When I click on a Google search result, one in about 3-6 clicks will be redirected to various sites offering stuff for me to buy. It used to be that every single Google search result click was redirected, but after battling this issue with various anti-viruses and malware removal tools, I was able to minimize, yet not completely, eliminate this issue. I am appealing to you, the techspot community, to please help me.
Solved Virus redirects Google search results, please help
- Thread starter Scathez
- Start date
- Status
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7680
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000
9/8/2011 7:38:12 PM
mbam-log-2011-09-08 (19-38-12).txt
Scan type: Quick scan
Objects scanned: 171094
Time elapsed: 4 minute(s), 29 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2011-09-08 20:51:49
Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD12 rev.01.0
Running: w4cuxfll.exe; Driver: C:\Users\Victor\AppData\Local\Temp\ufdiakow.sys
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_27
Run by Victor at 20:53:39 on 2011-09-08
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.1948 [GMT -4:00]
.
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
BHO: {01c7cf0f-dc08-4458-b8c6-82bfd7319b5a} - c:\windows\system32\wscui32.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVXV1UtV0JEWEMtVllGTjMtUURKTUgtNDJBT0EtSzZIVTk"&"inst=NzctNzE2NjkxOTk2LVNUMTJGT0krMS1ERFQrMC1FVUxBKzEtU1QxMkZBUFArMQ"&"prod=90"&"ver=2012.0.1796"&"mid=90677aaece9047d1934f13f94988ffe0-9581dd74e5f78007af15c41a9f2b377b615911ad
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
dPolicies-explorer: HideSCAHealth = 1 (0x1)
IE: E&xport to Microsoft Excel
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A} : NameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A} : DhcpNameServer = 192.168.1.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\victor\appdata\roaming\mozilla\firefox\profiles\g349ce76.default\
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
.
============= SERVICES / DRIVERS ===============
.
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-9-8 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-9-8 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-9-8 66616]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2010-1-30 12672]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-26 366640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-26 22712]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2006-11-2 9216]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-20 16896]
S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2008-1-20 19968]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
S4 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-3-2 1153368]
.
=============== Created Last 30 ================
.
2011-09-08 22:43:52 -------- d-----w- c:\users\victor\appdata\roaming\Avira
2011-09-08 22:40:44 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-09-08 22:40:43 -------- d-----w- c:\programdata\Avira
2011-09-08 22:38:58 -------- d-----w- c:\program files\Avira
2011-09-08 22:23:19 332 ----a-w- C:\Start_.cmd
2011-09-08 22:23:19 -------- d-----w- C:\ComboFix
2011-09-08 20:28:04 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-07 02:23:40 -------- d-----w- c:\users\victor\appdata\roaming\Foxit Software
2011-09-07 02:22:36 72960 ----a-w- c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
2011-09-07 02:22:21 -------- d-----w- c:\program files\Foxit Software
2011-09-07 02:21:24 -------- d-----w- c:\users\victor\appdata\local\COMODO
2011-09-07 00:04:14 -------- d--h--w- C:\VritualRoot
2011-09-07 00:03:34 467168 ----a-w- c:\windows\system32\drivers\sfi.dat
2011-09-06 23:54:59 -------- d-----w- c:\programdata\Comodo
2011-09-06 23:54:54 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2011-09-06 23:01:47 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-06 22:23:05 -------- d-----w- c:\windows\system32\catroot2
2011-09-06 18:36:12 -------- d-----w- c:\users\victor\appdata\local\temp
2011-09-06 18:29:50 -------- d-----w- C:\$RECYCLE.BIN
2011-09-06 18:16:16 -------- d-----w- C:\Combo-Fix
2011-09-06 16:53:03 -------- d-----w- c:\users\victor\appdata\roaming\AVG2012
2011-09-06 16:43:16 0 ---ha-w- c:\windows\mmoewlmwpi.tmp
2011-09-06 16:33:31 -------- d-----w- c:\program files\AVG
2011-09-06 14:08:43 98816 ----a-w- c:\windows\sed.exe
2011-09-06 14:08:43 518144 ----a-w- c:\windows\SWREG.exe
2011-09-06 14:08:43 256000 ----a-w- c:\windows\PEV.exe
2011-09-06 14:08:43 208896 ----a-w- c:\windows\MBR.exe
2011-09-06 14:05:24 -------- d--h--w- c:\programdata\Common Files
2011-09-06 14:00:09 -------- d-----w- c:\programdata\MFAData
2011-09-06 12:18:20 0 ---ha-w- c:\windows\system32\mmoewlmwpi.tmp
2011-09-06 11:22:06 240128 ----a-w- c:\windows\system32\wscui32.dll
2011-09-06 00:04:05 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
2011-09-06 00:04:04 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
2011-09-06 00:03:56 -------- d-----w- c:\programdata\EPSON
2011-09-05 03:42:56 -------- d-----w- c:\users\victor\riotsGamesLogs
2011-09-02 00:52:14 -------- d-----w- c:\windows\system32\CSP
2011-09-02 00:22:56 -------- d-----w- c:\users\victor\fontconfig
2011-09-02 00:17:01 -------- d-----w- c:\users\victor\.smplayer
2011-09-01 19:22:01 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-09-01 19:20:06 -------- d-----w- c:\program files\common files\L&H
2011-09-01 16:59:39 -------- d-----w- c:\users\victor\Cisco Packet Tracer 5.3.2
2011-09-01 15:59:08 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
2011-09-01 02:19:53 -------- d-----w- c:\users\victor\appdata\local\Microsoft Help
2011-08-31 12:51:00 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-27 16:50:47 -------- d-----w- C:\Dls
2011-08-27 16:47:59 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-27 16:47:58 -------- d-----w- c:\users\victor\appdata\local\Conduit
2011-08-27 16:47:50 -------- d-----w- c:\program files\uTorrent
2011-08-27 16:47:15 -------- d-----w- c:\users\victor\appdata\roaming\uTorrent
2011-08-27 16:47:15 -------- d-----w- c:\users\victor\appdata\local\uTorrent
2011-08-27 11:58:37 -------- d-----w- c:\program files\RegClean 5.9 English
2011-08-27 11:50:37 -------- d-----w- c:\program files\CCleaner
2011-08-27 04:21:36 -------- d-----w- c:\users\victor\appdata\roaming\SUPERAntiSpyware.com
2011-08-27 04:01:56 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-08-27 03:33:11 -------- d-----w- c:\users\victor\appdata\roaming\Malwarebytes
2011-08-27 03:32:59 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 03:32:58 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 03:32:53 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 03:32:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
.
==================== Find3M ====================
.
2011-09-08 21:13:28 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
.
============= FINISH: 20:54:14.71 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 7/2/2008 3:52:07 AM
System Uptime: 9/8/2011 7:29:20 PM (1 hours ago)
.
Motherboard: Quanta | | 30D2
Processor: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz | U2E1 | 2000/667mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 100 GiB total, 10.085 GiB free.
D: is FIXED (NTFS) - 12 GiB total, 1.995 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Realtek RTL8101E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_30CC103C&REV_01\4&2EE70BA2&0&00E5
Manufacturer: Realtek
Name: Realtek RTL8101E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
PNP Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_30CC103C&REV_01\4&2EE70BA2&0&00E5
Service: RTL8169
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 10 Plugin
Adobe Shockwave Player
Adobe Shockwave Player 11
AuthenTec Fingerprint Sensor Minimum Install
Avira AntiVir Personal - Free Antivirus
CCleaner
Cisco Packet Tracer 5.3.2
Cisco Systems VPN Client 5.0.00.0340
CoreAVC Professional Edition (remove only)
CPUID CPU-Z 1.53.1
DigitalPersona Personal 3.0.0
DVD Suite
EPSON WorkForce 610 Series Printer Uninstall
Foxit Phantom
Google Chrome
Google Update Helper
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Product Detection
HP Quick Launch Buttons 6.30 E1
HP QuickPlay 3.6
HP QuickTouch 1.00 C4
HP Total Care Advisor
HP Wireless Assistant
HPNetworkAssistant
Intel® Matrix Storage Manager
Java Auto Updater
Java(TM) 6 Update 26
Java(TM) 6 Update 27
K-Lite Codec Pack 4.5.3 (Standard)
League of Legends
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 3.5 SP1
Microsoft Money 98
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office XP Professional with FrontPage
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Motorola SM56 Data Fax Modem
Mozilla Firefox 6.0.2 (x86 en-US)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MV RegClean 5.9 English
NVIDIA Display Control Panel
NVIDIA Drivers
Power2Go
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
Realtek High Definition Audio Driver
Revo Uninstaller 1.75
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Skype™ 5.0
Spybot - Search & Destroy
Synaptics Pointing Device Driver
TuneUp Utilities 2007
VBA (2627.01)
VLC media player 1.1.0
WeatherBug Gadget
WinRAR archiver
.
==== Event Viewer Messages From Past Week ========
.
9/8/2011 7:31:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
9/8/2011 6:46:16 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: The system cannot find the path specified.
9/8/2011 6:46:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "3" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
9/8/2011 11:24:34 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the stisvc service.
9/7/2011 2:06:29 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
9/6/2011 9:31:31 AM, Error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).
9/6/2011 9:28:17 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 9:25:00 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 6:13:25 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
9/6/2011 5:36:01 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
9/6/2011 2:36:58 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
9/6/2011 2:13:53 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
9/6/2011 12:57:18 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgtdix
9/6/2011 12:34:23 PM, Error: Service Control Manager [7000] - The AVG TDI Driver service failed to start due to the following error: The system cannot find the file specified.
9/6/2011 12:32:43 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
9/6/2011 12:32:24 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
9/6/2011 12:31:20 AM, Error: EventLog [6008] - The previous system shutdown at 12:27:14 AM on 9/6/2011 was unexpected.
9/6/2011 12:06:47 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
9/6/2011 12:06:47 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
9/6/2011 12:06:39 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: epfwtdir
9/6/2011 12:06:39 PM, Error: Service Control Manager [7000] - The RMCAST (Pgm) Protocol Driver service failed to start due to the following error: The system cannot find the path specified.
9/6/2011 10:46:49 AM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC easdrv epfwtdir NetBIOS netbt nsiproxy PSched RasAcd rdbss SASDIFSV SASKUTIL Smb spldr tdx Wanarpv6
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:45:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
9/6/2011 10:45:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
9/6/2011 10:41:43 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
9/6/2011 10:41:41 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
9/6/2011 10:41:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
9/6/2011 10:41:30 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/6/2011 10:41:22 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
9/6/2011 10:13:03 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
9/6/2011 10:09:30 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
9/6/2011 10:09:30 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/6/2011 10:09:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 1:38:32 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service.
9/6/2011 1:20:23 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: The system cannot find the file specified.
9/6/2011 1:20:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "2" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
9/6/2011 1:19:06 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: Access is denied.
9/6/2011 1:09:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
9/6/2011 1:03:26 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 Avgtdix SASDIFSV SASKUTIL spldr Wanarpv6
9/3/2011 8:43:49 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Eset Nod32 Boot service to connect.
9/3/2011 8:43:49 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/3/2011 8:43:49 AM, Error: Service Control Manager [7000] - The Eset Nod32 Boot service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/1/2011 3:24:54 PM, Error: Service Control Manager [7030] - The Machine Debug Manager service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
9/1/2011 2:35:50 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the service.
9/1/2011 12:55:01 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.11 for the Network Card with network address 00215C05D355 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================
www.malwarebytes.org
Database version: 7680
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000
9/8/2011 7:38:12 PM
mbam-log-2011-09-08 (19-38-12).txt
Scan type: Quick scan
Objects scanned: 171094
Time elapsed: 4 minute(s), 29 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2011-09-08 20:51:49
Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD12 rev.01.0
Running: w4cuxfll.exe; Driver: C:\Users\Victor\AppData\Local\Temp\ufdiakow.sys
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_27
Run by Victor at 20:53:39 on 2011-09-08
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.1948 [GMT -4:00]
.
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
BHO: {01c7cf0f-dc08-4458-b8c6-82bfd7319b5a} - c:\windows\system32\wscui32.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVXV1UtV0JEWEMtVllGTjMtUURKTUgtNDJBT0EtSzZIVTk"&"inst=NzctNzE2NjkxOTk2LVNUMTJGT0krMS1ERFQrMC1FVUxBKzEtU1QxMkZBUFArMQ"&"prod=90"&"ver=2012.0.1796"&"mid=90677aaece9047d1934f13f94988ffe0-9581dd74e5f78007af15c41a9f2b377b615911ad
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
dPolicies-explorer: HideSCAHealth = 1 (0x1)
IE: E&xport to Microsoft Excel
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A} : NameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A} : DhcpNameServer = 192.168.1.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\victor\appdata\roaming\mozilla\firefox\profiles\g349ce76.default\
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
.
============= SERVICES / DRIVERS ===============
.
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-9-8 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-9-8 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-9-8 66616]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2010-1-30 12672]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-26 366640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-26 22712]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2006-11-2 9216]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-20 16896]
S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2008-1-20 19968]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-12-24 136176]
S4 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-3-2 1153368]
.
=============== Created Last 30 ================
.
2011-09-08 22:43:52 -------- d-----w- c:\users\victor\appdata\roaming\Avira
2011-09-08 22:40:44 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-09-08 22:40:43 -------- d-----w- c:\programdata\Avira
2011-09-08 22:38:58 -------- d-----w- c:\program files\Avira
2011-09-08 22:23:19 332 ----a-w- C:\Start_.cmd
2011-09-08 22:23:19 -------- d-----w- C:\ComboFix
2011-09-08 20:28:04 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-07 02:23:40 -------- d-----w- c:\users\victor\appdata\roaming\Foxit Software
2011-09-07 02:22:36 72960 ----a-w- c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
2011-09-07 02:22:21 -------- d-----w- c:\program files\Foxit Software
2011-09-07 02:21:24 -------- d-----w- c:\users\victor\appdata\local\COMODO
2011-09-07 00:04:14 -------- d--h--w- C:\VritualRoot
2011-09-07 00:03:34 467168 ----a-w- c:\windows\system32\drivers\sfi.dat
2011-09-06 23:54:59 -------- d-----w- c:\programdata\Comodo
2011-09-06 23:54:54 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2011-09-06 23:01:47 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-06 22:23:05 -------- d-----w- c:\windows\system32\catroot2
2011-09-06 18:36:12 -------- d-----w- c:\users\victor\appdata\local\temp
2011-09-06 18:29:50 -------- d-----w- C:\$RECYCLE.BIN
2011-09-06 18:16:16 -------- d-----w- C:\Combo-Fix
2011-09-06 16:53:03 -------- d-----w- c:\users\victor\appdata\roaming\AVG2012
2011-09-06 16:43:16 0 ---ha-w- c:\windows\mmoewlmwpi.tmp
2011-09-06 16:33:31 -------- d-----w- c:\program files\AVG
2011-09-06 14:08:43 98816 ----a-w- c:\windows\sed.exe
2011-09-06 14:08:43 518144 ----a-w- c:\windows\SWREG.exe
2011-09-06 14:08:43 256000 ----a-w- c:\windows\PEV.exe
2011-09-06 14:08:43 208896 ----a-w- c:\windows\MBR.exe
2011-09-06 14:05:24 -------- d--h--w- c:\programdata\Common Files
2011-09-06 14:00:09 -------- d-----w- c:\programdata\MFAData
2011-09-06 12:18:20 0 ---ha-w- c:\windows\system32\mmoewlmwpi.tmp
2011-09-06 11:22:06 240128 ----a-w- c:\windows\system32\wscui32.dll
2011-09-06 00:04:05 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
2011-09-06 00:04:04 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
2011-09-06 00:03:56 -------- d-----w- c:\programdata\EPSON
2011-09-05 03:42:56 -------- d-----w- c:\users\victor\riotsGamesLogs
2011-09-02 00:52:14 -------- d-----w- c:\windows\system32\CSP
2011-09-02 00:22:56 -------- d-----w- c:\users\victor\fontconfig
2011-09-02 00:17:01 -------- d-----w- c:\users\victor\.smplayer
2011-09-01 19:22:01 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-09-01 19:20:06 -------- d-----w- c:\program files\common files\L&H
2011-09-01 16:59:39 -------- d-----w- c:\users\victor\Cisco Packet Tracer 5.3.2
2011-09-01 15:59:08 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
2011-09-01 02:19:53 -------- d-----w- c:\users\victor\appdata\local\Microsoft Help
2011-08-31 12:51:00 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-27 16:50:47 -------- d-----w- C:\Dls
2011-08-27 16:47:59 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-27 16:47:58 -------- d-----w- c:\users\victor\appdata\local\Conduit
2011-08-27 16:47:50 -------- d-----w- c:\program files\uTorrent
2011-08-27 16:47:15 -------- d-----w- c:\users\victor\appdata\roaming\uTorrent
2011-08-27 16:47:15 -------- d-----w- c:\users\victor\appdata\local\uTorrent
2011-08-27 11:58:37 -------- d-----w- c:\program files\RegClean 5.9 English
2011-08-27 11:50:37 -------- d-----w- c:\program files\CCleaner
2011-08-27 04:21:36 -------- d-----w- c:\users\victor\appdata\roaming\SUPERAntiSpyware.com
2011-08-27 04:01:56 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-08-27 03:33:11 -------- d-----w- c:\users\victor\appdata\roaming\Malwarebytes
2011-08-27 03:32:59 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 03:32:58 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 03:32:53 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 03:32:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
.
