Inactive Laptop taken over by apype and smartwebsearch

[Broni]

Try from Safe Mode.

 

[frh]

IE Reset doesn't remove Smartwebsearch

Couldn't get into safe mode by normal routes. Finally got there by switching off via long power key press. Reset IE in Safe Mode (all options selected) and Smartwebsearch is still there after normal reboot. Should I go ahead and run OTL with your latest code?

 

[Broni]

Yes, go ahead and when done post fresh OTL log as well.

 

[frh]

4th OTL Log Pt 1

Didn't get a log after Run Fix. Still seeing Smartwebsearch in IE and Firefox. Chrome and Safari still hijacked. Log after Quick Scan:


OTL logfile created on: 22-Nov-11 4:42:28 AM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Daddy\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy

3.87 Gb Total Physical Memory | 2.21 Gb Available Physical Memory | 57.09% Memory free
7.73 Gb Paging File | 5.82 Gb Available in Paging File | 75.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 451.01 Gb Total Space | 306.42 Gb Free Space | 67.94% Space Free | Partition Type: NTFS
Drive D: | 457.02 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: HOLDER-PC | User Name: Daddy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011-11-22 00:03:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
PRC - [2011-11-03 12:06:56 | 002,152,152 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011-11-03 12:06:56 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2011-09-06 21:45:28 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011-06-06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011-04-18 11:01:12 | 001,827,328 | ---- | M] (AudioEngines Inc.) -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe
PRC - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
PRC - [2011-01-13 20:54:26 | 000,464,856 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
PRC - [2011-01-13 20:42:12 | 003,811,648 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
PRC - [2011-01-13 20:39:32 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
PRC - [2011-01-13 20:37:02 | 000,705,856 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
PRC - [2010-11-02 00:02:18 | 001,427,952 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
PRC - [2010-11-02 00:02:12 | 000,522,736 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
PRC - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010-06-08 17:49:26 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010-03-03 21:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010-03-03 21:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009-12-29 21:19:14 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
PRC - [2009-09-13 00:09:10 | 000,103,768 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
PRC - [2009-09-13 00:09:04 | 000,550,232 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
PRC - [2009-06-24 23:21:38 | 000,409,744 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
PRC - [2009-06-09 15:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2007-05-21 00:37:36 | 000,124,512 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE


