie.Revsci";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@ru4[1].txt";"Found Tracking cookie.Ru4";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@ru4[1].txt:\ru4.com.5a5e0633";"Found Tracking cookie.Ru4";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@serving-sys[1].txt";"Found Tracking cookie.Serving-sys";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@serving-sys[1].txt:\serving-sys.com.176b0dad";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@serving-sys[1].txt:\serving-sys.com.3c465e6e";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@serving-sys[1].txt:\serving-sys.com.db46cecc";"Found Tracking cookie.Serving-sys";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@smartadserver[2].txt";"Found Tracking cookie.Smartadserver";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@smartadserver[2].txt:\smartadserver.com.321a5cf8";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@smartadserver[2].txt:\smartadserver.com.3632541c";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@smartadserver[2].txt:\smartadserver.com.5550c4ed";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@smartadserver[2].txt:\smartadserver.com.bf8b766";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@smartadserver[2].txt:\smartadserver.com.c5827141";"Found Tracking cookie.Smartadserver";"Moved to Virus Vault"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@tribalfusion[2].txt";"Found Tracking cookie.Tribalfusion";"Healed"
"";"C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\mark@tribalfusion[2].txt:\tribalfusion.com.dcc03271";"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault"

"Information"
"";"File";"Information";"Result"
"";"C:\Users\Mark\Downloads\Game Files\x3\X3Update1.4_to_2.5.exe";"The file is signed with a broken digital signature, issued by: Microsoft Corporation.";""
"";"C:\Users\Mark\Downloads\Game Files\x3\X3Update1.4_to_2.5.exe:\{tmp}\wmfdist_xp32.exe";"The file is signed with a broken digital signature, issued by: Microsoft Corporation.";""

Logs

I've also run Microsoft's Malicious Software Removal Tool (Feb 2011) which says it checks for DOS and Win32 variants of Alureon. Seeing as these were the only guys who identified it in the first place (assuming it was correct)...

Results were clean, but I'm still a bit nervous, as I haven't done anything to remove it yet!

Normally I would take you to task for running another scan, but I see I didn't include this:
Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.

The reason for this is because programs are going to change the log entries I have to work with so please stop running scans and removing entries unless I instruct you to. AVG scans are useless. Usually most of what they show is tracking Cookies. You can prevent the be resetting Cookies in the browser not to accept 3rd party Cookies.
==========================================
And your files are all locked and cannot be accessed. I'm going to have you run Combofix and to do it, you will need to uninstall AVG:
Download Combofix to your desktop from one of these locations:
Link 1
Link 2http://www.forospyware.com/sUBs/ComboFix.exe

• Double click combofix.exe & follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
• Query- Recovery Console image
  
  
  
  

  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

  Click to expand...

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
  
• .Click on Yes, to continue scanning for malware
• .If Combofix asks you to update the program, allow
• .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• .Close any open browsers.
• .Double click combofix.exe
  
  & follow the prompts to run.
• When the scan completes it will open a text window. Please paste that log in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
================================================
You have several programs that are not compatible with the Win 7 OS> one may be this:
Product name: Sophos Anti-Rootkit
Description: Sophos boot tasks for Windows 2000
You need to look into these errors from the Event Viewer:
10/02/2011 23:36:58, Error: Service Control Manager [7000] - The MEMSWEEP2 service failed to start due to the following error: This driver has been blocked from loading
10/02/2011 23:36:58, Error: Application Popup [1060] - \??\C:\Windows\system32\3B81.tmp has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
10/02/2011 23:34:10, Error: Application Popup [1060] - \??\C:\Windows\system32\8D85.tmp has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

I see a lot of bug checks and mini dumps. I don't handle those here- there is a forum especially for the BSODs

ComboFix

Hi,
I attempted to run Combo Fix, exactly as you said, after removing AVG. The AVG uninstall process asked to restart, which gave a BSOD, but after that it appears to be removed properly (I used their removal tool to be certain.)

Ran Combo Fix, and saw it take a couple of actions but before the log came up it asked to restart, and as it did so, I had yet another BSOD.