==================== Find3M ====================
.
2011-09-08 21:13:28 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
.
============= FINISH: 20:54:14.71 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 7/2/2008 3:52:07 AM
System Uptime: 9/8/2011 7:29:20 PM (1 hours ago)
.
Motherboard: Quanta | | 30D2
Processor: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz | U2E1 | 2000/667mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 100 GiB total, 10.085 GiB free.
D: is FIXED (NTFS) - 12 GiB total, 1.995 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Realtek RTL8101E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_30CC103C&REV_01\4&2EE70BA2&0&00E5
Manufacturer: Realtek
Name: Realtek RTL8101E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
PNP Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_30CC103C&REV_01\4&2EE70BA2&0&00E5
Service: RTL8169
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 10 Plugin
Adobe Shockwave Player
Adobe Shockwave Player 11
AuthenTec Fingerprint Sensor Minimum Install
Avira AntiVir Personal - Free Antivirus
CCleaner
Cisco Packet Tracer 5.3.2
Cisco Systems VPN Client 5.0.00.0340
CoreAVC Professional Edition (remove only)
CPUID CPU-Z 1.53.1
DigitalPersona Personal 3.0.0
DVD Suite
EPSON WorkForce 610 Series Printer Uninstall
Foxit Phantom
Google Chrome
Google Update Helper
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Product Detection
HP Quick Launch Buttons 6.30 E1
HP QuickPlay 3.6
HP QuickTouch 1.00 C4
HP Total Care Advisor
HP Wireless Assistant
HPNetworkAssistant
Intel® Matrix Storage Manager
Java Auto Updater
Java(TM) 6 Update 26
Java(TM) 6 Update 27
K-Lite Codec Pack 4.5.3 (Standard)
League of Legends
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 3.5 SP1
Microsoft Money 98
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office XP Professional with FrontPage
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Motorola SM56 Data Fax Modem
Mozilla Firefox 6.0.2 (x86 en-US)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MV RegClean 5.9 English
NVIDIA Display Control Panel
NVIDIA Drivers
Power2Go
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
Realtek High Definition Audio Driver
Revo Uninstaller 1.75
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Skype™ 5.0
Spybot - Search & Destroy
Synaptics Pointing Device Driver
TuneUp Utilities 2007
VBA (2627.01)
VLC media player 1.1.0
WeatherBug Gadget
WinRAR archiver
.
==== Event Viewer Messages From Past Week ========
.
9/8/2011 7:31:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
9/8/2011 6:46:16 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: The system cannot find the path specified.
9/8/2011 6:46:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "3" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
9/8/2011 11:24:34 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the stisvc service.
9/7/2011 2:06:29 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
9/6/2011 9:31:31 AM, Error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).
9/6/2011 9:28:17 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 9:25:00 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 6:13:25 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
9/6/2011 5:36:01 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
9/6/2011 2:36:58 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
9/6/2011 2:13:53 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
9/6/2011 12:57:18 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgtdix
9/6/2011 12:34:23 PM, Error: Service Control Manager [7000] - The AVG TDI Driver service failed to start due to the following error: The system cannot find the file specified.
9/6/2011 12:32:43 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
9/6/2011 12:32:24 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
9/6/2011 12:31:20 AM, Error: EventLog [6008] - The previous system shutdown at 12:27:14 AM on 9/6/2011 was unexpected.
9/6/2011 12:06:47 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
9/6/2011 12:06:47 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
9/6/2011 12:06:39 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: epfwtdir
9/6/2011 12:06:39 PM, Error: Service Control Manager [7000] - The RMCAST (Pgm) Protocol Driver service failed to start due to the following error: The system cannot find the path specified.
9/6/2011 10:46:49 AM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC easdrv epfwtdir NetBIOS netbt nsiproxy PSched RasAcd rdbss SASDIFSV SASKUTIL Smb spldr tdx Wanarpv6
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
9/6/2011 10:46:00 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
9/6/2011 10:45:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
9/6/2011 10:45:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
9/6/2011 10:41:43 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
9/6/2011 10:41:41 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
9/6/2011 10:41:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
9/6/2011 10:41:30 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/6/2011 10:41:22 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
9/6/2011 10:13:03 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
9/6/2011 10:09:30 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
9/6/2011 10:09:30 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/6/2011 10:09:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 10:08:33 AM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
9/6/2011 1:38:32 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service.
9/6/2011 1:20:23 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: The system cannot find the file specified.
9/6/2011 1:20:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "2" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
9/6/2011 1:19:06 PM, Error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: Access is denied.
9/6/2011 1:09:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
9/6/2011 1:03:26 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 Avgtdix SASDIFSV SASKUTIL spldr Wanarpv6
9/3/2011 8:43:49 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Eset Nod32 Boot service to connect.
9/3/2011 8:43:49 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/3/2011 8:43:49 AM, Error: Service Control Manager [7000] - The Eset Nod32 Boot service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/1/2011 3:24:54 PM, Error: Service Control Manager [7030] - The Machine Debug Manager service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
9/1/2011 2:35:50 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the service.
9/1/2011 12:55:01 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.11 for the Network Card with network address 00215C05D355 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================
Broni
Posts: 56,041 +516
Welcome aboard
Please, observe following rules:
==================================================================
Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan:
On completion of the scan click "Save log", save it to your desktop and post in your next reply:
NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
=================================================================
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
Make sure, you re-enable your security programs, when you're done with Combofix.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTE.
If, for some reason, Combofix refuses to run, try one of the following:
1. Run Combofix from Safe Mode.
2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
Rkill.com
Rkill.scr
Rkill.exe
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.
If normal mode still doesn't work, run BOTH tools from safe mode.
In case #2, please post BOTH logs, rKill and Combofix.
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running tools or applying updates other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
==================================================================
Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan:
On completion of the scan click "Save log", save it to your desktop and post in your next reply:
NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
=================================================================
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE 2. If Combofix asks you to update the program, always do so.- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt"
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
Make sure, you re-enable your security programs, when you're done with Combofix.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTE.
If, for some reason, Combofix refuses to run, try one of the following:
1. Run Combofix from Safe Mode.
2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
Rkill.com
Rkill.scr
Rkill.exe
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.
If normal mode still doesn't work, run BOTH tools from safe mode.
In case #2, please post BOTH logs, rKill and Combofix.
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Broni, thank you for your time; I appreciate your help greatly. I have done as instructed, and here are the logs:
=================================================================
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-09 00:21:07
-----------------------------
00:21:07.859 OS Version: Windows 6.0.6001 Service Pack 1
00:21:07.859 Number of processors: 2 586 0xF0D
00:21:07.860 ComputerName: VICTOR-LAPPY UserName: Victor
00:21:08.571 Initialize success
00:21:53.831 AVAST engine defs: 11090802
00:22:46.095 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
00:22:46.098 Disk 0 Vendor: WDC_WD12 01.0 Size: 114473MB BusType: 3
00:22:46.152 Disk 0 MBR read successfully
00:22:46.154 Disk 0 MBR scan
00:22:46.161 Disk 0 unknown MBR code
00:22:46.167 Disk 0 scanning sectors +234436545
00:22:46.233 Disk 0 scanning C:\Windows\system32\drivers
00:22:54.857 Service scanning
00:22:56.075 Modules scanning
00:23:00.821 Disk 0 trace - called modules:
00:23:00.926 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
00:23:00.930 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861150a0]
00:23:00.934 3 CLASSPNP.SYS[8a5a9745] -> nt!IofCallDriver -> [0x8513e900]
00:23:01.263 5 acpi.sys[8069b6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x85149028]
00:23:02.886 AVAST engine scan C:\Windows
00:23:05.767 AVAST engine scan C:\Windows\system32
00:24:53.202 AVAST engine scan C:\Windows\system32\drivers
00:25:02.074 AVAST engine scan C:\Users\Victor
00:28:44.729 AVAST engine scan C:\ProgramData
00:29:13.232 Scan finished successfully
00:34:02.256 Disk 0 MBR has been saved successfully to "C:\Users\Victor\Desktop\Redirect POS\MBR.dat"
00:34:02.261 The log file has been saved successfully to "C:\Users\Victor\Desktop\Redirect POS\aswMBR.txt"
ComboFix 11-09-09.01 - Victor 09/09/2011 0:38.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.2014 [GMT -4:00]
Running from: c:\users\Victor\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\chrome.manifest
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\chrome\xulcache.jar
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\defaults\preferences\xulcache.js
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\install.rdf
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\chrome.manifest
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\chrome\xulcache.jar
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\defaults\preferences\xulcache.js
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\install.rdf
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\chrome.manifest
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\chrome\xulcache.jar
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\defaults\preferences\xulcache.js
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\install.rdf
.
.
((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-09 04:43 . 2011-09-09 04:43 -------- d-----w- c:\users\Victor\AppData\Local\temp
2011-09-09 04:43 . 2011-09-09 04:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-08 22:43 . 2011-09-08 22:43 -------- d-----w- c:\users\Victor\AppData\Roaming\Avira
2011-09-08 22:40 . 2011-07-21 16:15 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-09-08 22:40 . 2011-07-21 16:15 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-09-08 22:40 . 2011-09-08 22:40 -------- d-----w- c:\programdata\Avira
2011-09-08 22:38 . 2011-09-08 22:44 -------- d-----w- c:\program files\Avira
2011-09-08 20:28 . 2011-09-08 20:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-07 02:23 . 2011-09-07 02:23 -------- d-----w- c:\users\Victor\AppData\Roaming\Foxit Software
2011-09-06 22:23 . 2011-09-06 22:26 -------- d-----w- c:\windows\system32\catroot2
2011-09-06 18:16 . 2011-09-06 18:37 -------- d-----w- C:\Combo-Fix
2011-09-06 16:53 . 2011-09-07 00:21 -------- d-----w- c:\users\Victor\AppData\Roaming\AVG2012
2011-09-06 16:43 . 2011-09-06 16:43 0 ---ha-w- c:\windows\mmoewlmwpi.tmp
2011-09-06 16:33 . 2011-09-06 16:33 -------- d-----w- c:\program files\AVG
2011-09-06 14:05 . 2011-09-06 14:05 -------- d--h--w- c:\programdata\Common Files
2011-09-06 14:00 . 2011-09-07 00:18 -------- d-----w- c:\programdata\MFAData
2011-09-06 12:18 . 2011-09-06 12:18 0 ---ha-w- c:\windows\system32\mmoewlmwpi.tmp
2011-09-06 11:22 . 2011-09-06 11:22 240128 ----a-w- c:\windows\system32\wscui32.dll
2011-09-06 00:04 . 2008-11-12 07:00 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
2011-09-06 00:04 . 2008-11-12 07:00 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
2011-09-06 00:03 . 2011-09-06 00:04 -------- d-----w- c:\programdata\EPSON
2011-09-05 03:42 . 2011-09-09 02:17 -------- d-----w- c:\users\Victor\riotsGamesLogs
2011-09-02 00:52 . 2011-09-02 00:52 -------- d-----w- c:\windows\system32\CSP
2011-09-02 00:22 . 2011-09-02 00:22 -------- d-----w- c:\users\Victor\fontconfig
2011-09-02 00:17 . 2011-09-04 17:01 -------- d-----w- c:\users\Victor\.smplayer
2011-09-01 19:22 . 2011-09-01 19:22 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-09-01 19:20 . 2011-09-01 19:20 -------- d-----w- c:\program files\Common Files\L&H
2011-09-01 16:59 . 2011-09-01 17:00 -------- d-----w- c:\users\Victor\Cisco Packet Tracer 5.3.2
2011-09-01 15:59 . 2011-09-01 16:00 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
2011-09-01 03:09 . 2011-09-01 03:09 -------- d-----w- c:\users\Public\CyberLink
2011-09-01 02:19 . 2011-09-01 02:19 -------- d-----w- c:\users\Victor\AppData\Local\Microsoft Help
2011-08-31 12:51 . 2011-08-31 12:51 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-27 16:50 . 2011-09-08 18:32 -------- d-----w- C:\Dls
2011-08-27 16:47 . 2011-08-27 16:47 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-27 16:47 . 2011-08-31 13:55 -------- d-----w- c:\users\Victor\AppData\Local\Conduit
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\program files\uTorrent
2011-08-27 16:47 . 2011-09-09 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\uTorrent
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\users\Victor\AppData\Local\uTorrent
2011-08-27 11:58 . 2011-09-08 22:42 -------- d-----w- c:\program files\RegClean 5.9 English
2011-08-27 11:50 . 2011-08-27 11:50 -------- d-----w- c:\program files\CCleaner
2011-08-27 04:21 . 2011-08-27 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\SUPERAntiSpyware.com
2011-08-27 04:01 . 2011-08-27 04:01 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-08-27 03:33 . 2011-08-27 03:33 -------- d-----w- c:\users\Victor\AppData\Roaming\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 03:32 . 2011-08-27 03:32 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 03:32 . 2011-08-27 03:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-26 23:23 . 2011-08-26 23:23 -------- d-----w- c:\users\Victor\AppData\Roaming\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-08 21:13 . 2008-01-21 02:24 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
2011-09-03 06:01 . 2011-09-06 22:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01C7CF0F-DC08-4458-B8C6-82BFD7319B5a}]
2011-09-06 11:22 240128 ----a-w- c:\windows\System32\wscui32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVXV1UtV0JEWEMtVllGTjMtUURKTUgtNDJBT0EtSzZIVTk&inst=NzctNzE2NjkxOTk2LVNUMTJGT0krMS1ERFQrMC1FVUxBKzEtU1QxMkZBUFArMQ&prod=90&ver=2012.0.1796&mid=90677aaece9047d1934f13f94988ffe0-9581dd74e5f78007af15c41a9f2b377b615911ad" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-11-02 8704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DpAgent"=c:\program files\DigitalPersona\Bin\dpagent.exe
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"OnScreenDisplay"=c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
"RtHDVCpl"=RtHDVCpl.exe
"WAWifiMessage"=c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
"EnableNotificationsRef"=dword:00000003
.
R2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2006-11-02 9216]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2008-01-21 19968]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMBR
*NewlyCreated* - SSMDRV
*Deregistered* - aswMBR
*Deregistered* - ufdiakow
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-02 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-03 03:35]
.
2011-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
IE: E&xport to Microsoft Excel
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
FF - ProfilePath - c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\
.
- - - - ORPHANS REMOVED - - - -
.
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
Notify-!SASWinLogon - c:\program files\SUPERAntiSpyware\SASWINLO.DLL
SafeBoot-04906191.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-09 00:43
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-09-09 00:45:43
ComboFix-quarantined-files.txt 2011-09-09 04:45
.
Pre-Run: 11,091,349,504 bytes free
Post-Run: 11,194,482,688 bytes free
.