========== Modules (No Company Name) ==========

MOD - [2011-10-14 02:48:07 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\6d859463c9e6a7423ddb335211a79dda\System.Core.ni.dll
MOD - [2011-10-14 02:46:54 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\dde0e0cfec8f496421c5f5415d623480\IAStorUtil.ni.dll
MOD - [2011-10-14 02:41:07 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5672e6b9d976feca51deb06d8dd1df0e\PresentationFramework.Aero.ni.dll
MOD - [2011-10-14 02:40:51 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\018d2569cf208acbe8ad73908705f607\System.Runtime.Remoting.ni.dll
MOD - [2011-10-14 02:40:40 | 014,322,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\09e39322b47f9b4e8dd2199ff03acb2e\PresentationFramework.ni.dll
MOD - [2011-10-14 02:40:26 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d76221993c2fdfb991b8c12ae50a30eb\System.Windows.Forms.ni.dll
MOD - [2011-10-14 02:40:19 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e245eb9c1067cabd5673fe832d28613\System.Drawing.ni.dll
MOD - [2011-10-14 02:40:16 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\d2dc021a8311197516e4fa325b292f21\PresentationCore.ni.dll
MOD - [2011-10-14 02:40:07 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\3136e12cfb8809d39813e76c766c782c\WindowsBase.ni.dll
MOD - [2011-10-14 02:40:02 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\275680f2b9db0501d53c50ea7d7a43f0\System.Xml.ni.dll
MOD - [2011-10-14 02:39:59 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e9ebeb7959f1c916ebf6fca8f7077d6c\System.Configuration.ni.dll
MOD - [2011-10-14 02:39:57 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\95b9866ab6e4437ef5dc5855ebab4e33\System.ni.dll
MOD - [2011-10-14 02:39:48 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
MOD - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
MOD - [2011-03-21 17:30:20 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011-01-13 20:42:02 | 000,025,920 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftBRCCPiped.dll
MOD - [2011-01-13 20:39:32 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
MOD - [2011-01-13 20:37:50 | 000,079,168 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll
MOD - [2011-01-13 20:37:26 | 000,075,072 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll
MOD - [2011-01-13 20:37:24 | 000,111,936 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll
MOD - [2011-01-13 20:37:20 | 000,121,152 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll
MOD - [2011-01-13 20:37:18 | 000,128,320 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
MOD - [2011-01-13 20:37:14 | 000,234,816 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll
MOD - [2011-01-13 20:37:04 | 000,025,920 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STBRCCServCLR.dll
MOD - [2011-01-13 20:36:50 | 001,123,648 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dll
MOD - [2010-11-02 00:02:18 | 001,427,952 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
MOD - [2010-11-02 00:02:12 | 000,522,736 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
MOD - [2010-11-02 00:02:06 | 000,657,904 | ---- | M] () -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\BBEngineAS.dll
MOD - [2010-08-30 10:34:12 | 000,375,280 | ---- | M] () -- c:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\SQLite352.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011-09-06 21:45:28 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010-09-23 01:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010-06-18 06:10:14 | 000,258,048 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
SRV:64bit: - [2010-06-02 07:30:28 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010-02-03 05:13:10 | 000,048,128 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
SRV:64bit: - [2009-12-29 21:19:12 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009-06-09 15:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV:64bit: - [2009-03-03 11:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV - [2011-11-03 12:06:56 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011-08-31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011-06-06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011-01-13 20:37:02 | 000,705,856 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE -- (SftService)
SRV - [2010-12-08 14:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010-09-04 08:15:22 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
SRV - [2010-09-04 08:14:26 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
SRV - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010-03-18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010-03-03 21:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010-03-03 21:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009-06-06 01:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe -- (GameConsoleService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011-11-03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2011-09-06 21:38:18 | 000,601,944 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2011-09-06 21:38:16 | 000,301,912 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2011-09-06 21:36:41 | 000,058,200 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2011-09-06 21:36:41 | 000,042,328 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr.sys -- (aswRdr)
DRV:64bit: - [2011-09-06 21:36:30 | 000,065,368 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2011-09-06 21:36:14 | 000,024,408 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2011-05-10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011-03-11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011-03-11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010-09-23 01:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010-07-30 14:18:04 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:64bit: - [2010-07-30 14:18:02 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:64bit: - [2010-07-30 14:18:00 | 000,026,624 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:64bit: - [2010-07-30 14:17:56 | 000,019,456 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:64bit: - [2010-07-21 17:59:28 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2010-06-23 10:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010-06-18 06:10:14 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2010-06-08 17:33:14 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010-06-02 07:50:28 | 006,857,728 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010-06-02 06:42:48 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010-05-06 14:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010-03-30 20:58:06 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010-03-30 20:58:06 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010-03-30 20:58:06 | 000,053,800 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2010-03-30 20:58:06 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010-03-30 20:58:06 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010-03-19 10:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010-03-17 22:44:44 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010-03-17 22:29:52 | 000,232,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010-02-03 05:13:08 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)
DRV:64bit: - [2010-02-03 05:13:08 | 000,020,984 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcmvwl64.sys -- (BcmVWL)
DRV:64bit: - [2010-02-03 05:13:06 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009-09-17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009-09-08 19:13:16 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)
DRV:64bit: - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009-07-14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009-07-14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009-07-14 01:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2009-06-15 20:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2009-06-10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009-06-10 21:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009-05-18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008-08-28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2007-07-11 15:57:08 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
DRV:64bit: - [2007-07-11 11:07:36 | 000,029,696 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
DRV:64bit: - [2007-07-11 11:04:40 | 000,016,896 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
DRV:64bit: - [2006-11-01 19:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2011-11-17 22:51:46 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2002-07-17 08:53:02 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\ASPI32.SYS -- (Aspi32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736
FF - prefs.js..extensions.enabledItems: wrc@avast.com:6.0.1289
FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll ( )
FF - HKLM\Software\MozillaPlugins\@ganymede/SNOOKER,version=1.0: C:\Program Files (x86)\Ganymede\Plugins\SNOOKER\NPSNOOKER.dll (Ganymede Technologies)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\ [2011-05-22 16:13:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-10-16 20:29:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-11-13 01:48:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011-11-13 01:48:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011-08-03 19:01:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]