I ran it a second time, and although it didn't seem to disconnect me from the internet (there was no notification and my sidebar gadget seemed to be normal) it worked, with another restart. Here is the log:




ComboFix 11-02-13.04 - Mark 14/02/2011 15:56:03.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.6135.4945 [GMT 0:00]
Running from: c:\users\Mark\Desktop\ComboFix.exe
AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2011-01-14 to 2011-02-14 )))))))))))))))))))))))))))))))
.

2011-02-13 13:19 . 2011-02-13 13:19 388096 ----a-r- c:\users\Mark\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-12 16:22 . 2011-02-12 16:22 -------- d-----w- c:\program files (x86)\ESET
2011-02-12 13:26 . 2011-02-12 13:26 -------- d-----w- c:\program files (x86)\Trend Micro
2011-02-10 23:37 . 2009-06-18 12:55 18816 ------w- c:\windows\SysWow64\SAVRKBootTasks.sys
2011-02-10 23:31 . 2011-02-02 17:10 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B7D062D9-1C6A-4E38-AD69-5A49B387AA8C}\mpengine.dll
2011-02-10 18:14 . 2011-02-14 15:48 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2011-02-09 21:59 . 2011-02-09 22:00 -------- d-----w- c:\users\Mark\AppData\Roaming\gtk-2.0
2011-02-09 21:30 . 2011-02-09 22:02 -------- d-----w- c:\users\Mark\.dia
2011-02-09 21:30 . 2011-02-09 21:30 -------- d-----w- c:\program files (x86)\Dia
2011-02-09 13:11 . 2011-02-09 13:11 -------- d-----w- C:\NVIDIA
2011-02-09 11:37 . 2010-12-18 03:39 1502208 ----a-w- c:\windows\system32\inetcpl.cpl
2011-02-09 11:37 . 2010-12-18 03:35 2381824 ----a-w- c:\windows\system32\mshtml.tlb
2011-02-09 11:37 . 2010-12-18 03:19 1448448 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2011-02-09 11:37 . 2010-12-18 03:15 2381824 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-01-31 19:57 . 2011-01-31 19:57 -------- d-----w- c:\program files\iTunes
2011-01-31 19:57 . 2011-01-31 19:57 -------- d-----w- c:\program files (x86)\iTunes
2011-01-31 19:57 . 2011-01-31 19:57 -------- d-----w- c:\program files\iPod
2011-01-30 18:45 . 2011-02-01 20:57 -------- d-----w- c:\users\Mark\AppData\Roaming\TS3Client
2011-01-30 18:44 . 2011-01-30 18:44 -------- d-----w- c:\program files\TeamSpeak 3 Client
2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2011-01-26 18:27 . 2011-01-26 18:27 -------- d-----w- c:\program files (x86)\Egosoft
2011-01-26 13:43 . 2008-07-12 08:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll
2011-01-26 13:43 . 2008-07-12 08:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2011-01-26 13:43 . 2008-07-12 08:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll
2011-01-26 13:43 . 2008-07-12 08:18 540688 ----a-w- c:\windows\system32\d3dx10_39.dll
2011-01-26 13:43 . 2008-07-12 08:18 4992520 ----a-w- c:\windows\system32\D3DX9_39.dll
2011-01-26 13:43 . 2008-07-12 08:18 1942552 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2011-01-17 13:14 . 2011-01-17 13:15 -------- d-----w- c:\users\Mark\AppData\Roaming\HTC
2011-01-17 13:14 . 2011-01-25 10:42 -------- d-----w- c:\program files (x86)\HTC
2011-01-17 13:14 . 2011-01-17 13:14 -------- d-----w- c:\program files (x86)\MSXML 4.0
2011-01-17 11:23 . 2011-01-05 19:03 62448 ----a-w- c:\windows\system32\drivers\RapportKE64.sys
2011-01-17 11:23 . 2011-01-17 11:23 -------- d-----w- c:\users\Mark\AppData\Roaming\Trusteer
2011-01-17 11:23 . 2011-01-17 11:23 -------- d-----w- c:\program files (x86)\Trusteer
2011-01-17 11:22 . 2011-01-17 11:22 -------- d-----w- c:\programdata\Trusteer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-08 23:24 . 2010-09-27 18:15 270904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-02-08 23:24 . 2010-09-08 21:27 270904 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-02-08 23:19 . 2010-09-08 21:27 215128 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-02-02 17:11 . 2010-09-07 16:24 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-01-08 03:27 . 2010-10-29 18:20 7729256 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-01-08 03:27 . 2010-10-29 18:20 2200680 ----a-w- c:\windows\system32\nvapi64.dll
2011-01-08 03:27 . 2010-10-29 18:20 12859496 ----a-w- c:\windows\system32\nvd3dumx.dll
2011-01-08 03:27 . 2010-10-29 18:20 10078312 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2011-01-07 20:50 . 2011-01-07 20:50 795752 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll
2011-01-07 20:50 . 2011-01-07 20:50 6143080 ----a-w- c:\windows\system32\nvcpl.dll
2011-01-07 20:49 . 2011-01-07 20:49 3156072 ----a-w- c:\windows\system32\nvsvc64.dll
2011-01-07 20:49 . 2011-01-07 20:49 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-01-07 20:49 . 2011-01-07 20:49 2558568 ----a-w- c:\windows\system32\nvsvcr.dll
2011-01-07 20:49 . 2011-01-07 20:49 1005160 ----a-w- c:\windows\system32\nvvsvc.exe
2010-12-20 18:09 . 2010-11-15 18:43 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2010-12-20 18:08 . 2010-11-15 18:43 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-19 18:12 . 2010-09-08 21:27 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2010-12-06 13:46 . 2010-12-06 13:43 2142976 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2010-11-29 17:38 . 2010-11-29 17:38 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2010-11-29 17:38 . 2010-11-29 17:38 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2010-11-23 16:06 . 2010-11-23 16:06 834544 ----a-w- c:\windows\system32\drivers\sptd.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2009-05-25 210216]
"UpdatePPShortCut"="c:\program files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"RemoteControl8"="c:\program files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-07-16 91432]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"PDVD8LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-01-22 106496]
"MDS_Menu"="c:\program files (x86)\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"InstantBurn"="c:\progra~2\CYBERL~1\INSTAN~1\Win2K\IBurn.exe" [2008-10-17 681256]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-04-30 103720]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared Files\brs.exe" [2009-08-28 75048]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