- - End Of File - - 4DAF2080845F89CA93E2AD8FC3C21EFE
=================================================================
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-09 00:21:07
-----------------------------
00:21:07.859 OS Version: Windows 6.0.6001 Service Pack 1
00:21:07.859 Number of processors: 2 586 0xF0D
00:21:07.860 ComputerName: VICTOR-LAPPY UserName: Victor
00:21:08.571 Initialize success
00:21:53.831 AVAST engine defs: 11090802
00:22:46.095 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
00:22:46.098 Disk 0 Vendor: WDC_WD12 01.0 Size: 114473MB BusType: 3
00:22:46.152 Disk 0 MBR read successfully
00:22:46.154 Disk 0 MBR scan
00:22:46.161 Disk 0 unknown MBR code
00:22:46.167 Disk 0 scanning sectors +234436545
00:22:46.233 Disk 0 scanning C:\Windows\system32\drivers
00:22:54.857 Service scanning
00:22:56.075 Modules scanning
00:23:00.821 Disk 0 trace - called modules:
00:23:00.926 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
00:23:00.930 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861150a0]
00:23:00.934 3 CLASSPNP.SYS[8a5a9745] -> nt!IofCallDriver -> [0x8513e900]
00:23:01.263 5 acpi.sys[8069b6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x85149028]
00:23:02.886 AVAST engine scan C:\Windows
00:23:05.767 AVAST engine scan C:\Windows\system32
00:24:53.202 AVAST engine scan C:\Windows\system32\drivers
00:25:02.074 AVAST engine scan C:\Users\Victor
00:28:44.729 AVAST engine scan C:\ProgramData
00:29:13.232 Scan finished successfully
00:34:02.256 Disk 0 MBR has been saved successfully to "C:\Users\Victor\Desktop\Redirect POS\MBR.dat"
00:34:02.261 The log file has been saved successfully to "C:\Users\Victor\Desktop\Redirect POS\aswMBR.txt"
ComboFix 11-09-09.01 - Victor 09/09/2011 0:38.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.2014 [GMT -4:00]
Running from: c:\users\Victor\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\chrome.manifest
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\chrome\xulcache.jar
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\defaults\preferences\xulcache.js
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{38c4a361-204c-47e0-9352-c1e6e90231d8}\install.rdf
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\chrome.manifest
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\chrome\xulcache.jar
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\defaults\preferences\xulcache.js
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{51abc595-ff82-4dc9-9081-411f1c5c4577}\install.rdf
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\chrome.manifest
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\chrome\xulcache.jar
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\defaults\preferences\xulcache.js
c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{9780c473-1c53-4d64-b75c-47918fa48f92}\install.rdf
.
.
((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-09 04:43 . 2011-09-09 04:43 -------- d-----w- c:\users\Victor\AppData\Local\temp
2011-09-09 04:43 . 2011-09-09 04:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-08 22:43 . 2011-09-08 22:43 -------- d-----w- c:\users\Victor\AppData\Roaming\Avira
2011-09-08 22:40 . 2011-07-21 16:15 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-09-08 22:40 . 2011-07-21 16:15 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-09-08 22:40 . 2011-09-08 22:40 -------- d-----w- c:\programdata\Avira
2011-09-08 22:38 . 2011-09-08 22:44 -------- d-----w- c:\program files\Avira
2011-09-08 20:28 . 2011-09-08 20:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-07 02:23 . 2011-09-07 02:23 -------- d-----w- c:\users\Victor\AppData\Roaming\Foxit Software
2011-09-06 22:23 . 2011-09-06 22:26 -------- d-----w- c:\windows\system32\catroot2
2011-09-06 18:16 . 2011-09-06 18:37 -------- d-----w- C:\Combo-Fix
2011-09-06 16:53 . 2011-09-07 00:21 -------- d-----w- c:\users\Victor\AppData\Roaming\AVG2012
2011-09-06 16:43 . 2011-09-06 16:43 0 ---ha-w- c:\windows\mmoewlmwpi.tmp
2011-09-06 16:33 . 2011-09-06 16:33 -------- d-----w- c:\program files\AVG
2011-09-06 14:05 . 2011-09-06 14:05 -------- d--h--w- c:\programdata\Common Files
2011-09-06 14:00 . 2011-09-07 00:18 -------- d-----w- c:\programdata\MFAData
2011-09-06 12:18 . 2011-09-06 12:18 0 ---ha-w- c:\windows\system32\mmoewlmwpi.tmp
2011-09-06 11:22 . 2011-09-06 11:22 240128 ----a-w- c:\windows\system32\wscui32.dll
2011-09-06 00:04 . 2008-11-12 07:00 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
2011-09-06 00:04 . 2008-11-12 07:00 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
2011-09-06 00:03 . 2011-09-06 00:04 -------- d-----w- c:\programdata\EPSON
2011-09-05 03:42 . 2011-09-09 02:17 -------- d-----w- c:\users\Victor\riotsGamesLogs
2011-09-02 00:52 . 2011-09-02 00:52 -------- d-----w- c:\windows\system32\CSP
2011-09-02 00:22 . 2011-09-02 00:22 -------- d-----w- c:\users\Victor\fontconfig
2011-09-02 00:17 . 2011-09-04 17:01 -------- d-----w- c:\users\Victor\.smplayer
2011-09-01 19:22 . 2011-09-01 19:22 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-09-01 19:20 . 2011-09-01 19:20 -------- d-----w- c:\program files\Common Files\L&H
2011-09-01 16:59 . 2011-09-01 17:00 -------- d-----w- c:\users\Victor\Cisco Packet Tracer 5.3.2
2011-09-01 15:59 . 2011-09-01 16:00 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
2011-09-01 03:09 . 2011-09-01 03:09 -------- d-----w- c:\users\Public\CyberLink
2011-09-01 02:19 . 2011-09-01 02:19 -------- d-----w- c:\users\Victor\AppData\Local\Microsoft Help
2011-08-31 12:51 . 2011-08-31 12:51 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-27 16:50 . 2011-09-08 18:32 -------- d-----w- C:\Dls
2011-08-27 16:47 . 2011-08-27 16:47 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-27 16:47 . 2011-08-31 13:55 -------- d-----w- c:\users\Victor\AppData\Local\Conduit
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\program files\uTorrent
2011-08-27 16:47 . 2011-09-09 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\uTorrent
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\users\Victor\AppData\Local\uTorrent
2011-08-27 11:58 . 2011-09-08 22:42 -------- d-----w- c:\program files\RegClean 5.9 English
2011-08-27 11:50 . 2011-08-27 11:50 -------- d-----w- c:\program files\CCleaner
2011-08-27 04:21 . 2011-08-27 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\SUPERAntiSpyware.com
2011-08-27 04:01 . 2011-08-27 04:01 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-08-27 03:33 . 2011-08-27 03:33 -------- d-----w- c:\users\Victor\AppData\Roaming\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 03:32 . 2011-08-27 03:32 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 03:32 . 2011-08-27 03:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-26 23:23 . 2011-08-26 23:23 -------- d-----w- c:\users\Victor\AppData\Roaming\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-08 21:13 . 2008-01-21 02:24 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
2011-09-03 06:01 . 2011-09-06 22:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01C7CF0F-DC08-4458-B8C6-82BFD7319B5a}]
2011-09-06 11:22 240128 ----a-w- c:\windows\System32\wscui32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVXV1UtV0JEWEMtVllGTjMtUURKTUgtNDJBT0EtSzZIVTk&inst=NzctNzE2NjkxOTk2LVNUMTJGT0krMS1ERFQrMC1FVUxBKzEtU1QxMkZBUFArMQ&prod=90&ver=2012.0.1796&mid=90677aaece9047d1934f13f94988ffe0-9581dd74e5f78007af15c41a9f2b377b615911ad" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-11-02 8704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DpAgent"=c:\program files\DigitalPersona\Bin\dpagent.exe
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"OnScreenDisplay"=c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
"RtHDVCpl"=RtHDVCpl.exe
"WAWifiMessage"=c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
"EnableNotificationsRef"=dword:00000003
.
R2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2006-11-02 9216]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2008-01-21 19968]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMBR
*NewlyCreated* - SSMDRV
*Deregistered* - aswMBR
*Deregistered* - ufdiakow
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-02 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-03 03:35]
.
2011-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
IE: E&xport to Microsoft Excel
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
FF - ProfilePath - c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\
.
- - - - ORPHANS REMOVED - - - -
.
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
Notify-!SASWinLogon - c:\program files\SUPERAntiSpyware\SASWINLO.DLL
SafeBoot-04906191.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-09 00:43
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-09-09 00:45:43
ComboFix-quarantined-files.txt 2011-09-09 04:45
.
Pre-Run: 11,091,349,504 bytes free
Post-Run: 11,194,482,688 bytes free
.
- - End Of File - - 4DAF2080845F89CA93E2AD8FC3C21EFE
Broni
Posts: 56,041 +516
How is redirection?
1. Please open Notepad
2. Now copy/paste the entire content of the codebox below into the Notepad window:
3. Save the above as CFScript.txt
4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.
5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box
- Click OK
2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\mmoewlmwpi.tmp
c:\windows\system32\mmoewlmwpi.tmp
Folder::
c:\users\Victor\AppData\Roaming\AVG2012
c:\program files\AVG
Driver::
NOD32FiXTemDono
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:000000003. Save the above as CFScript.txt
4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.
5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
Thank you for your assitance thus far, but unfortunately the redirects still occur. They are happening much less frequently now at a rate of about 1 redirect in every 20 clicks. The sites that I am redirected to look identical, although their URLs differ. xpertsuppliers d0t c0m and informationgetter d0t c0m are some of the examples.
===================================================================
ComboFix 11-09-09.03 - Victor 09/09/2011 9:31.5.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.2084 [GMT -4:00]
Running from: c:\users\Victor\Desktop\ComboFix.exe
Command switches used :: c:\users\Victor\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\mmoewlmwpi.tmp"
"c:\windows\system32\mmoewlmwpi.tmp"
.
.
((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-09 13:35 . 2011-09-09 13:35 -------- d-----w- c:\users\Victor\AppData\Local\temp
2011-09-09 13:35 . 2011-09-09 13:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-08 22:43 . 2011-09-08 22:43 -------- d-----w- c:\users\Victor\AppData\Roaming\Avira
2011-09-08 22:40 . 2011-07-21 16:15 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-09-08 22:40 . 2011-07-21 16:15 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-09-08 22:40 . 2011-09-08 22:40 -------- d-----w- c:\programdata\Avira
2011-09-08 22:38 . 2011-09-08 22:44 -------- d-----w- c:\program files\Avira
2011-09-08 20:28 . 2011-09-08 20:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-07 02:23 . 2011-09-07 02:23 -------- d-----w- c:\users\Victor\AppData\Roaming\Foxit Software
2011-09-06 22:23 . 2011-09-06 22:26 -------- d-----w- c:\windows\system32\catroot2
2011-09-06 18:16 . 2011-09-06 18:37 -------- d-----w- C:\Combo-Fix
2011-09-06 14:05 . 2011-09-06 14:05 -------- d--h--w- c:\programdata\Common Files
2011-09-06 14:00 . 2011-09-07 00:18 -------- d-----w- c:\programdata\MFAData
2011-09-06 11:22 . 2011-09-06 11:22 240128 ----a-w- c:\windows\system32\wscui32.dll
2011-09-06 00:04 . 2008-11-12 07:00 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
2011-09-06 00:04 . 2008-11-12 07:00 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
2011-09-06 00:03 . 2011-09-06 00:04 -------- d-----w- c:\programdata\EPSON
2011-09-05 03:42 . 2011-09-09 02:17 -------- d-----w- c:\users\Victor\riotsGamesLogs
2011-09-02 00:52 . 2011-09-02 00:52 -------- d-----w- c:\windows\system32\CSP
2011-09-02 00:22 . 2011-09-02 00:22 -------- d-----w- c:\users\Victor\fontconfig
2011-09-02 00:17 . 2011-09-04 17:01 -------- d-----w- c:\users\Victor\.smplayer
2011-09-01 19:22 . 2011-09-01 19:22 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-09-01 19:20 . 2011-09-01 19:20 -------- d-----w- c:\program files\Common Files\L&H
2011-09-01 16:59 . 2011-09-01 17:00 -------- d-----w- c:\users\Victor\Cisco Packet Tracer 5.3.2
2011-09-01 15:59 . 2011-09-01 16:00 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
2011-09-01 03:09 . 2011-09-01 03:09 -------- d-----w- c:\users\Public\CyberLink
2011-09-01 02:19 . 2011-09-01 02:19 -------- d-----w- c:\users\Victor\AppData\Local\Microsoft Help
2011-08-31 12:51 . 2011-08-31 12:51 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-27 16:50 . 2011-09-08 18:32 -------- d-----w- C:\Dls
2011-08-27 16:47 . 2011-08-27 16:47 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-27 16:47 . 2011-08-31 13:55 -------- d-----w- c:\users\Victor\AppData\Local\Conduit
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\program files\uTorrent
2011-08-27 16:47 . 2011-09-09 12:58 -------- d-----w- c:\users\Victor\AppData\Roaming\uTorrent
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\users\Victor\AppData\Local\uTorrent
2011-08-27 11:58 . 2011-09-08 22:42 -------- d-----w- c:\program files\RegClean 5.9 English
2011-08-27 11:50 . 2011-08-27 11:50 -------- d-----w- c:\program files\CCleaner
2011-08-27 04:21 . 2011-08-27 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\SUPERAntiSpyware.com
2011-08-27 04:01 . 2011-08-27 04:01 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-08-27 03:33 . 2011-08-27 03:33 -------- d-----w- c:\users\Victor\AppData\Roaming\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 03:32 . 2011-08-27 03:32 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 03:32 . 2011-08-27 03:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-26 23:23 . 2011-08-26 23:23 -------- d-----w- c:\users\Victor\AppData\Roaming\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-08 21:13 . 2008-01-21 02:24 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
2011-09-03 06:01 . 2011-09-06 22:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01C7CF0F-DC08-4458-B8C6-82BFD7319B5a}]
2011-09-06 11:22 240128 ----a-w- c:\windows\System32\wscui32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-11-02 8704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DpAgent"=c:\program files\DigitalPersona\Bin\dpagent.exe
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"OnScreenDisplay"=c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
"RtHDVCpl"=RtHDVCpl.exe
"WAWifiMessage"=c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
"EnableNotificationsRef"=dword:00000003
.
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2008-01-21 19968]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-02 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-03 03:35]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
IE: E&xport to Microsoft Excel
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
FF - ProfilePath - c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-09 09:35
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-09-09 09:37:30
ComboFix-quarantined-files.txt 2011-09-09 13:37
ComboFix2.txt 2011-09-09 13:28
.
Pre-Run: 11,245,846,528 bytes free
Post-Run: 11,202,617,344 bytes free
.
- - End Of File - - 5F5CA3098020F08141D0887F458EDAA6
===================================================================
ComboFix 11-09-09.03 - Victor 09/09/2011 9:31.5.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3070.2084 [GMT -4:00]
Running from: c:\users\Victor\Desktop\ComboFix.exe
Command switches used :: c:\users\Victor\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\mmoewlmwpi.tmp"
"c:\windows\system32\mmoewlmwpi.tmp"
.
.