[2011-01-25 00:36:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daddy\AppData\Roaming\Mozilla\Extensions
[2011-08-30 14:55:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\extensions
[2011-11-22 04:39:52 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
[2011-11-13 01:48:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011-10-16 20:29:05 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2011-11-05 07:53:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2009-09-13 00:05:42 | 000,124,240 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
[2009-09-13 00:06:22 | 000,070,488 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
[2009-09-13 00:06:32 | 000,091,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
[2009-09-13 00:06:28 | 000,022,360 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
[2011-03-13 01:14:04 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010-11-24 12:12:30 | 000,120,296 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npganymedenet.dll
[2009-09-13 00:08:36 | 000,406,864 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
[2011-04-21 10:47:56 | 000,636,408 | ---- | M] (Ganymede Technologies) -- C:\Program Files (x86)\mozilla firefox\plugins\NPSNOOKER.dll
[2009-09-13 00:06:24 | 000,023,896 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll
[2011-11-05 04:21:03 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011-11-05 04:21:03 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - Extension: avast! WebRep = C:\Users\Daddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\6.0.1289_0\

O1 HOSTS File: ([2011-11-21 23:23:50 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (ALOT Appbar Helper) - {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - C:\Program Files (x86)\alotappbar\bin\BHO\ALOTHelperBHO.dll (Vertro)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (ALOT Appbar) - {A531D99C-5A22-449b-83DA-872725C6D0ED} - C:\Program Files (x86)\alotappbar\bin\alothelper.dll (Vertro)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE (Dell Inc.)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\oem\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (CANON INC.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [YoutubeDownloader] C:\Program Files (x86)\OneStopSoft.com\Youtube Downloader\Youtube Downloader.exe (SoundInDepth.com)
O4 - HKCU..\Run: [Foco] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe (AudioEngines Inc.)
O4 - HKCU..\Run: [NTServiceManager] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe ()
O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - Startup: C:\Users\Daddy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79961CF1-3CDA-45FB-901A-89BFE1CA5050}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2000-08-15 17:00:34 | 000,000,041 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

[frh]