c:\users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisableThumbnailsOnNetworkFolders"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-10-09 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-10-09 79360]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [2010-05-05 202840]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [2010-05-05 1417304]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [2010-05-05 94808]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\3B81.tmp [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-07 1255736]
R4 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-01-05 821048]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-11-23 834544]
S0 mv91cons;Marvell 91xx Config Device Driver;c:\windows\system32\DRIVERS\mv91cons.sys [2009-10-27 22568]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [2009-12-25 297512]
S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys [2011-01-05 62448]
S1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\DRIVERS\CLBStor.sys [2008-10-14 24560]
S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-01-05 50672]
S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-01-05 58864]
S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2010/10/29 18:15];c:\program files (x86)\CyberLink\PowerDVD8\000.fcl [2009-08-28 17:36 146928]
S2 CLBUDF;CyberLink InstantBurn UDF Filesystem; [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
S2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2009-12-17 497856]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [2010-05-05 202840]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [2010-05-05 1417304]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [2010-05-05 94808]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 77824]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 180224]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-11-11 155752]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]


[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-01-27 21:28 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1609296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:Tabs
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
.
- - - - ORPHANS REMOVED - - - -

Wow6432Node-HKCU-Run-Google Update - c:\users\Mark\AppData\Local\Google\Update\GoogleUpdate.exe
Wow6432Node-HKLM-Run-Name of App - c:\program files (x86)\SAMSUNG\FW LiveUpdate\FWManager.exe
Wow6432Node-HKLM-Run-CTxfiHlp - CTXFIHLP.EXE
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_bc2.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\3B81.tmp"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD8\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3968718095-3507211263-3057274292-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:6e,3b,93,1a,ee,70,98,b3,a5,8d,4c,e9,8d,e4,fa,b9,f9,8f,ee,f0,48,57,af,
a8,5c,89,35,a7,62,df,dd,f3,05,d3,60,d4,94,3a,ef,58,01,1d,de,75,03,ca,ab,b1,\
"??"=hex:65,34,23,f1,ac,3e,ae,99,14,20,f8,2a,53,ca,02,2f