((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-09 13:35 . 2011-09-09 13:35 -------- d-----w- c:\users\Victor\AppData\Local\temp
2011-09-09 13:35 . 2011-09-09 13:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-08 22:43 . 2011-09-08 22:43 -------- d-----w- c:\users\Victor\AppData\Roaming\Avira
2011-09-08 22:40 . 2011-07-21 16:15 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-09-08 22:40 . 2011-07-21 16:15 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-09-08 22:40 . 2011-09-08 22:40 -------- d-----w- c:\programdata\Avira
2011-09-08 22:38 . 2011-09-08 22:44 -------- d-----w- c:\program files\Avira
2011-09-08 20:28 . 2011-09-08 20:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-07 02:23 . 2011-09-07 02:23 -------- d-----w- c:\users\Victor\AppData\Roaming\Foxit Software
2011-09-06 22:23 . 2011-09-06 22:26 -------- d-----w- c:\windows\system32\catroot2
2011-09-06 18:16 . 2011-09-06 18:37 -------- d-----w- C:\Combo-Fix
2011-09-06 14:05 . 2011-09-06 14:05 -------- d--h--w- c:\programdata\Common Files
2011-09-06 14:00 . 2011-09-07 00:18 -------- d-----w- c:\programdata\MFAData
2011-09-06 11:22 . 2011-09-06 11:22 240128 ----a-w- c:\windows\system32\wscui32.dll
2011-09-06 00:04 . 2008-11-12 07:00 93696 ----a-w- c:\windows\system32\E_FLBFJA.DLL
2011-09-06 00:04 . 2008-11-12 07:00 79360 ----a-w- c:\windows\system32\E_FD4BFJA.DLL
2011-09-06 00:03 . 2011-09-06 00:04 -------- d-----w- c:\programdata\EPSON
2011-09-05 03:42 . 2011-09-09 02:17 -------- d-----w- c:\users\Victor\riotsGamesLogs
2011-09-02 00:52 . 2011-09-02 00:52 -------- d-----w- c:\windows\system32\CSP
2011-09-02 00:22 . 2011-09-02 00:22 -------- d-----w- c:\users\Victor\fontconfig
2011-09-02 00:17 . 2011-09-04 17:01 -------- d-----w- c:\users\Victor\.smplayer
2011-09-01 19:22 . 2011-09-01 19:22 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-09-01 19:20 . 2011-09-01 19:20 -------- d-----w- c:\program files\Common Files\L&H
2011-09-01 16:59 . 2011-09-01 17:00 -------- d-----w- c:\users\Victor\Cisco Packet Tracer 5.3.2
2011-09-01 15:59 . 2011-09-01 16:00 -------- d-----w- c:\program files\Cisco Packet Tracer 5.3.2
2011-09-01 03:09 . 2011-09-01 03:09 -------- d-----w- c:\users\Public\CyberLink
2011-09-01 02:19 . 2011-09-01 02:19 -------- d-----w- c:\users\Victor\AppData\Local\Microsoft Help
2011-08-31 12:51 . 2011-08-31 12:51 762 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-08-27 16:50 . 2011-09-08 18:32 -------- d-----w- C:\Dls
2011-08-27 16:47 . 2011-08-27 16:47 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-27 16:47 . 2011-08-31 13:55 -------- d-----w- c:\users\Victor\AppData\Local\Conduit
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\program files\uTorrent
2011-08-27 16:47 . 2011-09-09 12:58 -------- d-----w- c:\users\Victor\AppData\Roaming\uTorrent
2011-08-27 16:47 . 2011-08-27 16:47 -------- d-----w- c:\users\Victor\AppData\Local\uTorrent
2011-08-27 11:58 . 2011-09-08 22:42 -------- d-----w- c:\program files\RegClean 5.9 English
2011-08-27 11:50 . 2011-08-27 11:50 -------- d-----w- c:\program files\CCleaner
2011-08-27 04:21 . 2011-08-27 04:21 -------- d-----w- c:\users\Victor\AppData\Roaming\SUPERAntiSpyware.com
2011-08-27 04:01 . 2011-08-27 04:01 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-08-27 03:33 . 2011-08-27 03:33 -------- d-----w- c:\users\Victor\AppData\Roaming\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-27 03:32 . 2011-08-27 03:32 -------- d-----w- c:\programdata\Malwarebytes
2011-08-27 03:32 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 03:32 . 2011-08-27 03:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-26 23:23 . 2011-08-26 23:23 -------- d-----w- c:\users\Victor\AppData\Roaming\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-08 21:13 . 2008-01-21 02:24 71680 ----a-w- c:\windows\system32\drivers\tdx.sys
2011-09-03 06:01 . 2011-09-06 22:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01C7CF0F-DC08-4458-B8C6-82BFD7319B5a}]
2011-09-06 11:22 240128 ----a-w- c:\windows\System32\wscui32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-11-02 8704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DpAgent"=c:\program files\DigitalPersona\Bin\dpagent.exe
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"OnScreenDisplay"=c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
"RtHDVCpl"=RtHDVCpl.exe
"WAWifiMessage"=c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
"EnableNotificationsRef"=dword:00000003
.
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2008-01-21 19968]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 136176]
R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-02 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-03 03:35]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 07:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
IE: E&xport to Microsoft Excel
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
FF - ProfilePath - c:\users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-09 09:35
Windows 6.0.6001 Service Pack 1 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-09-09 09:37:30
ComboFix-quarantined-files.txt 2011-09-09 13:37
ComboFix2.txt 2011-09-09 13:28
.
Pre-Run: 11,245,846,528 bytes free
Post-Run: 11,202,617,344 bytes free
.
- - End Of File - - 5F5CA3098020F08141D0887F458EDAA6
Broni
Posts: 56,041 +516
Which browser is affected?
Download TDSSKiller and save it to your desktop.
Download TDSSKiller and save it to your desktop.
- Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
- If an infected file is detected, the default action will be Cure, click on Continue.
- If a suspicious file is detected, the default action will be Skip, click on Continue.
- It may ask you to reboot the computer to complete the process. Click on Reboot Now.
- If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
- If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
2011/09/09 23:07:59.0926 4056 TDSS rootkit removing tool 2.5.20.0 Sep 7 2011 16:44:34
2011/09/09 23:08:00.0160 4056 ================================================================================
2011/09/09 23:08:00.0160 4056 SystemInfo:
2011/09/09 23:08:00.0160 4056
2011/09/09 23:08:00.0160 4056 OS Version: 6.0.6001 ServicePack: 1.0
2011/09/09 23:08:00.0160 4056 Product type: Workstation
2011/09/09 23:08:00.0160 4056 ComputerName: VICTOR-LAPPY
2011/09/09 23:08:00.0160 4056 UserName: Victor
2011/09/09 23:08:00.0160 4056 Windows directory: C:\Windows
2011/09/09 23:08:00.0160 4056 System windows directory: C:\Windows
2011/09/09 23:08:00.0160 4056 Processor architecture: Intel x86
2011/09/09 23:08:00.0160 4056 Number of processors: 2
2011/09/09 23:08:00.0160 4056 Page size: 0x1000
2011/09/09 23:08:00.0160 4056 Boot type: Normal boot
2011/09/09 23:08:00.0160 4056 ================================================================================
2011/09/09 23:08:00.0550 4056 Initialize success
2011/09/09 23:08:05.0542 3844 ================================================================================
2011/09/09 23:08:05.0542 3844 Scan started
2011/09/09 23:08:05.0542 3844 Mode: Manual;
2011/09/09 23:08:05.0542 3844 ================================================================================
2011/09/09 23:08:05.0994 3844 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/09/09 23:08:06.0088 3844 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/09/09 23:08:06.0134 3844 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/09/09 23:08:06.0181 3844 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/09/09 23:08:06.0228 3844 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/09/09 23:08:06.0306 3844 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/09/09 23:08:06.0368 3844 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/09/09 23:08:06.0415 3844 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/09/09 23:08:06.0446 3844 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/09/09 23:08:06.0493 3844 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/09/09 23:08:06.0524 3844 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/09/09 23:08:06.0571 3844 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/09/09 23:08:06.0602 3844 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/09 23:08:06.0696 3844 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/09/09 23:08:06.0743 3844 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/09/09 23:08:06.0805 3844 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/09 23:08:06.0836 3844 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/09/09 23:08:06.0899 3844 ATSWPDRV (69e65a2ce11619f0c868967ca9540b80) C:\Windows\system32\DRIVERS\ATSwpDrv.sys
2011/09/09 23:08:06.0992 3844 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/09/09 23:08:07.0039 3844 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
2011/09/09 23:08:07.0133 3844 BCM43XV (cf6a67c90951e3e763d2135dede44b85) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/09/09 23:08:07.0195 3844 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/09/09 23:08:07.0258 3844 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/09/09 23:08:07.0304 3844 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/09 23:08:07.0351 3844 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/09/09 23:08:07.0382 3844 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/09/09 23:08:07.0429 3844 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/09/09 23:08:07.0460 3844 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/09/09 23:08:07.0492 3844 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/09/09 23:08:07.0538 3844 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/09/09 23:08:07.0570 3844 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/09/09 23:08:07.0726 3844 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/09 23:08:07.0757 3844 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/09 23:08:07.0804 3844 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/09/09 23:08:07.0850 3844 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/09/09 23:08:07.0913 3844 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/09/09 23:08:07.0944 3844 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/09/09 23:08:08.0006 3844 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/09/09 23:08:08.0084 3844 cpuz132 (097a0a4899b759a4f032bd464963b4be) C:\Windows\system32\drivers\cpuz132_x32.sys
2011/09/09 23:08:08.0100 3844 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/09/09 23:08:08.0131 3844 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/09/09 23:08:08.0225 3844 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
2011/09/09 23:08:08.0303 3844 CVPNDRVA (1c2999966f0f36aa44eaecbee70cf770) C:\Windows\system32\Drivers\CVPNDRVA.sys
2011/09/09 23:08:08.0350 3844 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/09/09 23:08:08.0412 3844 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/09/09 23:08:08.0474 3844 DNE (7b4fdfbe97c047175e613aa96f3de987) C:\Windows\system32\DRIVERS\dne2000.sys
2011/09/09 23:08:08.0552 3844 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/09/09 23:08:08.0630 3844 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/09 23:08:08.0662 3844 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/09/09 23:08:08.0755 3844 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/09/09 23:08:08.0833 3844 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/09/09 23:08:08.0864 3844 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/09/09 23:08:08.0942 3844 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/09/09 23:08:08.0974 3844 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/09/09 23:08:09.0005 3844 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/09 23:08:09.0083 3844 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/09/09 23:08:09.0114 3844 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/09/09 23:08:09.0145 3844 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/09 23:08:09.0161 3844 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/09/09 23:08:09.0192 3844 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/09 23:08:09.0223 3844 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/09/09 23:08:09.0317 3844 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/09/09 23:08:09.0348 3844 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/09 23:08:09.0379 3844 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/09/09 23:08:09.0395 3844 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/09/09 23:08:09.0457 3844 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/09 23:08:09.0520 3844 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/09/09 23:08:09.0551 3844 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys
2011/09/09 23:08:09.0582 3844 HpqRemHid (115c0933b3ed51dfbec4449348c8065b) C:\Windows\system32\DRIVERS\HpqRemHid.sys
2011/09/09 23:08:09.0660 3844 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/09/09 23:08:09.0722 3844 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/09/09 23:08:09.0785 3844 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/09/09 23:08:09.0816 3844 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/09/09 23:08:09.0894 3844 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/09 23:08:09.0972 3844 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys
2011/09/09 23:08:10.0003 3844 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/09/09 23:08:10.0050 3844 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/09/09 23:08:10.0175 3844 IntcAzAudAddService (8d7eb1fd498fd0a34c95a298685ec1c7) C:\Windows\system32\drivers\RTKVHDA.sys
2011/09/09 23:08:10.0253 3844 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/09/09 23:08:10.0300 3844 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/09 23:08:10.0362 3844 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/09 23:08:10.0409 3844 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/09/09 23:08:10.0456 3844 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/09/09 23:08:10.0471 3844 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/09/09 23:08:10.0487 3844 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/09/09 23:08:10.0534 3844 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/09 23:08:10.0565 3844 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/09/09 23:08:10.0612 3844 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/09/09 23:08:10.0658 3844 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/09 23:08:10.0690 3844 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/09 23:08:10.0768 3844 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/09 23:08:10.0814 3844 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/09 23:08:10.0861 3844 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/09/09 23:08:10.0892 3844 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/09/09 23:08:10.0924 3844 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/09/09 23:08:10.0955 3844 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/09/09 23:08:11.0048 3844 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\Windows\system32\drivers\mbam.sys
2011/09/09 23:08:11.0126 3844 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/09/09 23:08:11.0189 3844 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/09/09 23:08:11.0220 3844 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/09/09 23:08:11.0282 3844 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/09 23:08:11.0314 3844 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/09 23:08:11.0345 3844 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/09 23:08:11.0360 3844 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/09/09 23:08:11.0423 3844 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/09/09 23:08:11.0470 3844 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/09 23:08:11.0516 3844 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/09/09 23:08:11.0563 3844 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/09/09 23:08:11.0626 3844 mrxsmb (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/09 23:08:11.0688 3844 mrxsmb10 (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/09 23:08:11.0766 3844 mrxsmb20 (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/09 23:08:11.0813 3844 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/09/09 23:08:11.0860 3844 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/09/09 23:08:11.0875 3844 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/09/09 23:08:11.0938 3844 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/09/09 23:08:12.0000 3844 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/09 23:08:12.0062 3844 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/09 23:08:12.0094 3844 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/09/09 23:08:12.0125 3844 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/09/09 23:08:12.0140 3844 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/09 23:08:12.0187 3844 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/09/09 23:08:12.0203 3844 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/09/09 23:08:12.0296 3844 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/09 23:08:12.0359 3844 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/09/09 23:08:12.0390 3844 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/09 23:08:12.0437 3844 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/09 23:08:12.0468 3844 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/09 23:08:12.0484 3844 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/09/09 23:08:12.0515 3844 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/09 23:08:12.0546 3844 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/09 23:08:12.0671 3844 NETw4v32 (6522dd40a5f67ced020bd81b856613fb) C:\Windows\system32\DRIVERS\NETw4v32.sys
2011/09/09 23:08:12.0718 3844 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/09/09 23:08:12.0749 3844 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/09/09 23:08:12.0780 3844 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/09 23:08:12.0842 3844 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/09/09 23:08:12.0874 3844 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/09/09 23:08:12.0905 3844 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/09/09 23:08:12.0983 3844 NVENETFD (1657f3fbd9061526c14ff37e79306f98) C:\Windows\system32\DRIVERS\nvm60x32.sys
2011/09/09 23:08:13.0295 3844 nvlddmkm (377140a534d013bd661c69f1741de43c) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/09 23:08:13.0451 3844 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/09/09 23:08:13.0466 3844 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/09/09 23:08:13.0560 3844 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/09/09 23:08:13.0654 3844 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/09 23:08:13.0685 3844 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/09/09 23:08:13.0732 3844 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/09/09 23:08:13.0763 3844 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/09/09 23:08:13.0794 3844 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/09/09 23:08:13.0856 3844 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/09/09 23:08:13.0888 3844 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/09/09 23:08:13.0966 3844 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/09/09 23:08:14.0044 3844 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/09 23:08:14.0075 3844 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/09/09 23:08:14.0153 3844 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/09 23:08:14.0246 3844 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/09/09 23:08:14.0278 3844 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/09/09 23:08:14.0324 3844 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/09 23:08:14.0340 3844 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/09 23:08:14.0371 3844 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/09 23:08:14.0402 3844 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/09 23:08:14.0434 3844 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/09/09 23:08:14.0465 3844 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/09 23:08:14.0480 3844 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/09 23:08:14.0527 3844 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/09/09 23:08:14.0543 3844 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/09 23:08:14.0590 3844 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/09/09 23:08:14.0668 3844 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys
2011/09/09 23:08:14.0730 3844 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys
2011/09/09 23:08:14.0855 3844 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
2011/09/09 23:08:14.0917 3844 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys
2011/09/09 23:08:14.0980 3844 RMCAST (fdeb76bed9c0a75329ca426623297158) C:\Windows\system32\DRIVERS\RMCAST.sys
2011/09/09 23:08:15.0011 3844 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/09/09 23:08:15.0042 3844 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/09 23:08:15.0120 3844 RTL8169 (9a929308a64183d3d9dccbb6df4badae) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/09/09 23:08:15.0167 3844 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/09/09 23:08:15.0260 3844 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
2011/09/09 23:08:15.0292 3844 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/09/09 23:08:15.0338 3844 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/09/09 23:08:15.0385 3844 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/09/09 23:08:15.0416 3844 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/09/09 23:08:15.0479 3844 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/09/09 23:08:15.0510 3844 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/09/09 23:08:15.0541 3844 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/09/09 23:08:15.0572 3844 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/09/09 23:08:15.0619 3844 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/09/09 23:08:15.0650 3844 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/09/09 23:08:15.0682 3844 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/09/09 23:08:15.0728 3844 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/09/09 23:08:15.0775 3844 smserial (63b3b77bdb67ee674771c0e6fb96da9e) C:\Windows\system32\DRIVERS\smserial.sys
2011/09/09 23:08:15.0822 3844 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/09/09 23:08:15.0884 3844 srv (8e5fc19b3b38364c5f44ccecec5248e9) C:\Windows\system32\DRIVERS\srv.sys
2011/09/09 23:08:15.0947 3844 srv2 (4ceeb95e0b79e48b81f2da0a6c24c64b) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/09 23:08:16.0009 3844 srvnet (f9c65e1e00a6bbf7c57d9b8ea068c525) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/09 23:08:16.0072 3844 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/09/09 23:08:16.0150 3844 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/09 23:08:16.0196 3844 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/09/09 23:08:16.0274 3844 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/09/09 23:08:16.0306 3844 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/09/09 23:08:16.0337 3844 SynTP (f5d926807bd9bc0af68f9376144de425) C:\Windows\system32\DRIVERS\SynTP.sys
2011/09/09 23:08:16.0446 3844 Tcpip (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\drivers\tcpip.sys
2011/09/09 23:08:16.0508 3844 Tcpip6 (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/09 23:08:16.0540 3844 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/09 23:08:16.0555 3844 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/09/09 23:08:16.0586 3844 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/09/09 23:08:16.0618 3844 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/09 23:08:16.0649 3844 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/09/09 23:08:16.0711 3844 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/09 23:08:16.0758 3844 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/09/09 23:08:16.0820 3844 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/09 23:08:16.0852 3844 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/09/09 23:08:16.0883 3844 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/09 23:08:16.0930 3844 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/09/09 23:08:16.0961 3844 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/09/09 23:08:16.0992 3844 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/09/09 23:08:17.0023 3844 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/09/09 23:08:17.0054 3844 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/09 23:08:17.0101 3844 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/09 23:08:17.0148 3844 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/09/09 23:08:17.0195 3844 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/09 23:08:17.0226 3844 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/09 23:08:17.0257 3844 usbohci (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/09 23:08:17.0288 3844 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