4th OTL Log Pt 2

========== Files/Folders - Created Within 30 Days ==========

[2011-11-22 04:41:00 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E2E09817-E277-4AA0-A55D-5657F5BF82CD}
[2011-11-22 04:40:36 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{DC0AD153-B620-4643-979A-FE6A8D9D02B1}
[2011-11-22 04:10:57 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{957FA4B2-6880-4BCF-B4C5-A2972BEC13D8}
[2011-11-22 04:10:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D4120A0C-ED31-4970-AEB0-D68A66129E44}
[2011-11-22 03:49:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{0799F999-605E-4E7C-95B0-83C26E5CE6C9}
[2011-11-22 03:49:31 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{228F0A0D-C961-45C2-BE2E-20393F840167}
[2011-11-22 03:09:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C0EA4F15-218D-4DE2-A03A-1C9A63A5F359}
[2011-11-22 03:09:04 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{CCDD6E87-DF2F-4E33-908D-871A959F904F}
[2011-11-22 01:52:34 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{4A04BC3A-025E-450E-8493-E29460CDB901}
[2011-11-22 01:52:10 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7084EB2B-95BE-43B8-97C1-43DCC21AEC59}
[2011-11-22 01:46:55 | 000,000,000 | ---D | C] -- C:\_OTL
[2011-11-22 01:29:56 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{25F3A49C-2AF9-4B5A-AB28-1EDF1C8C8C28}
[2011-11-22 01:29:43 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7EE5991D-6395-4D24-910D-0DBB27E96063}
[2011-11-22 01:28:58 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011-11-22 00:03:14 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
[2011-11-21 23:45:37 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011-11-21 22:34:03 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011-11-21 22:18:41 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{5E7B5DCA-C3B3-4A99-9D3D-680C7A78E055}
[2011-11-21 22:18:17 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{1C3D6565-DAD5-43F7-8C4F-E40F215061BB}
[2011-11-21 00:03:07 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011-11-21 00:03:07 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011-11-21 00:03:07 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011-11-20 23:56:39 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011-11-20 00:52:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011-11-20 00:45:56 | 004,303,424 | R--- | C] (Swearware) -- C:\Users\Daddy\Desktop\ComboFix.exe
[2011-11-20 00:39:14 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Daddy\Desktop\aswMBR.exe
[2011-11-19 20:47:09 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Daddy\Desktop\dds.scr
[2011-11-19 20:17:20 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{63345C7D-CA91-4DDE-9B6C-13DEAB8BDCC6}
[2011-11-19 20:17:06 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{02F99136-B844-4E35-9B64-951485D46D9C}
[2011-11-19 19:24:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D8435C12-1580-4EE8-B6B2-4D304241ECAE}
[2011-11-19 19:24:04 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{BDFDC5D8-FF77-4040-A255-5F5E98FDE185}
[2011-11-19 07:07:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011-11-19 02:08:07 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2F578588-C781-431C-ADD9-0516BF9CAD46}
[2011-11-19 02:07:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D96D471F-F887-4943-BA8D-1BE6744B3711}
[2011-11-18 00:04:17 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{D4DEB02B-6B22-4554-BE3D-380F4A674286}
[2011-11-18 00:03:53 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{220F4A37-1030-4E58-ACC9-EA1736633762}
[2011-11-17 22:51:46 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011-11-17 22:48:42 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
[2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011-11-17 22:48:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
[2011-11-17 22:06:46 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2011-11-17 22:02:22 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{81547243-F6A2-4239-9C23-E069E5E74095}
[2011-11-17 22:02:09 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{3FE19719-756B-404B-89D9-4B1082BC60D9}
[2011-11-17 02:12:11 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C83F3967-5A6B-4CC4-A910-458C64F5BBCC}
[2011-11-17 02:11:54 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{49FE06D3-4FB6-4D17-97A3-09501CE0289A}
[2011-11-17 00:50:10 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A0C1B9FE-5C97-4CAD-B6B6-869C5B07B666}
[2011-11-17 00:50:01 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B7AF6830-B83F-4D30-A3AB-D0A07ED89A4B}
[2011-11-15 17:25:44 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{181EA340-CA15-4186-8654-D6E91FC54FA1}
[2011-11-15 17:25:33 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{31B81133-FD5A-4F7E-BCFC-0D0698FA715C}
[2011-11-15 17:14:35 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{6AD1A3C3-EA33-4060-9BA2-8E405CB7076D}
[2011-11-15 17:14:28 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{867956E2-F466-4ECF-8F75-97504C719CB7}
[2011-11-15 00:42:57 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{BC66E416-D557-428A-8DDF-AC62A68E7AD0}
[2011-11-15 00:42:56 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A939B63C-FF12-4D6B-9B06-77650BCC780E}
[2011-11-14 19:23:49 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C49AA169-4690-4196-9A34-E0B1EA4657DB}
[2011-11-14 19:23:15 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C55EDE01-C58B-4BA6-BC8C-7F7D4CDDCC26}
[2011-11-13 02:15:50 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B260EFF4-0419-4833-9576-6648A05D0FF7}
[2011-11-13 02:15:45 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{90B51F54-335F-418D-A9BA-AC2010F8A5EC}
[2011-11-13 01:05:32 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{B4388EDC-CFA5-41B3-A1C2-40F2BA73CAD1}
[2011-11-13 01:05:08 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{5F0B7321-5FFE-464E-B4A5-10382CFA2D46}
[2011-11-12 19:49:06 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2011-11-12 19:47:52 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{7670782F-5632-4DEA-B553-4479C38DE2A4}
[2011-11-12 19:47:41 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{68703C67-9D01-4F8C-9F4A-75E0C5AEFC5B}
[2011-11-12 00:05:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEGV
[2011-11-11 23:52:43 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{91F1BC4B-9AAD-4E23-8B5B-35636FFC9A26}
[2011-11-11 23:52:32 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{A3063E73-CECB-437F-A8B0-6F054BA57505}
[2011-11-11 01:38:02 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E788BC36-449E-4918-B6B0-50F123A4305E}
[2011-11-10 15:06:20 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{6154443F-D3EF-4819-9FBD-06F2B7894590}
[2011-11-10 15:06:07 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{66A37168-9B2D-48E8-90EE-A349C7ACF0A2}
[2011-11-10 14:51:25 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{390B54B8-0CA0-42FF-9FD0-C7CA3BBA4578}
[2011-11-06 23:12:53 | 000,000,000 | ---D | C] -- C:\Users\Daddy\Documents\Photos
[2011-11-06 23:12:23 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{E629B392-F9B7-4889-A277-E43D4BEE4961}
[2011-11-04 20:41:29 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{60AB8944-1C45-4416-803D-455132F4B967}
[2011-11-04 20:41:18 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2A95A727-8526-4BC1-A6E5-56EC93220E9F}
[2011-10-30 17:28:14 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{C36D71FA-30C7-4638-A0E8-DA1ADED7652B}
[2011-10-30 17:28:02 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{2B98BDD9-6857-4BC8-B3D0-8C828082DFDA}
[2011-10-26 18:24:48 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{AFE03083-33EA-4C4C-AC7E-BDE359EE15DA}
[2011-10-26 18:24:37 | 000,000,000 | ---D | C] -- C:\Users\Daddy\AppData\Local\{8083DF18-8708-456F-AC79-6D88497607C2}