[HKEY_USERS\S-1-5-21-3968718095-3507211263-3057274292-1001\Software\SecuROM\License information*]
"datasecu"=hex:3d,80,b5,5f,55,34,3d,3c,ea,05,33,8f,a3,b9,a9,54,00,b5,be,a4,b5,
e4,df,c7,65,c5,a0,ee,d7,2d,95,10,7b,6c,1e,64,ca,ec,a9,10,e3,37,88,02,25,d1,\
"rkeysecu"=hex:da,69,69,92,06,8f,39,9e,b4,53,bf,d3,ff,f8,83,ad

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_10_2_161_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_10_2_161_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\CyberLink\InstantBurn\Win2K\IBurn.exe
.
**************************************************************************
.
Completion time: 2011-02-14 15:59:57 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-14 15:59

Pre-Run: 26,261,516,288 bytes free
Post-Run: 25,471,942,656 bytes free

- - End Of File - - FB6E75E3E450D27377A481F60A81A9C5

...

I will remove the Sophos software, and look into the BSODs on the other forum once this is sorted, although I assumed they were related, as I only had them very rarely before.

The MEMSWEEP event details are as follows:

- System

- Provider

[ Name] Service Control Manager
[ Guid] {555908d1-a6d7-4695-8e1e-26931d2012f4}
[ EventSourceName] Service Control Manager

- EventID 7000

[ Qualifiers] 49152

Version 0

Level 2

Task 0

Opcode 0

Keywords 0x8080000000000000

- TimeCreated

[ SystemTime] 2011-02-10T23:36:58.825107400Z

EventRecordID 62419

Correlation

- Execution

[ ProcessID] 864
[ ThreadID] 1816

Channel System

Computer Mark-PC

Security


- EventData

param1 MEMSWEEP2
param2 %%1275



I could not glean anything else from event viewer.

The details for the next one you mentioned are:

- System

- Provider

[ Name] Application Popup

- EventID 26

[ Qualifiers] 16384

Level 4

Task 0

Keywords 0x80000000000000

- TimeCreated

[ SystemTime] 2011-02-10T23:36:56.859503900Z

EventRecordID 62414

Channel System

Computer Mark-PC

Security


- EventData


\??\C:\Windows\system32\3B81.tmp failed to load
0000000002003000000000001A000040280400C06C0200C000000000000000000000000000000000


--------------------------------------------------------------------------------

Binary data:


In Words

0000: 00000000 00300002 00000000 4000001A
0008: C0000428 C000026C 00000000 00000000
0010: 00000000 00000000


In Bytes

0000: 00 00 00 00 02 00 30 00 ......0.
0008: 00 00 00 00 1A 00 00 40 .......@
0010: 28 04 00 C0 6C 02 00 C0 (..Àl..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


and the third one is pretty similar:

- System

- Provider

[ Name] Application Popup

- EventID 26

[ Qualifiers] 16384

Level 4

Task 0

Keywords 0x80000000000000

- TimeCreated

[ SystemTime] 2011-02-10T23:34:10.025213800Z

EventRecordID 62406

Channel System

Computer Mark-PC

Security


- EventData


\??\C:\Windows\system32\8D85.tmp failed to load
0000000002003000000000001A000040280400C06C0200C000000000000000000000000000000000


--------------------------------------------------------------------------------

Binary data:


In Words

0000: 00000000 00300002 00000000 4000001A
0008: C0000428 C000026C 00000000 00000000
0010: 00000000 00000000


In Bytes

0000: 00 00 00 00 02 00 30 00 ......0.
0008: 00 00 00 00 1A 00 00 40 .......@
0010: 28 04 00 C0 6C 02 00 C0 (..Àl..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........




I have no idea what they are, except that MEMSWEEP may be part of the Sophos anti-rootkit software. Shall I uninstall it now?

Combo Fix

Just noticed that in C:\Qoobox\ComboFix-quarantined-files.txt the log is slightly different to what I posted before (see below). The file 6363.tmp.vir could have been what it dealt with the first time I ran it but lost the log due to the crash... Hope its useful.