2011/09/09 23:08:17.0335 3844 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/09 23:08:17.0351 3844 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/09 23:08:17.0429 3844 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/09/09 23:08:17.0507 3844 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/09 23:08:17.0522 3844 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/09/09 23:08:17.0554 3844 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/09/09 23:08:17.0585 3844 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/09/09 23:08:17.0616 3844 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/09/09 23:08:17.0647 3844 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/09/09 23:08:17.0678 3844 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/09/09 23:08:17.0694 3844 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/09/09 23:08:17.0756 3844 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/09/09 23:08:17.0803 3844 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/09/09 23:08:17.0819 3844 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/09 23:08:17.0866 3844 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/09 23:08:17.0912 3844 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/09/09 23:08:17.0944 3844 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/09 23:08:18.0037 3844 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/09/09 23:08:18.0100 3844 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/09/09 23:08:18.0162 3844 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/09 23:08:18.0209 3844 WSDPrintDevice (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
2011/09/09 23:08:18.0256 3844 WSDScan (9f6fa85e84d0a42d86a9dbb79d76b0ed) C:\Windows\system32\DRIVERS\WSDScan.sys
2011/09/09 23:08:18.0302 3844 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/09 23:08:18.0380 3844 MBR (0x1B8) (1a1a06f62e891045814007163c1c76c3) \Device\Harddisk0\DR0
2011/09/09 23:08:18.0412 3844 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
2011/09/09 23:08:18.0427 3844 Boot (0x1200) (9476977f60eef92252fb08c3beba1463) \Device\Harddisk0\DR0\Partition0
2011/09/09 23:08:18.0443 3844 Boot (0x1200) (f2db4dd8ef2ebc3f34ad7c1a781b65b5) \Device\Harddisk0\DR0\Partition1
2011/09/09 23:08:18.0458 3844 Boot (0x1200) (85bf0a42c1bf840de30cb25976ec98d9) \Device\Harddisk1\DR1\Partition0
2011/09/09 23:08:18.0474 3844 ================================================================================
2011/09/09 23:08:18.0474 3844 Scan finished
2011/09/09 23:08:18.0474 3844 ================================================================================
2011/09/09 23:08:18.0490 3328 Detected object count: 0
2011/09/09 23:08:18.0490 3328 Actual detected object count: 0
2011/09/09 23:08:00.0160 4056 ================================================================================
2011/09/09 23:08:00.0160 4056 SystemInfo:
2011/09/09 23:08:00.0160 4056
2011/09/09 23:08:00.0160 4056 OS Version: 6.0.6001 ServicePack: 1.0
2011/09/09 23:08:00.0160 4056 Product type: Workstation
2011/09/09 23:08:00.0160 4056 ComputerName: VICTOR-LAPPY
2011/09/09 23:08:00.0160 4056 UserName: Victor
2011/09/09 23:08:00.0160 4056 Windows directory: C:\Windows
2011/09/09 23:08:00.0160 4056 System windows directory: C:\Windows
2011/09/09 23:08:00.0160 4056 Processor architecture: Intel x86
2011/09/09 23:08:00.0160 4056 Number of processors: 2
2011/09/09 23:08:00.0160 4056 Page size: 0x1000
2011/09/09 23:08:00.0160 4056 Boot type: Normal boot
2011/09/09 23:08:00.0160 4056 ================================================================================
2011/09/09 23:08:00.0550 4056 Initialize success
2011/09/09 23:08:05.0542 3844 ================================================================================
2011/09/09 23:08:05.0542 3844 Scan started
2011/09/09 23:08:05.0542 3844 Mode: Manual;
2011/09/09 23:08:05.0542 3844 ================================================================================
2011/09/09 23:08:05.0994 3844 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/09/09 23:08:06.0088 3844 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/09/09 23:08:06.0134 3844 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/09/09 23:08:06.0181 3844 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/09/09 23:08:06.0228 3844 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/09/09 23:08:06.0306 3844 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/09/09 23:08:06.0368 3844 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/09/09 23:08:06.0415 3844 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/09/09 23:08:06.0446 3844 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/09/09 23:08:06.0493 3844 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/09/09 23:08:06.0524 3844 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/09/09 23:08:06.0571 3844 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/09/09 23:08:06.0602 3844 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/09 23:08:06.0696 3844 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/09/09 23:08:06.0743 3844 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/09/09 23:08:06.0805 3844 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/09 23:08:06.0836 3844 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/09/09 23:08:06.0899 3844 ATSWPDRV (69e65a2ce11619f0c868967ca9540b80) C:\Windows\system32\DRIVERS\ATSwpDrv.sys
2011/09/09 23:08:06.0992 3844 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/09/09 23:08:07.0039 3844 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
2011/09/09 23:08:07.0133 3844 BCM43XV (cf6a67c90951e3e763d2135dede44b85) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/09/09 23:08:07.0195 3844 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/09/09 23:08:07.0258 3844 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/09/09 23:08:07.0304 3844 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/09 23:08:07.0351 3844 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/09/09 23:08:07.0382 3844 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/09/09 23:08:07.0429 3844 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/09/09 23:08:07.0460 3844 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/09/09 23:08:07.0492 3844 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/09/09 23:08:07.0538 3844 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/09/09 23:08:07.0570 3844 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/09/09 23:08:07.0726 3844 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/09 23:08:07.0757 3844 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/09 23:08:07.0804 3844 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/09/09 23:08:07.0850 3844 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/09/09 23:08:07.0913 3844 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/09/09 23:08:07.0944 3844 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/09/09 23:08:08.0006 3844 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/09/09 23:08:08.0084 3844 cpuz132 (097a0a4899b759a4f032bd464963b4be) C:\Windows\system32\drivers\cpuz132_x32.sys
2011/09/09 23:08:08.0100 3844 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/09/09 23:08:08.0131 3844 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/09/09 23:08:08.0225 3844 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys
2011/09/09 23:08:08.0303 3844 CVPNDRVA (1c2999966f0f36aa44eaecbee70cf770) C:\Windows\system32\Drivers\CVPNDRVA.sys
2011/09/09 23:08:08.0350 3844 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/09/09 23:08:08.0412 3844 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/09/09 23:08:08.0474 3844 DNE (7b4fdfbe97c047175e613aa96f3de987) C:\Windows\system32\DRIVERS\dne2000.sys
2011/09/09 23:08:08.0552 3844 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/09/09 23:08:08.0630 3844 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/09 23:08:08.0662 3844 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/09/09 23:08:08.0755 3844 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/09/09 23:08:08.0833 3844 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/09/09 23:08:08.0864 3844 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/09/09 23:08:08.0942 3844 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/09/09 23:08:08.0974 3844 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/09/09 23:08:09.0005 3844 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/09 23:08:09.0083 3844 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/09/09 23:08:09.0114 3844 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/09/09 23:08:09.0145 3844 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/09 23:08:09.0161 3844 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/09/09 23:08:09.0192 3844 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/09 23:08:09.0223 3844 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/09/09 23:08:09.0317 3844 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/09/09 23:08:09.0348 3844 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/09 23:08:09.0379 3844 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/09/09 23:08:09.0395 3844 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/09/09 23:08:09.0457 3844 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/09 23:08:09.0520 3844 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/09/09 23:08:09.0551 3844 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys
2011/09/09 23:08:09.0582 3844 HpqRemHid (115c0933b3ed51dfbec4449348c8065b) C:\Windows\system32\DRIVERS\HpqRemHid.sys
2011/09/09 23:08:09.0660 3844 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/09/09 23:08:09.0722 3844 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/09/09 23:08:09.0785 3844 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/09/09 23:08:09.0816 3844 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/09/09 23:08:09.0894 3844 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/09 23:08:09.0972 3844 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys
2011/09/09 23:08:10.0003 3844 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/09/09 23:08:10.0050 3844 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/09/09 23:08:10.0175 3844 IntcAzAudAddService (8d7eb1fd498fd0a34c95a298685ec1c7) C:\Windows\system32\drivers\RTKVHDA.sys
2011/09/09 23:08:10.0253 3844 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/09/09 23:08:10.0300 3844 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/09 23:08:10.0362 3844 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/09 23:08:10.0409 3844 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/09/09 23:08:10.0456 3844 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/09/09 23:08:10.0471 3844 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/09/09 23:08:10.0487 3844 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/09/09 23:08:10.0534 3844 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/09 23:08:10.0565 3844 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/09/09 23:08:10.0612 3844 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/09/09 23:08:10.0658 3844 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/09 23:08:10.0690 3844 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/09 23:08:10.0768 3844 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/09 23:08:10.0814 3844 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/09 23:08:10.0861 3844 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/09/09 23:08:10.0892 3844 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/09/09 23:08:10.0924 3844 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/09/09 23:08:10.0955 3844 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/09/09 23:08:11.0048 3844 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\Windows\system32\drivers\mbam.sys
2011/09/09 23:08:11.0126 3844 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/09/09 23:08:11.0189 3844 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/09/09 23:08:11.0220 3844 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/09/09 23:08:11.0282 3844 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/09 23:08:11.0314 3844 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/09 23:08:11.0345 3844 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/09 23:08:11.0360 3844 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/09/09 23:08:11.0423 3844 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/09/09 23:08:11.0470 3844 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/09 23:08:11.0516 3844 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/09/09 23:08:11.0563 3844 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/09/09 23:08:11.0626 3844 mrxsmb (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/09 23:08:11.0688 3844 mrxsmb10 (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/09 23:08:11.0766 3844 mrxsmb20 (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/09 23:08:11.0813 3844 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/09/09 23:08:11.0860 3844 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/09/09 23:08:11.0875 3844 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/09/09 23:08:11.0938 3844 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/09/09 23:08:12.0000 3844 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/09 23:08:12.0062 3844 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/09 23:08:12.0094 3844 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/09/09 23:08:12.0125 3844 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/09/09 23:08:12.0140 3844 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/09 23:08:12.0187 3844 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/09/09 23:08:12.0203 3844 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/09/09 23:08:12.0296 3844 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/09 23:08:12.0359 3844 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/09/09 23:08:12.0390 3844 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/09 23:08:12.0437 3844 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/09 23:08:12.0468 3844 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/09 23:08:12.0484 3844 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/09/09 23:08:12.0515 3844 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/09 23:08:12.0546 3844 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/09 23:08:12.0671 3844 NETw4v32 (6522dd40a5f67ced020bd81b856613fb) C:\Windows\system32\DRIVERS\NETw4v32.sys
2011/09/09 23:08:12.0718 3844 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/09/09 23:08:12.0749 3844 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/09/09 23:08:12.0780 3844 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/09 23:08:12.0842 3844 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/09/09 23:08:12.0874 3844 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/09/09 23:08:12.0905 3844 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/09/09 23:08:12.0983 3844 NVENETFD (1657f3fbd9061526c14ff37e79306f98) C:\Windows\system32\DRIVERS\nvm60x32.sys
2011/09/09 23:08:13.0295 3844 nvlddmkm (377140a534d013bd661c69f1741de43c) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/09 23:08:13.0451 3844 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/09/09 23:08:13.0466 3844 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/09/09 23:08:13.0560 3844 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/09/09 23:08:13.0654 3844 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/09 23:08:13.0685 3844 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/09/09 23:08:13.0732 3844 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/09/09 23:08:13.0763 3844 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/09/09 23:08:13.0794 3844 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/09/09 23:08:13.0856 3844 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/09/09 23:08:13.0888 3844 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/09/09 23:08:13.0966 3844 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/09/09 23:08:14.0044 3844 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/09 23:08:14.0075 3844 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/09/09 23:08:14.0153 3844 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/09 23:08:14.0246 3844 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/09/09 23:08:14.0278 3844 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/09/09 23:08:14.0324 3844 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/09 23:08:14.0340 3844 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/09 23:08:14.0371 3844 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/09 23:08:14.0402 3844 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/09 23:08:14.0434 3844 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/09/09 23:08:14.0465 3844 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/09 23:08:14.0480 3844 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/09 23:08:14.0527 3844 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/09/09 23:08:14.0543 3844 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/09 23:08:14.0590 3844 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/09/09 23:08:14.0668 3844 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys
2011/09/09 23:08:14.0730 3844 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\DRIVERS\rimsptsk.sys
2011/09/09 23:08:14.0855 3844 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
2011/09/09 23:08:14.0917 3844 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\DRIVERS\rixdptsk.sys
2011/09/09 23:08:14.0980 3844 RMCAST (fdeb76bed9c0a75329ca426623297158) C:\Windows\system32\DRIVERS\RMCAST.sys
2011/09/09 23:08:15.0011 3844 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/09/09 23:08:15.0042 3844 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/09 23:08:15.0120 3844 RTL8169 (9a929308a64183d3d9dccbb6df4badae) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/09/09 23:08:15.0167 3844 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/09/09 23:08:15.0260 3844 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
2011/09/09 23:08:15.0292 3844 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/09/09 23:08:15.0338 3844 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/09/09 23:08:15.0385 3844 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/09/09 23:08:15.0416 3844 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/09/09 23:08:15.0479 3844 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/09/09 23:08:15.0510 3844 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/09/09 23:08:15.0541 3844 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/09/09 23:08:15.0572 3844 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/09/09 23:08:15.0619 3844 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/09/09 23:08:15.0650 3844 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/09/09 23:08:15.0682 3844 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/09/09 23:08:15.0728 3844 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/09/09 23:08:15.0775 3844 smserial (63b3b77bdb67ee674771c0e6fb96da9e) C:\Windows\system32\DRIVERS\smserial.sys
2011/09/09 23:08:15.0822 3844 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/09/09 23:08:15.0884 3844 srv (8e5fc19b3b38364c5f44ccecec5248e9) C:\Windows\system32\DRIVERS\srv.sys
2011/09/09 23:08:15.0947 3844 srv2 (4ceeb95e0b79e48b81f2da0a6c24c64b) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/09 23:08:16.0009 3844 srvnet (f9c65e1e00a6bbf7c57d9b8ea068c525) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/09 23:08:16.0072 3844 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/09/09 23:08:16.0150 3844 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/09 23:08:16.0196 3844 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/09/09 23:08:16.0274 3844 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/09/09 23:08:16.0306 3844 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/09/09 23:08:16.0337 3844 SynTP (f5d926807bd9bc0af68f9376144de425) C:\Windows\system32\DRIVERS\SynTP.sys
2011/09/09 23:08:16.0446 3844 Tcpip (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\drivers\tcpip.sys
2011/09/09 23:08:16.0508 3844 Tcpip6 (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/09 23:08:16.0540 3844 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/09 23:08:16.0555 3844 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/09/09 23:08:16.0586 3844 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/09/09 23:08:16.0618 3844 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/09 23:08:16.0649 3844 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/09/09 23:08:16.0711 3844 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/09 23:08:16.0758 3844 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/09/09 23:08:16.0820 3844 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/09 23:08:16.0852 3844 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/09/09 23:08:16.0883 3844 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/09 23:08:16.0930 3844 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/09/09 23:08:16.0961 3844 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/09/09 23:08:16.0992 3844 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/09/09 23:08:17.0023 3844 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/09/09 23:08:17.0054 3844 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/09 23:08:17.0101 3844 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/09 23:08:17.0148 3844 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/09/09 23:08:17.0195 3844 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/09 23:08:17.0226 3844 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/09 23:08:17.0257 3844 usbohci (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/09 23:08:17.0288 3844 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
2011/09/09 23:08:17.0335 3844 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/09 23:08:17.0351 3844 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/09 23:08:17.0429 3844 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/09/09 23:08:17.0507 3844 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/09 23:08:17.0522 3844 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/09/09 23:08:17.0554 3844 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/09/09 23:08:17.0585 3844 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/09/09 23:08:17.0616 3844 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/09/09 23:08:17.0647 3844 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/09/09 23:08:17.0678 3844 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/09/09 23:08:17.0694 3844 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/09/09 23:08:17.0756 3844 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/09/09 23:08:17.0803 3844 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/09/09 23:08:17.0819 3844 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/09 23:08:17.0866 3844 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/09 23:08:17.0912 3844 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/09/09 23:08:17.0944 3844 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/09 23:08:18.0037 3844 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/09/09 23:08:18.0100 3844 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/09/09 23:08:18.0162 3844 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/09 23:08:18.0209 3844 WSDPrintDevice (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
2011/09/09 23:08:18.0256 3844 WSDScan (9f6fa85e84d0a42d86a9dbb79d76b0ed) C:\Windows\system32\DRIVERS\WSDScan.sys
2011/09/09 23:08:18.0302 3844 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/09 23:08:18.0380 3844 MBR (0x1B8) (1a1a06f62e891045814007163c1c76c3) \Device\Harddisk0\DR0
2011/09/09 23:08:18.0412 3844 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
2011/09/09 23:08:18.0427 3844 Boot (0x1200) (9476977f60eef92252fb08c3beba1463) \Device\Harddisk0\DR0\Partition0
2011/09/09 23:08:18.0443 3844 Boot (0x1200) (f2db4dd8ef2ebc3f34ad7c1a781b65b5) \Device\Harddisk0\DR0\Partition1
2011/09/09 23:08:18.0458 3844 Boot (0x1200) (85bf0a42c1bf840de30cb25976ec98d9) \Device\Harddisk1\DR1\Partition0
2011/09/09 23:08:18.0474 3844 ================================================================================
2011/09/09 23:08:18.0474 3844 Scan finished
2011/09/09 23:08:18.0474 3844 ================================================================================
2011/09/09 23:08:18.0490 3328 Detected object count: 0
2011/09/09 23:08:18.0490 3328 Actual detected object count: 0
TDS killer found nothing but then I believe I have solved the issue.