========== Files - Modified Within 30 Days ==========

[2011-11-22 04:47:11 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011-11-22 04:47:11 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011-11-22 04:43:03 | 000,730,448 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011-11-22 04:43:03 | 000,627,316 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011-11-22 04:43:03 | 000,107,600 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011-11-22 04:38:59 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011-11-22 04:38:42 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011-11-22 04:36:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-11-22 04:36:44 | 3113,234,432 | -HS- | M] () -- C:\hiberfil.sys
[2011-11-22 03:49:13 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011-11-22 00:03:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Daddy\Desktop\OTL.exe
[2011-11-21 23:23:50 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011-11-21 22:29:30 | 004,303,424 | R--- | M] (Swearware) -- C:\Users\Daddy\Desktop\ComboFix.exe
[2011-11-20 23:30:29 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2011-11-20 23:30:29 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2011-11-20 00:44:46 | 000,000,512 | ---- | M] () -- C:\Users\Daddy\Desktop\MBR.dat
[2011-11-20 00:39:15 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Daddy\Desktop\aswMBR.exe
[2011-11-19 20:47:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Daddy\Desktop\dds.scr
[2011-11-19 20:34:14 | 000,302,592 | ---- | M] () -- C:\Users\Daddy\Desktop\7wxwoicb.exe
[2011-11-19 07:07:09 | 000,002,259 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011-11-17 22:51:46 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011-11-17 22:51:45 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
[2011-11-17 22:48:45 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011-11-17 22:01:58 | 000,000,344 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
[2011-11-13 01:49:12 | 000,002,054 | ---- | M] () -- C:\Users\Daddy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011-11-11 18:30:06 | 000,466,184 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011-11-03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys

========== Files Created - No Company Name ==========

[2011-11-21 22:16:29 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011-11-21 00:03:07 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011-11-21 00:03:07 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011-11-21 00:03:07 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011-11-21 00:03:07 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011-11-21 00:03:07 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011-11-20 23:30:29 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011-11-20 23:30:29 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011-11-20 00:44:46 | 000,000,512 | ---- | C] () -- C:\Users\Daddy\Desktop\MBR.dat
[2011-11-19 20:34:13 | 000,302,592 | ---- | C] () -- C:\Users\Daddy\Desktop\7wxwoicb.exe
[2011-11-19 07:07:09 | 000,002,259 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011-11-19 01:17:07 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
[2011-11-17 22:48:45 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011-11-17 22:01:58 | 000,000,344 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
[2011-11-13 01:48:43 | 000,001,197 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011-08-22 11:17:42 | 000,056,320 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
[2011-08-22 11:15:17 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll
[2011-05-26 21:14:52 | 000,743,534 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011-05-22 16:42:38 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
[2011-05-22 16:42:38 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2011-01-27 09:48:25 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2011-01-25 20:45:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011-01-25 00:32:35 | 000,007,605 | ---- | C] () -- C:\Users\Daddy\AppData\Local\resmon.resmoncfg
[2011-01-17 07:59:38 | 000,002,137 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011-01-17 07:56:57 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
[2011-01-17 07:56:57 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini
[2011-01-17 07:56:57 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini
[2011-01-17 07:56:57 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini
[2011-01-17 07:56:57 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2011-01-17 07:56:57 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini
[2011-01-17 07:08:50 | 000,000,074 | RHS- | C] () -- C:\Windows\CT4CET.bin
[2011-01-17 06:44:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010-12-10 01:33:11 | 000,000,325 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2009-07-14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009-07-14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009-07-14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009-07-14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009-07-14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009-07-13 22:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2009-07-13 22:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009-07-13 22:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009-07-13 22:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2009-07-13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009-06-10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011-04-22 01:45:00 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\DVDVideoSoft
[2011-04-22 01:44:15 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\DVDVideoSoftIEHelpers
[2011-11-18 02:17:32 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\GanymedeNet
[2011-09-22 23:00:30 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\ICAClient
[2011-05-22 17:33:21 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\PC Suite
[2011-06-04 19:27:57 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\PCDr
[2011-11-14 02:24:11 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Spotify
[2011-08-03 19:01:44 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Thunderbird
[2011-07-29 11:18:14 | 000,000,000 | ---D | M] -- C:\Users\Daddy\AppData\Roaming\Windows Live Writer
[2011-11-22 04:38:59 | 000,000,408 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2011-09-03 19:56:55 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

 

[Broni]

Something went wrong with OTL fix.
Let's try again....

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
  FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
  FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
  FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
  FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
  FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
  FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
  FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
  FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
  FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]
  [2011-11-22 04:39:52 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\se archplugins\GoogleFeed.xml
  
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.

 

[frh]

OTL Run Fix log

Smartwebsearch still evident. OTL Run Fix log below. Will now run Scan.


All processes killed
========== OTL ==========
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Prefs.js: "google-feed.net" removed from browser.search.defaultenginename
Prefs.js: "GoogleFeed.net" removed from browser.search.selectedEngine
Prefs.js: "http://www.smartwebsearch.net/index.php?from=3" removed from browser.startup.homepage
Prefs.js: "http://smartwebsearch.net/results.php?q=" removed from keyword.URL
Prefs.js: "google-feed.net" removed from browser.search.defaultenginename
Prefs.js: "http://smartwebsearch.net/results.php?q=" removed from keyword.URL
Prefs.js: "GoogleFeed.net" removed from browser.search.selectedEngine
Prefs.js: "http://www.smartwebsearch.net/index.php?from=3" removed from browser.startup.homepage
File HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF not found.
File C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\se archplugins\GoogleFeed.xml not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Callum
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Daddy
->Temp folder emptied: 264806 bytes
->Temporary Internet Files folder emptied: 42891637 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 16797516 bytes
->Google Chrome cache emptied: 6827958 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 1955 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Mummy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 68339 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 64.00 mb


[EMPTYFLASH]

User: All Users

User: Callum
->Flash cache emptied: 0 bytes

User: Daddy
->Flash cache emptied: 456 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Mummy
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 11222011_051105

Files\Folders moved on Reboot...
C:\Users\Daddy\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF0A51632D2C4B3F98.TMP not found!
File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF4F0AFE7A776C8141.TMP not found!
File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF66CDD86486D30D21.TMP not found!
File\Folder C:\Users\Daddy\AppData\Local\Temp\~DF66D9ADD6E60E3DE8.TMP not found!
File\Folder C:\Users\Daddy\AppData\Local\Temp\~DFF012C3AA1EA57B4A.TMP not found!
File\Folder C:\Users\Daddy\AppData\Local\Temp\~DFF97E59EAC9037C05.TMP not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\ac5[2].htm not found!
C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\afr[6].htm moved successfully.
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\if[1].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\like[1].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\sandbox[1].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\sandbox[2].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJFPZFWE\v[1].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\333930[1].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\kim-kardashian-fragrance-launch-foxy-402036[1].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\like[1].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR3WLEIU\statstracker[4].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\afr[5].htm not found!
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\like[1].htm not found!
C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C9RME2JR\redirect_v94_cim_11_16_0[2].html moved successfully.
C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\afr[5].htm moved successfully.
File\Folder C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\ivanka-trump-all-set-open-soho-flagship-store-564452[1].htm not found!
C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\kim-kardashian-5088[1].htm moved successfully.
C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\pixel[2].htm moved successfully.
C:\Users\Daddy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MQU6KRH\statstracker[4].htm moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

 

[Broni]

I need new OTL scan log.
Instead of pasting the log, attach it because it looks to me like a known forum bug is playing games with us.