2011-02-14 15:59:24 . 2011-02-14 15:59:24 2,966 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-PunkBusterSvc.reg.dat
2011-02-14 15:59:09 . 2011-02-14 15:59:09 119 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-HKLM-Run-CTxfiHlp.reg.dat
2011-02-14 15:59:09 . 2011-02-14 15:59:09 174 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-HKLM-Run-Name of App.reg.dat
2011-02-14 15:59:08 . 2011-02-14 15:59:08 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-HKCU-Run-Google Update.reg.dat
2011-02-14 15:52:19 . 2011-02-14 15:57:19 5,249 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2011-02-14 15:50:37 . 2011-02-14 15:55:40 102 ----a-w- C:\Qoobox\Quarantine\catchme.log
2011-02-14 15:50:06 . 2011-02-14 15:50:06 349,648 ----a-w- C:\Qoobox\Quarantine\C\Users\Mark\AppData\Local\Temp\6363.tmp.vir

Ok having major issues now! Had BSOD related to rapport driver, restarted, but couldn't boot Windows. Eventually booted recovery console from windows disc and let it auto repair. It found the master boot record was corrupt and did disk metadata repairs.

Restart failed with new Bsod just as Windows starts to boot. Stop error is 0X0000007B, which according to Microsoft article is either due to new hardware issue, or is due to a boot sector virus. This is why I'm still posting here, and desperately need help! The MS article is http://support.microsoft.com/kb/324103.

I tried a system file integrity check but repair failed.

I have files on the system I really need to keep, so if there is any way...

Somehow, I've managed to repair the MBR, (exported it to delete it and create a new one), then couldn't boot due to BSOD on RapportPG64.sys.

Got into Safe Mode, and manually uninstalled Rapport (following instructions from Trusteer's website).

Now I can boot again! But system doesn't feel entirely stable, a few slow ups etc. I await further instructions/condemnation! Expect you'll have to start again with fresh scans after all that activity?!

Another detection

Sorry to post again before you've had a chance to take a look through, but figured I should keep the thread up-to-date!

Booted today to find Avira has detected the trojan TR/Mooplids.A.4 (mhkvqgwm.dll) and has automatically moved it into quarantine.

Haven't scanned or produced any more logs as of yet--learnt my lesson

I'm not sure what you are wanting to do. In this forum, we look for malware and hopefully remove it. You continue to give problems that are 'system' in nature, not 'malware'. If you have an antivirus program and it finds a bad entry and puts it in Quarantine, that's what you have it for and that's what it's suppose to do.

Once you did the repair, the previous logs were no longer applicable.

You're having Memory dumps, Bug Checks and creating mini-dump files. These are what are most likely the cause of the BSOD. But I don't handle this- there is a forum especially for this. You need to get the system stabilized so a scan can be run without producing a BSOD or making you do a repair.

I am going to close this thread. Please let the members in the BSOD forum help you find and resolve the drivers causing the errors. After that has been done, if you still think you have a malware issue, return here and start a new thread with references to the URL for this thread and also the thread in the BSOD forum. Run Mbam, GMER and DDS again and leave the new logs.

In the meantime, Removing all of the tools we used and the files and folders they created

• Uninstall ComboFix and all Backups of the files it deleted
• Click START> then RUN
• Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  

• Download OTCleanIt by OldTimer and save it to your Desktop.
• Double click OTCleanIt.exe.
• Click the CleanUp! button.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes.

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.
(I m not having you remove the old restore points yet because I'm not sure if the system is clean yet.)
==============================================
When I left the following, I did not mean for you to give me the details from the Event Viewer- I meant for you to see what the incompatible programs were and either uninstall them or update them, whichever is the most appropriate:

You need to look into these errors from the Event Viewer:
10/02/2011 23:36:58, Error: Service Control Manager [7000] - The MEMSWEEP2 service failed to start due to the following error: This driver has been blocked from loading
10/02/2011 23:36:58, Error: Application Popup [1060] - \??\C:\Windows\system32\3B81.tmp has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
10/02/2011 23:34:10, Error: Application Popup [1060] - \??\C:\Windows\system32\8D85.tmp has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Click to expand...