I went back to the original instructions and started following them from step one all over. Originally, I did not run aswMBR from desktop but from a folder on the desktop (not sure if it made a differnce)
So, I have re-downloaded all of the files onto the desktop and exited all of my programs and disabled Avira AntiVir. Then I ran aswMBR from desktop, and it produced one detection "c:\windows\system32\wscui32.dll". Then, Immediately after I ran Combofix from my desktop. After this, I have made a notepad file that you suggested and I added "c:\windows\system32\wscui32.dll" line after the "File:" and named it CFScript.txt and dragged and dropped it onto Combofix.exe immediately after the first combofix.exe scan was completed. After the 2nd Combofix scan, I ran TDSKiller and it produced 0 detections, which i sort of expected.
I restarted windows, tried clicking about 100 google search results with various keywords, and so far no redirects! Ran MBAM quick scan again, which previously has been producing the one detection "HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO)" after every restart, even though it claimed to remove it every time.
This time, MBAM produced 0 detections!
Two questions arise:
1. I have an external USB HDD which I plug in and out all the time, and Avira AntiVir blocks its autorun.inf. Could the redirect virus have spread onto the external HDD prior to me having Avira AntiVir? And if I were to disable the autorun.inf block, could it comeback and spread again?
2. Could this virus have had access to my stored passwords, and/or other passwords which I may have entered to log into banking/credit card sites?
Thank you again. My gratitude is enormous.
I went back to the original instructions and started following them from step one all over. Originally, I did not run aswMBR from desktop but from a folder on the desktop (not sure if it made a differnce)
So, I have re-downloaded all of the files onto the desktop and exited all of my programs and disabled Avira AntiVir. Then I ran aswMBR from desktop, and it produced one detection "c:\windows\system32\wscui32.dll". Then, Immediately after I ran Combofix from my desktop. After this, I have made a notepad file that you suggested and I added "c:\windows\system32\wscui32.dll" line after the "File:" and named it CFScript.txt and dragged and dropped it onto Combofix.exe immediately after the first combofix.exe scan was completed. After the 2nd Combofix scan, I ran TDSKiller and it produced 0 detections, which i sort of expected.
I restarted windows, tried clicking about 100 google search results with various keywords, and so far no redirects! Ran MBAM quick scan again, which previously has been producing the one detection "HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO)" after every restart, even though it claimed to remove it every time.
This time, MBAM produced 0 detections!
Two questions arise:
1. I have an external USB HDD which I plug in and out all the time, and Avira AntiVir blocks its autorun.inf. Could the redirect virus have spread onto the external HDD prior to me having Avira AntiVir? And if I were to disable the autorun.inf block, could it comeback and spread again?
2. Could this virus have had access to my stored passwords, and/or other passwords which I may have entered to log into banking/credit card sites?
Thank you again. My gratitude is enormous.
Broni
Posts: 56,041 +516
Good news then 
1. Install this on your computer. Then plug the drive in and scan it with Avira.
Download, and run Flash Disinfector, and save it to your desktop (Windows Vista and Windows 7 users, scroll down)
*Please disable any AV / ScriptBlockers as they might detect Flash Disinfector to be malicious and block it. Hence, the failure in executing. You can enable them back after the cleaning process*
Windows Vista and Windows 7 users
Flash Disinfector is not compatible with the above Windows version.
Please, use Panda USB Vaccine, or BitDefender’s USB Immunizer
2. Yes. You should change all your passwords, but wait with that, because I want you to run couple more scans for me....
Download OTL to your Desktop.
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop
1. Install this on your computer. Then plug the drive in and scan it with Avira.
Download, and run Flash Disinfector, and save it to your desktop (Windows Vista and Windows 7 users, scroll down)
*Please disable any AV / ScriptBlockers as they might detect Flash Disinfector to be malicious and block it. Hence, the failure in executing. You can enable them back after the cleaning process*
- Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
- The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
- Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
- Wait until it has finished scanning and then exit the program.
- Reboot your computer when done.
Windows Vista and Windows 7 users
Flash Disinfector is not compatible with the above Windows version.
Please, use Panda USB Vaccine, or BitDefender’s USB Immunizer
2. Yes. You should change all your passwords, but wait with that, because I want you to run couple more scans for me....
Download OTL to your Desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Click the Scan All Users checkbox.
- Under the Custom Scan box paste this in:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
OTL logfile created on: 9/10/2011 10:48:22 AM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Victor\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 69.29% Memory free
6.19 Gb Paging File | 5.36 Gb Available in Paging File | 86.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99.72 Gb Total Space | 10.98 Gb Free Space | 11.01% Space Free | Partition Type: NTFS
Drive D: | 12.07 Gb Total Space | 1.99 Gb Free Space | 16.53% Space Free | Partition Type: NTFS
Drive F: | 465.11 Gb Total Space | 53.70 Gb Free Space | 11.54% Space Free | Partition Type: NTFS
Computer Name: VICTOR-LAPPY | User Name: Victor | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
PRC - [2011/09/03 02:01:45 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/07/21 12:12:18 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/04/21 07:54:06 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/04/21 07:53:50 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/21 07:53:34 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/04/15 20:54:40 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2008/01/20 22:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
========== Modules (No Company Name) ==========
MOD - [2011/09/03 02:01:45 | 001,846,232 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2008/09/16 20:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- -- (MDM)
SRV - [2011/07/21 12:12:18 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/04/21 07:53:50 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/07/09 19:20:06 | 001,469,544 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Windows\System32\nvsvc.dll -- (nvsvc)
SRV - [2009/01/26 19:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Disabled | Stopped] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/04/15 20:54:42 | 000,354,840 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007/09/20 14:02:58 | 000,299,008 | ---- | M] (DigitalPersona, Inc.) [Disabled | Stopped] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2007/05/16 13:41:18 | 000,029,704 | ---- | M] (TuneUp Software GmbH) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2007/04/03 19:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Disabled | Stopped] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2007/03/05 13:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Disabled | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)
========== Driver Services (SafeList) ==========
DRV - [2011/07/21 12:15:22 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/21 12:15:20 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/07/09 18:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/06/17 15:27:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/27 05:16:28 | 000,012,672 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz132_x32.sys -- (cpuz132)
DRV - [2008/05/09 21:33:10 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) RMCAST (Pgm)
DRV - [2008/01/20 22:23:27 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV - [2008/01/20 22:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2007/09/26 16:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007/09/17 19:17:36 | 000,098,816 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007/08/28 18:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
DRV - [2007/07/11 13:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid)
DRV - [2007/06/18 20:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007/04/03 19:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007/01/31 16:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2007/01/18 17:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2007/01/17 09:38:52 | 000,983,936 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006/11/16 12:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/16 07:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/16 05:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/02 03:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/06 18:44:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/06 22:22:36 | 000,000,000 | ---D | M]
[2009/11/23 02:22:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Victor\AppData\Roaming\Mozilla\Extensions
[2011/09/09 22:56:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions
[2011/09/07 11:02:39 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{aa7b9bfa-4feb-4f84-bfb3-6cdcfc6e4a2c}
[2011/09/06 19:05:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/09/06 19:05:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/06 19:01:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011/09/03 02:01:45 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/12/23 12:06:38 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2011/09/02 19:25:59 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
O1 HOSTS File: ([2011/09/09 23:05:04 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 4
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\HPTimewarp.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\HPTimewarp.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/07/01 09:18:01 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011/09/10 10:32:00 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O32 - AutoRun File - [2011/09/10 10:32:01 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/03/21 14:51:12 | 000,000,000 | ---D | M] - F:\AUTORUN_.INF -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSACM.MSNAUDIO - C:\Windows\System32\msnaudio.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\Windows\System32\SL_ANET.ACM (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/09/10 10:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2011/09/10 10:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
[2011/09/10 10:37:04 | 000,000,000 | ---D | C] -- C:\Program Files\Panda USB Vaccine
[2011/09/10 10:32:00 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2011/09/10 10:26:21 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
[2011/09/09 23:06:57 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/09/09 23:06:56 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/09/09 23:06:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\temp
[2011/09/09 22:59:15 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/09/09 21:42:32 | 004,201,039 | R--- | C] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
[2011/09/09 21:35:52 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
[2011/09/09 21:35:28 | 001,402,672 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
[2011/09/09 09:19:20 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/09/08 18:43:52 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Avira
[2011/09/08 18:40:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011/09/08 18:40:44 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/09/08 18:40:44 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011/09/08 18:40:44 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011/09/08 18:40:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011/09/08 18:38:58 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011/09/08 18:36:13 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Redirect POS
[2011/09/08 18:27:28 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/09/06 22:23:40 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Foxit Software
[2011/09/06 22:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
[2011/09/06 22:22:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Phantom
[2011/09/06 22:21:24 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\COMODO
[2011/09/06 20:04:16 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
[2011/09/06 19:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2011/09/06 19:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011/09/06 18:44:34 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Mozilla
[2011/09/06 18:44:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011/09/06 18:23:05 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
[2011/09/06 10:44:55 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/09/06 10:08:43 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/09/06 10:08:43 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/09/06 10:08:43 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/09/06 10:08:39 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/09/06 10:05:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011/09/06 10:00:09 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011/09/05 20:04:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2011/09/05 20:03:56 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2011/09/04 23:42:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\riotsGamesLogs
[2011/09/01 20:52:14 | 000,000,000 | ---D | C] -- C:\Windows\System32\CSP
[2011/09/01 20:22:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\fontconfig
[2011/09/01 20:17:01 | 000,000,000 | ---D | C] -- C:\Users\Victor\.smplayer
[2011/09/01 19:13:37 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Music
[2011/09/01 15:22:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2011/09/01 15:21:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2011/09/01 15:20:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\L&H
[2011/09/01 15:19:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2011/09/01 12:59:39 | 000,000,000 | ---D | C] -- C:\Users\Victor\Cisco Packet Tracer 5.3.2
[2011/09/01 12:00:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Packet Tracer
[2011/09/01 11:59:08 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco Packet Tracer 5.3.2
[2011/08/31 22:19:53 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Microsoft Help
[2011/08/31 14:40:19 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\WinRAR
[2011/08/31 14:40:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/08/31 14:40:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/08/31 14:40:00 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2011/08/27 12:50:47 | 000,000,000 | ---D | C] -- C:\Dls
[2011/08/27 12:47:58 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Conduit
[2011/08/27 12:47:50 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2011/08/27 12:47:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\uTorrent
[2011/08/27 12:47:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\uTorrent
[2011/08/27 07:58:37 | 000,000,000 | ---D | C] -- C:\Program Files\RegClean 5.9 English
[2011/08/27 07:50:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/08/27 07:50:37 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/08/27 00:21:36 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\SUPERAntiSpyware.com
[2011/08/27 00:01:56 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011/08/26 23:46:35 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Security
[2011/08/26 23:33:11 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Malwarebytes
[2011/08/26 23:32:59 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/08/26 23:32:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/26 23:32:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/08/26 23:32:53 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/08/26 23:32:52 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/26 19:23:18 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\dvdcss
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/09/10 10:48:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/10 10:47:05 | 000,595,684 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/09/10 10:47:05 | 000,101,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/09/10 10:41:49 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/10 10:41:44 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 10:41:44 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 10:41:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/09/10 10:41:21 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
[2011/09/09 23:22:40 | 000,036,650 | ---- | M] () -- C:\Users\Victor\Desktop\aesetup2.2.exe.htm
[2011/09/09 23:05:04 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/09/09 21:42:40 | 004,201,039 | R--- | M] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
[2011/09/09 21:36:00 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
[2011/09/09 21:35:41 | 001,402,672 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
[2011/09/09 18:26:40 | 000,000,178 | ---- | M] () -- C:\Users\Victor\.packettracer
[2011/09/09 17:15:46 | 000,000,392 | ---- | M] () -- C:\Windows\tasks\1-Click Maintenance.job
[2011/09/08 19:30:44 | 000,305,888 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/09/08 18:40:48 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011/09/08 18:28:11 | 000,001,324 | ---- | M] () -- C:\Windows\System32\.ini
[2011/09/07 13:32:00 | 000,002,337 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/09/07 12:22:37 | 000,002,361 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
[2011/09/07 09:58:33 | 000,467,168 | ---- | M] () -- C:\Windows\System32\drivers\sfi.dat
[2011/09/06 22:25:13 | 000,002,029 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/09/06 22:22:28 | 000,001,926 | ---- | M] () -- C:\Users\Public\Desktop\Foxit Phantom.lnk
[2011/09/06 18:44:31 | 000,000,870 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 18:00:52 | 000,000,979 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer (No Add-ons).lnk
[2011/09/06 14:29:48 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110907-141548.backup
[2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/09/06 12:26:04 | 000,002,579 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2011/09/06 10:17:08 | 000,000,121 | ---- | M] () -- C:\Windows\wininit.ini
[2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
[2011/09/05 23:10:36 | 000,179,273 | ---- | M] () -- C:\Users\Victor\Desktop\Amazon.jpg
[2011/09/04 13:00:48 | 000,000,435 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\System - Shortcut.lnk
[2011/09/02 20:10:12 | 000,003,584 | ---- | M] () -- C:\Users\Victor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/01 20:45:04 | 000,000,075 | ---- | M] () -- C:\ProgramData\nvUnsupRes.dat
[2011/09/01 15:24:54 | 000,000,376 | ---- | M] () -- C:\Windows\ODBC.INI
[2011/09/01 12:00:34 | 000,001,036 | ---- | M] () -- C:\Users\Victor\Desktop\Cisco Packet Tracer.lnk
[2011/08/31 23:10:25 | 000,000,974 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Power2Go.lnk
[2011/08/31 08:51:00 | 000,000,762 | ---- | M] () -- C:\Windows\System32\ealregsnapshot1.reg
[2011/08/30 22:23:54 | 000,000,104 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Computer - Shortcut.lnk
[2011/08/27 12:48:00 | 000,000,816 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/08/27 07:57:16 | 000,214,054 | ---- | M] () -- C:\Users\Victor\Documents\cc_20110827_075650.reg
[2011/08/26 23:14:09 | 000,008,268 | ---- | M] () -- C:\Users\Victor\AppData\Local\d3d9caps.dat
[2011/08/26 18:53:16 | 000,000,872 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\lol.launcher.exe - Shortcut.lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/09/09 23:22:39 | 000,036,650 | ---- | C] () -- C:\Users\Victor\Desktop\aesetup2.2.exe.htm
[2011/09/08 18:40:48 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011/09/08 18:28:11 | 000,001,324 | ---- | C] () -- C:\Windows\System32\.ini
[2011/09/07 12:22:35 | 000,002,337 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/09/06 22:25:13 | 000,002,029 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/09/06 22:22:28 | 000,001,926 | ---- | C] () -- C:\Users\Public\Desktop\Foxit Phantom.lnk