 

[frh]

Latest OTL Scan Log

I spy irony :haha:

Latest OTL scan log attached.

If you don't mind, I would like to carry on Tuesday evening. It's 4.30am here and I am flagging; have to be up for work in two hours

Thanks for your patience and persistence

 

[Broni]

No problem. Go to bed....LOL

I'll post new instructions in a moment.

 

[Broni]

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  PRC - [2011-04-18 11:01:12 | 001,827,328 | ---- | M] (AudioEngines Inc.) -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe
  PRC - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
  FF - prefs.js..browser.search.defaultenginename: "google-feed.net"
  FF - prefs.js..browser.search.selectedEngine: "GoogleFeed.net"
  FF - prefs.js..browser.startup.homepage: "http://www.smartwebsearch.net/index.php?from=3"
  FF - prefs.js..keyword.URL: "http://smartwebsearch.net/results.php?q="
  [2011-11-22 05:18:14 | 000,002,126 | ---- | M] () -- C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
  FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\SearchToolbar@skywebsearch.com: C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF [2011-04-22 01:12:03 | 000,000,000 | ---D | M]
  O4 - HKLM..\Run: [YoutubeDownloader] C:\Program Files (x86)\OneStopSoft.com\Youtube Downloader\Youtube Downloader.exe (SoundInDepth.com)
  O4 - HKCU..\Run: [Foco] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\Foco.exe (AudioEngines Inc.)
  O4 - HKCU..\Run: [NTServiceManager] C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe ()
  MOD - [2011-04-13 18:05:38 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\NTServiceManager.exe
  
  
  :Services
  
  :Reg
  
  :Files
  C:\Program Files (x86)\YoutubeDownloader.org
  C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\2bjb5m1r.default\searchplugins\GoogleFeed.xml
  
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.

 

[frh]

Latest OTR fix and scan

Good evening Broni. Hope you're ok.

When I started up this evening, I ran Firefox which went immediately to the page http://apype.com/?f=3#. I hadn't seen evidence of apype for a while, but clearly it was still there.

I then ran OTR with the fix in your last post. The PC rebooted and the log is attached (I have assumed you again want the file attached rather than the contents pasted?).

I then ran the Quick Scan - again, the log file is attached. I then opened Firefox, which went to the Firefox home page. I went to the Google page and searched "BBC". From the results page I clicked on a link to one of the BBC pages and the browser was hijacked.

Thanks, as ever.

 

[Broni]

OTL log looks much better, but we still have some work to do.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64-bit users go HERE

• Double-click SystemLook.exe to run it.
• Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
• Copy the content of the following box and paste it into the main textfield:
  

  :reg
  HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions /s

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

[frh]

Systemlook

This ran in milliseconds. I hope I did it ok!


SystemLook 30.07.11 by jpshortstuff
Log created at 23:44 on 22/11/2011 by Daddy
Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions]
"SearchToolbar@skywebsearch.com"="C:\Program Files (x86)\YoutubeDownloader.org\YoutubeDownloader\FF"


-= EOF =-

 

[Broni]

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  
  :Services
  
  :Reg
  [HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions]
  "SearchToolbar@skywebsearch.com"=-
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.

 

[frh]

Further OTR fix and scan

Still evidence of hijacking. Logs attached.

 

[frh]

zzzzzzzzzzzzzz

Hi Broni,

I think I will go to bed - pushed it too far last night. Looking forward to your next instructions.

Thanks, & have a good evening & day tomorrow.

 

[Broni]

Still evidence of hijacking.

Give me more details.
Is IE OK?