[2011/09/06 20:03:34 | 000,467,168 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
[2011/09/06 18:44:31 | 000,000,870 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 18:44:31 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/09/06 18:00:52 | 000,000,979 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer (No Add-ons).lnk
[2011/09/06 13:15:58 | 3219,578,880 | -HS- | C] () -- C:\hiberfil.sys
[2011/09/06 10:17:08 | 000,000,121 | ---- | C] () -- C:\Windows\wininit.ini
[2011/09/06 10:08:43 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/09/06 10:08:43 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/09/06 10:08:43 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/09/06 10:08:43 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/09/06 10:08:43 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/09/06 04:54:43 | 000,001,244 | -HS- | C] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
[2011/09/05 22:26:56 | 000,179,273 | ---- | C] () -- C:\Users\Victor\Desktop\Amazon.jpg
[2011/09/04 13:00:48 | 000,000,435 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\System - Shortcut.lnk
[2011/09/02 20:10:12 | 000,003,584 | ---- | C] () -- C:\Users\Victor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/01 20:45:04 | 000,000,075 | ---- | C] () -- C:\ProgramData\nvUnsupRes.dat
[2011/09/01 15:22:05 | 000,002,579 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2011/09/01 15:22:04 | 000,002,046 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Outlook.lnk
[2011/09/01 15:22:04 | 000,002,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint.lnk
[2011/09/01 15:22:03 | 000,002,030 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
[2011/09/01 15:22:03 | 000,001,998 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft FrontPage.lnk
[2011/09/01 15:22:03 | 000,001,990 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Access.lnk
[2011/09/01 12:59:39 | 000,000,178 | ---- | C] () -- C:\Users\Victor\.packettracer
[2011/09/01 12:00:34 | 000,001,036 | ---- | C] () -- C:\Users\Victor\Desktop\Cisco Packet Tracer.lnk
[2011/08/31 23:10:25 | 000,000,974 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Power2Go.lnk
[2011/08/31 08:51:00 | 000,000,762 | ---- | C] () -- C:\Windows\System32\ealregsnapshot1.reg
[2011/08/27 12:48:00 | 000,000,816 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/08/27 07:56:58 | 000,214,054 | ---- | C] () -- C:\Users\Victor\Documents\cc_20110827_075650.reg
[2011/08/26 18:53:16 | 000,000,872 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\lol.launcher.exe - Shortcut.lnk
[2010/12/27 01:37:55 | 000,000,000 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\wklnhst.dat
[2010/12/24 03:25:43 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010/07/20 04:21:28 | 000,595,353 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/07/20 04:21:15 | 000,595,353 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/11/23 02:22:45 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009/09/30 00:25:00 | 000,008,268 | ---- | C] () -- C:\Users\Victor\AppData\Local\d3d9caps.dat
[2009/02/10 19:46:45 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009/02/07 21:59:00 | 000,000,024 | ---- | C] () -- C:\Windows\winamp.ini
[2008/07/26 17:34:28 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/07/24 23:21:37 | 000,269,014 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\nvModes.001
[2008/07/24 23:21:35 | 000,269,014 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\nvModes.dat
[2008/07/24 22:18:33 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008/07/24 22:18:33 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/07/02 03:59:07 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat
[2008/07/02 03:59:07 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat
[2008/07/02 03:58:37 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2008/07/01 09:33:22 | 000,101,605 | ---- | C] () -- C:\Windows\hpqins13.dat
[2007/04/03 19:18:26 | 000,197,672 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,305,888 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,595,684 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,101,350 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/03/09 05:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
========== LOP Check ==========
[2011/08/31 14:44:23 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Autodesk
[2008/07/24 10:07:27 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\DigitalPersona
[2011/09/06 22:23:40 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Foxit Software
[2010/07/20 02:59:52 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\LolClient
[2010/12/27 01:38:01 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Template
[2010/03/02 22:24:47 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\TuneUp Software
[2011/09/09 21:47:05 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\uTorrent
[2008/11/21 20:21:52 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\WarZone
[2011/09/09 17:15:46 | 000,000,392 | ---- | M] () -- C:\Windows\Tasks\1-Click Maintenance.job
[2011/09/10 10:40:36 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< >
< %SYSTEMDRIVE%\*.* >
[2008/07/01 09:18:01 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
[2008/01/20 22:24:42 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2011/09/09 23:06:54 | 000,011,038 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2011/09/10 10:41:21 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys
[2008/07/26 21:06:03 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/07/26 21:06:03 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/09/10 10:41:19 | 3533,369,344 | -HS- | M] () -- C:\pagefile.sys
[2011/09/09 23:07:56 | 000,063,904 | ---- | M] () -- C:\TDSSKiller.2.5.20.0_09.09.2011_23.07.23_log.txt
[2011/09/09 23:10:23 | 000,063,904 | ---- | M] () -- C:\TDSSKiller.2.5.20.0_09.09.2011_23.07.59_log.txt
< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 08:37:12 | 000,030,808 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | -H-- | M] () -- C:\Windows\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/20 22:23:14 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 08:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 22:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2008/01/20 22:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2008/01/20 23:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 23:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 23:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/09/08 14:34:57 | 000,000,359 | -HS- | M] () -- C:\Users\Victor\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
[2011/09/09 21:36:00 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
[2011/09/09 21:42:40 | 004,201,039 | R--- | M] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
[2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
[2011/09/09 21:35:41 | 001,402,672 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
< %USERPROFILE%\*.exe >
< %systemroot%\ADDINS\*.* >
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
[2008/07/24 10:07:20 | 000,000,402 | -HS- | M] () -- C:\Users\Victor\Favorites\desktop.ini
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
[2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
[2008/07/01 09:34:28 | 000,000,371 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.001
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
< dir /b "%systemroot%\*.exe" | find /i " " /c >
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.* >
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Victor\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 69.29% Memory free
6.19 Gb Paging File | 5.36 Gb Available in Paging File | 86.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99.72 Gb Total Space | 10.98 Gb Free Space | 11.01% Space Free | Partition Type: NTFS
Drive D: | 12.07 Gb Total Space | 1.99 Gb Free Space | 16.53% Space Free | Partition Type: NTFS
Drive F: | 465.11 Gb Total Space | 53.70 Gb Free Space | 11.54% Space Free | Partition Type: NTFS
Computer Name: VICTOR-LAPPY | User Name: Victor | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
PRC - [2011/09/03 02:01:45 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/07/21 12:12:18 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/04/21 07:54:06 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/04/21 07:53:50 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/21 07:53:34 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/04/15 20:54:40 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2008/01/20 22:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
========== Modules (No Company Name) ==========
MOD - [2011/09/03 02:01:45 | 001,846,232 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2008/09/16 20:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- -- (MDM)
SRV - [2011/07/21 12:12:18 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/04/21 07:53:50 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/07/09 19:20:06 | 001,469,544 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Windows\System32\nvsvc.dll -- (nvsvc)
SRV - [2009/01/26 19:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Disabled | Stopped] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/04/15 20:54:42 | 000,354,840 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007/09/20 14:02:58 | 000,299,008 | ---- | M] (DigitalPersona, Inc.) [Disabled | Stopped] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2007/05/16 13:41:18 | 000,029,704 | ---- | M] (TuneUp Software GmbH) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2007/04/03 19:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Disabled | Stopped] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2007/03/05 13:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Disabled | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)
========== Driver Services (SafeList) ==========
DRV - [2011/07/21 12:15:22 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/21 12:15:20 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/07/09 18:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/06/17 15:27:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/27 05:16:28 | 000,012,672 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz132_x32.sys -- (cpuz132)
DRV - [2008/05/09 21:33:10 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) RMCAST (Pgm)
DRV - [2008/01/20 22:23:27 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV - [2008/01/20 22:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2007/09/26 16:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007/09/17 19:17:36 | 000,098,816 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007/08/28 18:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
DRV - [2007/07/11 13:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid)
DRV - [2007/06/18 20:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007/04/03 19:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007/01/31 16:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2007/01/18 17:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2007/01/17 09:38:52 | 000,983,936 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006/11/16 12:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/16 07:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/16 05:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/02 03:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 0F CF C7 01 08 DC 58 44 B8 C6 82 BF D7 31 9B 5A [binary data]
IE - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/06 18:44:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/06 22:22:36 | 000,000,000 | ---D | M]
[2009/11/23 02:22:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Victor\AppData\Roaming\Mozilla\Extensions
[2011/09/09 22:56:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions
[2011/09/07 11:02:39 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{aa7b9bfa-4feb-4f84-bfb3-6cdcfc6e4a2c}
[2011/09/06 19:05:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/09/06 19:05:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/06 19:01:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011/09/03 02:01:45 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/12/23 12:06:38 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2011/09/02 19:25:59 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
O1 HOSTS File: ([2011/09/09 23:05:04 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 4
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08070827-0396-4E03-9174-485A8D027C3A}: NameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\HPTimewarp.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\HPTimewarp.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/07/01 09:18:01 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011/09/10 10:32:00 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O32 - AutoRun File - [2011/09/10 10:32:01 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/03/21 14:51:12 | 000,000,000 | ---D | M] - F:\AUTORUN_.INF -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSACM.MSNAUDIO - C:\Windows\System32\msnaudio.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\Windows\System32\SL_ANET.ACM (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011/09/10 10:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2011/09/10 10:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
[2011/09/10 10:37:04 | 000,000,000 | ---D | C] -- C:\Program Files\Panda USB Vaccine
[2011/09/10 10:32:00 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2011/09/10 10:26:21 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
[2011/09/09 23:06:57 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/09/09 23:06:56 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/09/09 23:06:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\temp
[2011/09/09 22:59:15 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/09/09 21:42:32 | 004,201,039 | R--- | C] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
[2011/09/09 21:35:52 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
[2011/09/09 21:35:28 | 001,402,672 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
[2011/09/09 09:19:20 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/09/08 18:43:52 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Avira
[2011/09/08 18:40:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011/09/08 18:40:44 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/09/08 18:40:44 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011/09/08 18:40:44 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011/09/08 18:40:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011/09/08 18:38:58 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011/09/08 18:36:13 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Redirect POS
[2011/09/08 18:27:28 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/09/06 22:23:40 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Foxit Software
[2011/09/06 22:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
[2011/09/06 22:22:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Phantom
[2011/09/06 22:21:24 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\COMODO
[2011/09/06 20:04:16 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
[2011/09/06 19:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2011/09/06 19:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011/09/06 18:44:34 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Mozilla
[2011/09/06 18:44:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011/09/06 18:23:05 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
[2011/09/06 10:44:55 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/09/06 10:08:43 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/09/06 10:08:43 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/09/06 10:08:43 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/09/06 10:08:39 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/09/06 10:05:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011/09/06 10:00:09 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011/09/05 20:04:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2011/09/05 20:03:56 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2011/09/04 23:42:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\riotsGamesLogs
[2011/09/01 20:52:14 | 000,000,000 | ---D | C] -- C:\Windows\System32\CSP
[2011/09/01 20:22:56 | 000,000,000 | ---D | C] -- C:\Users\Victor\fontconfig
[2011/09/01 20:17:01 | 000,000,000 | ---D | C] -- C:\Users\Victor\.smplayer
[2011/09/01 19:13:37 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Music
[2011/09/01 15:22:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ActiveSync
[2011/09/01 15:21:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2011/09/01 15:20:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\L&H
[2011/09/01 15:19:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2011/09/01 12:59:39 | 000,000,000 | ---D | C] -- C:\Users\Victor\Cisco Packet Tracer 5.3.2
[2011/09/01 12:00:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Packet Tracer
[2011/09/01 11:59:08 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco Packet Tracer 5.3.2
[2011/08/31 22:19:53 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Microsoft Help
[2011/08/31 14:40:19 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\WinRAR
[2011/08/31 14:40:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/08/31 14:40:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/08/31 14:40:00 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2011/08/27 12:50:47 | 000,000,000 | ---D | C] -- C:\Dls
[2011/08/27 12:47:58 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\Conduit
[2011/08/27 12:47:50 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2011/08/27 12:47:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\uTorrent
[2011/08/27 12:47:15 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Local\uTorrent
[2011/08/27 07:58:37 | 000,000,000 | ---D | C] -- C:\Program Files\RegClean 5.9 English
[2011/08/27 07:50:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/08/27 07:50:37 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/08/27 00:21:36 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\SUPERAntiSpyware.com
[2011/08/27 00:01:56 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011/08/26 23:46:35 | 000,000,000 | ---D | C] -- C:\Users\Victor\Desktop\Security
[2011/08/26 23:33:11 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\Malwarebytes
[2011/08/26 23:32:59 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/08/26 23:32:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/26 23:32:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/08/26 23:32:53 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/08/26 23:32:52 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/26 19:23:18 | 000,000,000 | ---D | C] -- C:\Users\Victor\AppData\Roaming\dvdcss
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/09/10 10:48:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/09/10 10:47:05 | 000,595,684 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/09/10 10:47:05 | 000,101,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/09/10 10:41:49 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/09/10 10:41:44 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 10:41:44 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/10 10:41:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/09/10 10:41:21 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
[2011/09/09 23:22:40 | 000,036,650 | ---- | M] () -- C:\Users\Victor\Desktop\aesetup2.2.exe.htm
[2011/09/09 23:05:04 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/09/09 21:42:40 | 004,201,039 | R--- | M] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
[2011/09/09 21:36:00 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
[2011/09/09 21:35:41 | 001,402,672 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
[2011/09/09 18:26:40 | 000,000,178 | ---- | M] () -- C:\Users\Victor\.packettracer
[2011/09/09 17:15:46 | 000,000,392 | ---- | M] () -- C:\Windows\tasks\1-Click Maintenance.job
[2011/09/08 19:30:44 | 000,305,888 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/09/08 18:40:48 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011/09/08 18:28:11 | 000,001,324 | ---- | M] () -- C:\Windows\System32\.ini
[2011/09/07 13:32:00 | 000,002,337 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/09/07 12:22:37 | 000,002,361 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
[2011/09/07 09:58:33 | 000,467,168 | ---- | M] () -- C:\Windows\System32\drivers\sfi.dat
[2011/09/06 22:25:13 | 000,002,029 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/09/06 22:22:28 | 000,001,926 | ---- | M] () -- C:\Users\Public\Desktop\Foxit Phantom.lnk