 

[frh]

Hijackers still aboard

Hi Broni,

IE opens to MSN page. Search for BBC gives results in MSN engine. Click on link and three urls cycle through address box. Third url is http://paymente.net/in.cgi?11&onli=osou&ur=1&HTTP_REFERER=22200.c.evoplus.com&parameter=bbc&CS=1, which has now spent 3 minutes trying to complete load.

Firefox has about:home load. Click on home button reloads about:home. Search for BBC loads "Google Custom Search" with url http://www.google.com/cse?q=bbc&cx=...TF-8&sa=search#gsc.tab=0&gsc.q=bbc&gsc.page=1, with BBC results listed. Click on BBC home page link loads BBC home page. Click on home button again loads about:home. From here click on Google favourite loads UK Google as normal. Search from here for BBC loads BBC home page. Clicks on various BBC links load expected pages.Return to Google page followed by search followed by click on results link invokes hijack page urls cycling until rest at http://www.easya-z.com/search_uk/v_tukb/innerxy.php?q=Football&xy=itcg-20342.

Safari and GoogleChrome similarly hijacked, though symptoms show as soon as links following initial search are clicked.

 

[Broni]

Download Bootkit Remover to your Desktop.

• Unzip downloaded file to your Desktop.
• Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator).
• It will show a Black screen with some data on it.
• Right click on the screen and click Select All.
• Press CTRL+C
• Open a Notepad and press CTRL+V
• Post the output back here.

 

[frh]

Bootkit run

Hi Broni,

As I am running Windows 7 I looked for remover.exe in the zip file but found only boot_cleaner.exe, so I ran that. Results below:


Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000003`afd00000

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

 

[Broni]

but found only boot_cleaner.exe

My mistake, sorry about it. You did fine

It looks like your MBR is infected.

Please Boot to the System Recovery Options
If you have Windows 7 installation disc, just insert a DVD to the drive, restart computer and it should load automatically (option two presented in the article).
It's possible also that your computer has a pre-installed recovery partition instead - in such a case use a method one (by pressing F8 before Windows starts loading)...

On the System Recovery Options menu you will get the following options:

• Startup Repair
• System Restore
• Windows Complete PC Restore
• Windows Memory Diagnostic Tool
• Command Prompt

Choose Command Prompt
You should see X:\SOURCES>...

Execute the following commands in bold.
Press Enter after every one of them.

bootrec /fixmbr (<--- there is a "space" after "bootrec")

exit

Restart computer.

Post new Bootkit Remover log.

 

[frh]

Cannot access recovery options

I do not appear to have a recovery partition. I made a set of (2) recovery disks when I bought the laptop about a year ago.

I set the boot order in BIOS to boot from DVD first. I got the "Windows loading files" message and the load bar takes appx 4 mins to fill. I then got a blue screen with error code c000021a, and began to feel nauseous.....

I removed the DVD and restarted. The machine appeared to be loading windows, then powered off - several times. Finally Windows loaded successfully.

The Startup Repair option gives the loading files message then appears to stall when the bar is full, and I have to CTRL-ALT-DEL to power the machine off.

Where do we go from here? I can browse the recovery disks normally, if that is of any use at all.

Thanks.

 

[frh]

Recovery DVD loaded

I do not appear to have a recovery partition. I made a set of (2) recovery disks when I bought the laptop about a year ago.

I set the boot order in BIOS to boot from DVD first. I got the "Windows loading files" message and the load bar takes appx 4 mins to fill. I then got a blue screen with error code c000021a, and began to feel nauseous.....

I removed the DVD and restarted. The machine appeared to be loading windows, then powered off - several times. Finally Windows loaded successfully.

The Startup Repair option gives the loading files message then appears to stall when the bar is full, and I have to CTRL-ALT-DEL to power the machine off.

Where do we go from here? I can browse the recovery disks normally, if that is of any use at all.

Thanks.

Managed to get recovery dvd to load, but find no command prompt option. I get restore computer and preserve files option, and select other system backup and more options.

If I go for the second option, I have choice of factory restore, backup files and folders, and restore computer options.

 

[Broni]

Recovery DVD won't do.
You would have to have Windows 7 DVD (full version).
Since you don't have it you have to use "option 1" from my link.