[2011/09/06 18:44:31 | 000,000,870 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 18:00:52 | 000,000,979 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer (No Add-ons).lnk
[2011/09/06 14:29:48 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110907-141548.backup
[2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/09/06 12:26:04 | 000,002,579 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2011/09/06 10:17:08 | 000,000,121 | ---- | M] () -- C:\Windows\wininit.ini
[2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
[2011/09/05 23:10:36 | 000,179,273 | ---- | M] () -- C:\Users\Victor\Desktop\Amazon.jpg
[2011/09/04 13:00:48 | 000,000,435 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\System - Shortcut.lnk
[2011/09/02 20:10:12 | 000,003,584 | ---- | M] () -- C:\Users\Victor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/01 20:45:04 | 000,000,075 | ---- | M] () -- C:\ProgramData\nvUnsupRes.dat
[2011/09/01 15:24:54 | 000,000,376 | ---- | M] () -- C:\Windows\ODBC.INI
[2011/09/01 12:00:34 | 000,001,036 | ---- | M] () -- C:\Users\Victor\Desktop\Cisco Packet Tracer.lnk
[2011/08/31 23:10:25 | 000,000,974 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Power2Go.lnk
[2011/08/31 08:51:00 | 000,000,762 | ---- | M] () -- C:\Windows\System32\ealregsnapshot1.reg
[2011/08/30 22:23:54 | 000,000,104 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Computer - Shortcut.lnk
[2011/08/27 12:48:00 | 000,000,816 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/08/27 07:57:16 | 000,214,054 | ---- | M] () -- C:\Users\Victor\Documents\cc_20110827_075650.reg
[2011/08/26 23:14:09 | 000,008,268 | ---- | M] () -- C:\Users\Victor\AppData\Local\d3d9caps.dat
[2011/08/26 18:53:16 | 000,000,872 | ---- | M] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\lol.launcher.exe - Shortcut.lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/09/09 23:22:39 | 000,036,650 | ---- | C] () -- C:\Users\Victor\Desktop\aesetup2.2.exe.htm
[2011/09/08 18:40:48 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011/09/08 18:28:11 | 000,001,324 | ---- | C] () -- C:\Windows\System32\.ini
[2011/09/07 12:22:35 | 000,002,337 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/09/06 22:25:13 | 000,002,029 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/09/06 22:22:28 | 000,001,926 | ---- | C] () -- C:\Users\Public\Desktop\Foxit Phantom.lnk
[2011/09/06 20:03:34 | 000,467,168 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
[2011/09/06 18:44:31 | 000,000,870 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/09/06 18:44:31 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/09/06 18:00:52 | 000,000,979 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer (No Add-ons).lnk
[2011/09/06 13:15:58 | 3219,578,880 | -HS- | C] () -- C:\hiberfil.sys
[2011/09/06 10:17:08 | 000,000,121 | ---- | C] () -- C:\Windows\wininit.ini
[2011/09/06 10:08:43 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/09/06 10:08:43 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/09/06 10:08:43 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/09/06 10:08:43 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/09/06 10:08:43 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/09/06 04:54:43 | 000,001,244 | -HS- | C] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
[2011/09/05 22:26:56 | 000,179,273 | ---- | C] () -- C:\Users\Victor\Desktop\Amazon.jpg
[2011/09/04 13:00:48 | 000,000,435 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\System - Shortcut.lnk
[2011/09/02 20:10:12 | 000,003,584 | ---- | C] () -- C:\Users\Victor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/01 20:45:04 | 000,000,075 | ---- | C] () -- C:\ProgramData\nvUnsupRes.dat
[2011/09/01 15:22:05 | 000,002,579 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2011/09/01 15:22:04 | 000,002,046 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Outlook.lnk
[2011/09/01 15:22:04 | 000,002,002 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint.lnk
[2011/09/01 15:22:03 | 000,002,030 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
[2011/09/01 15:22:03 | 000,001,998 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft FrontPage.lnk
[2011/09/01 15:22:03 | 000,001,990 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Access.lnk
[2011/09/01 12:59:39 | 000,000,178 | ---- | C] () -- C:\Users\Victor\.packettracer
[2011/09/01 12:00:34 | 000,001,036 | ---- | C] () -- C:\Users\Victor\Desktop\Cisco Packet Tracer.lnk
[2011/08/31 23:10:25 | 000,000,974 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\Power2Go.lnk
[2011/08/31 08:51:00 | 000,000,762 | ---- | C] () -- C:\Windows\System32\ealregsnapshot1.reg
[2011/08/27 12:48:00 | 000,000,816 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/08/27 07:56:58 | 000,214,054 | ---- | C] () -- C:\Users\Victor\Documents\cc_20110827_075650.reg
[2011/08/26 18:53:16 | 000,000,872 | ---- | C] () -- C:\Users\Victor\Application Data\Microsoft\Internet Explorer\Quick Launch\lol.launcher.exe - Shortcut.lnk
[2010/12/27 01:37:55 | 000,000,000 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\wklnhst.dat
[2010/12/24 03:25:43 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010/07/20 04:21:28 | 000,595,353 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/07/20 04:21:15 | 000,595,353 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/11/23 02:22:45 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009/09/30 00:25:00 | 000,008,268 | ---- | C] () -- C:\Users\Victor\AppData\Local\d3d9caps.dat
[2009/02/10 19:46:45 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009/02/07 21:59:00 | 000,000,024 | ---- | C] () -- C:\Windows\winamp.ini
[2008/07/26 17:34:28 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/07/24 23:21:37 | 000,269,014 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\nvModes.001
[2008/07/24 23:21:35 | 000,269,014 | ---- | C] () -- C:\Users\Victor\AppData\Roaming\nvModes.dat
[2008/07/24 22:18:33 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008/07/24 22:18:33 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/07/02 03:59:07 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat
[2008/07/02 03:59:07 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat
[2008/07/02 03:58:37 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2008/07/01 09:33:22 | 000,101,605 | ---- | C] () -- C:\Windows\hpqins13.dat
[2007/04/03 19:18:26 | 000,197,672 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,305,888 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,595,684 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,101,350 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/03/09 05:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
========== LOP Check ==========
[2011/08/31 14:44:23 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Autodesk
[2008/07/24 10:07:27 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\DigitalPersona
[2011/09/06 22:23:40 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Foxit Software
[2010/07/20 02:59:52 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\LolClient
[2010/12/27 01:38:01 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\Template
[2010/03/02 22:24:47 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\TuneUp Software
[2011/09/09 21:47:05 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\uTorrent
[2008/11/21 20:21:52 | 000,000,000 | ---D | M] -- C:\Users\Victor\AppData\Roaming\WarZone
[2011/09/09 17:15:46 | 000,000,392 | ---- | M] () -- C:\Windows\Tasks\1-Click Maintenance.job
[2011/09/10 10:40:36 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< >
< %SYSTEMDRIVE%\*.* >
[2008/07/01 09:18:01 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
[2008/01/20 22:24:42 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2011/09/09 23:06:54 | 000,011,038 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2011/09/10 10:41:21 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys
[2008/07/26 21:06:03 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/07/26 21:06:03 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/09/10 10:41:19 | 3533,369,344 | -HS- | M] () -- C:\pagefile.sys
[2011/09/09 23:07:56 | 000,063,904 | ---- | M] () -- C:\TDSSKiller.2.5.20.0_09.09.2011_23.07.23_log.txt
[2011/09/09 23:10:23 | 000,063,904 | ---- | M] () -- C:\TDSSKiller.2.5.20.0_09.09.2011_23.07.59_log.txt
< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 08:37:12 | 000,030,808 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | -H-- | M] () -- C:\Windows\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/20 22:23:14 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 08:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 22:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2008/01/20 22:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
[2008/01/20 23:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 23:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 23:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/09/08 14:34:57 | 000,000,359 | -HS- | M] () -- C:\Users\Victor\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
[2011/09/09 21:36:00 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Victor\Desktop\aswMBR.exe
[2011/09/09 21:42:40 | 004,201,039 | R--- | M] (Swearware) -- C:\Users\Victor\Desktop\ComboFix.exe
[2011/09/10 10:26:21 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Victor\Desktop\OTL.exe
[2011/09/09 21:35:41 | 001,402,672 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Victor\Desktop\tdsskiller.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
< %USERPROFILE%\*.exe >
< %systemroot%\ADDINS\*.* >
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
[2008/07/24 10:07:20 | 000,000,402 | -HS- | M] () -- C:\Users\Victor\Favorites\desktop.ini
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
[2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33
[2008/07/01 09:34:28 | 000,000,371 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2011/09/06 12:54:54 | 000,595,353 | ---- | M] () -- C:\ProgramData\nvModes.001
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
< dir /b "%systemroot%\*.exe" | find /i " " /c >
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.* >
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >
OTL Extras logfile created on: 9/10/2011 10:48:22 AM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Victor\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 69.29% Memory free
6.19 Gb Paging File | 5.36 Gb Available in Paging File | 86.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99.72 Gb Total Space | 10.98 Gb Free Space | 11.01% Space Free | Partition Type: NTFS
Drive D: | 12.07 Gb Total Space | 1.99 Gb Free Space | 16.53% Space Free | Partition Type: NTFS
Drive F: | 465.11 Gb Total Space | 53.70 Gb Free Space | 11.54% Space Free | Partition Type: NTFS
Computer Name: VICTOR-LAPPY | User Name: Victor | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_USERS\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 3
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A521A31-0CEC-4C34-A529-86B71AA744AB}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |
"{0C567C69-62A2-4569-BDD7-A09BFF189925}" = lport=6939 | protocol=17 | dir=in | name=league of legends launcher |
"{0C70251B-B1B0-491F-96F2-726B23ABFE3C}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher |
"{0DC6D33F-13B8-431D-8707-6C68115D3B41}" = lport=6915 | protocol=17 | dir=in | name=league of legends launcher |
"{10EBA7D3-7B94-4A03-A95E-1C8D32698D27}" = lport=8382 | protocol=6 | dir=in | name=league of legends launcher |
"{1E00D2AA-67C1-417E-BB50-B66BFC625674}" = lport=6985 | protocol=6 | dir=in | name=league of legends launcher |
"{1F06BE27-982D-4976-B258-7A945253991F}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher |
"{2129E83F-F5E1-4D0E-9993-720A729675EC}" = lport=6887 | protocol=17 | dir=in | name=league of legends launcher |
"{2493F93E-ABA5-4E36-B390-9156AC1E7E84}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby |
"{2C5FC9BF-787D-4334-A7D3-F02070EBE9EE}" = lport=139 | protocol=6 | dir=in | app=system |
"{2F65D0D3-87EF-4EBA-B116-C87DE5384E08}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher |
"{30EEF6C2-34EA-4132-8469-10A0EC73663F}" = lport=8383 | protocol=17 | dir=in | name=league of legends launcher |
"{3664EF17-CD01-41C9-8901-01620419AA39}" = lport=6945 | protocol=6 | dir=in | name=league of legends launcher |
"{41F37E40-7B3D-4C00-B7C8-A5DA5660F6E6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{480D5559-AAEC-4A0A-B867-3D54DD1C7276}" = lport=6973 | protocol=6 | dir=in | name=league of legends launcher |
"{4FE81F4B-3E2B-4B67-B78F-99FE65D76842}" = lport=6939 | protocol=6 | dir=in | name=league of legends launcher |
"{6140199A-0B06-4BE7-96C9-1763A19F3EAF}" = rport=139 | protocol=6 | dir=out | app=system |
"{62815315-237E-4199-BA39-6071669D4ACC}" = lport=6887 | protocol=6 | dir=in | name=league of legends launcher |
"{6AFF6A58-3A69-4878-8AD2-BA627E6B4F26}" = lport=138 | protocol=17 | dir=in | app=system |
"{720345A5-6CB7-4CB9-8C95-F5064BBE0531}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |
"{79C17C62-3B8E-4E04-91A0-BA69086E3D7D}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |
"{80999A0B-E893-46AB-8557-D8DC8F5861E5}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client |
"{90131E6F-46A6-4A7D-8528-2983BD886CCD}" = lport=6969 | protocol=6 | dir=in | name=league of legends launcher |
"{95408A78-53DD-453A-9F32-1A122F6A1E0F}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
"{97CF301E-C371-4490-B075-B93162D0F58F}" = lport=6958 | protocol=17 | dir=in | name=league of legends launcher |
"{A71F4CF6-7AED-4095-814F-300BE1EEF980}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
"{A989FD17-538D-4533-A830-8423CE1F6B95}" = rport=137 | protocol=17 | dir=out | app=system |
"{AD2CB4E3-6A5A-48CA-A1C0-B71B8E395DCD}" = rport=445 | protocol=6 | dir=out | app=system |
"{ADBFB0B7-78B0-4163-94A0-21E7C7207919}" = lport=6975 | protocol=6 | dir=in | name=league of legends launcher |
"{BD726FEA-480E-4EE6-A8CD-9462F88941AA}" = lport=6969 | protocol=17 | dir=in | name=league of legends launcher |
"{BDE4BA31-E55C-4B6F-8CDA-C6336A6672F0}" = lport=6945 | protocol=17 | dir=in | name=league of legends launcher |
"{BE1FE395-76DB-46A2-A05B-37718A29C5D4}" = lport=8383 | protocol=6 | dir=in | name=league of legends launcher |
"{CB65A7B6-CC6D-4277-9B38-B8505D62B803}" = lport=445 | protocol=6 | dir=in | app=system |
"{CB9A2141-084E-45B5-99B7-C55E7924983A}" = lport=8378 | protocol=6 | dir=in | name=league of legends launcher |
"{CDA8DA27-FE48-489E-8740-A8D8CC70CE65}" = lport=6985 | protocol=17 | dir=in | name=league of legends launcher |
"{D098CDD7-21CE-43A1-B285-8A10FB83310C}" = lport=6915 | protocol=6 | dir=in | name=league of legends launcher |
"{D67FE716-EDF2-4E77-B44F-908FA89E60B4}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client |
"{D8A37A6F-F504-44A8-A419-53E4870093DB}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby |
"{DA5A9F53-0ED4-4CAE-AFFA-43BD56FABD98}" = lport=6973 | protocol=17 | dir=in | name=league of legends launcher |
"{DD93CF6E-FDDA-48FB-915F-0732B4545059}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher |
"{DDB6C156-AA81-4F46-844B-BC2BF7FDF4B5}" = rport=138 | protocol=17 | dir=out | app=system |
"{E0EC921C-FD69-4C25-9683-001202F0A876}" = lport=8378 | protocol=17 | dir=in | name=league of legends launcher |
"{E9A4A6F6-2740-4753-9AA9-D4CC323E3135}" = lport=6975 | protocol=17 | dir=in | name=league of legends launcher |
"{EB742E87-D7AA-4E08-BADC-C9940CBF3008}" = lport=6958 | protocol=6 | dir=in | name=league of legends launcher |
"{ED4DC38D-8814-4ED1-806B-00BEF6A81DA2}" = lport=8382 | protocol=17 | dir=in | name=league of legends launcher |
"{F986F0C9-532B-4C95-AD74-6C3A5DF962DC}" = lport=137 | protocol=17 | dir=in | app=system |
"{FA5119D1-29F7-4DF0-8543-A2B4F38737C0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FEC24560-75B6-4EEB-A398-52EC66ECFD8A}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03AB5076-B967-4346-A3DA-707B4CEA0614}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{0ABA2273-5D10-4F0B-9DAF-3F94E5EDFE38}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{2F8E9585-51DC-4AEE-89A1-C01A2DA9B7D7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{35519B5D-59B3-4E70-964B-541EBAF6DAFC}" = protocol=6 | dir=in | app=c:\program files\league\lol.launcher.exe |
"{5D0506C7-BEC9-4CEB-9483-E92BC89348AF}" = protocol=17 | dir=in | app=c:\program files\league\lol.launcher.exe |
"{D5168629-58AB-458A-A2A5-85858A480B4D}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{D73318BE-A9CE-45A2-8EF8-048ABDC2203F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E3D16098-FFE7-403E-AF72-62F79B69D238}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{E6350F94-0E85-425B-8317-2CC21404F6F1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{FEC19BE9-4A1E-4682-BD68-A8DDC8EC02EE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83216026F0}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{31753CDD-A7DA-4667-BEFC-B3EA3BDF366E}" = Foxit Phantom
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E1
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.16
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7DC4A410-9986-4329-9E5D-687B2C42CA39}" = HP QuickTouch 1.00 C4
"{7F362F06-A9A3-440F-8B19-6A01A72723C4}" = AuthenTec Fingerprint Sensor Minimum Install
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{b02df929-29a7-4fd2-9a70-81a644b635f7}" = HP Total Care Advisor
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B9CA59A0-3B70-48F8-9054-67595DE6E72B}" = League of Legends
"{C7AF7F33-9092-997E-2D29-DE8095863FE3}" = DigitalPersona Personal 3.0.0
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}" = HP Wireless Assistant
"{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}" = Cisco Systems VPN Client 5.0.00.0340
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"Cisco Packet Tracer 5.3.2_is1" = Cisco Packet Tracer 5.3.2
"CoreAVC Professional Edition" = CoreAVC Professional Edition (remove only)
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.53.1
"EPSON WorkForce 610 Series" = EPSON WorkForce 610 Series Printer Uninstall
"Google Chrome" = Google Chrome
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.5.3 (Standard)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 6.0.2 (x86 en-US)" = Mozilla Firefox 6.0.2 (x86 en-US)
"MSMONEYV60" = Microsoft Money 98
"MV RegClean 5.9 English_is1" = MV RegClean 5.9 English
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Revo Uninstaller" = Revo Uninstaller 1.75
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.0
"WinRAR archiver" = WinRAR archiver
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 9/9/2011 9:09:42 AM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
Description =
Error - 9/9/2011 9:16:52 AM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
Description =
Error - 9/9/2011 9:23:43 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:09 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:09 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:59 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:59 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:25:33 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:25:33 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 12:38:03 PM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
Description =
[ DigitalPersona Pro Events ]
Error - 1/23/2010 5:25:56 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/25/2010 1:07:59 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/26/2010 1:41:06 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/27/2010 1:57:47 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/28/2010 2:20:04 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/29/2010 4:53:43 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 2/10/2010 1:29:23 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 2/12/2010 1:47:35 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 3/2/2010 9:33:51 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 3/2/2010 9:42:59 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
[ Media Center Events ]
Error - 6/17/2009 1:32:10 AM | Computer Name = Victor-Lappy | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.
Error - 9/22/2009 1:25:24 PM | Computer Name = Victor-Lappy | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.
[ System Events ]
Error - 9/9/2011 11:12:06 PM | Computer Name = Victor-Lappy | Source = HTTP | ID = 15016
Description =
Error - 9/9/2011 11:13:10 PM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/9/2011 11:13:13 PM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/9/2011 11:13:29 PM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
Error - 9/9/2011 11:13:29 PM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
Error - 9/10/2011 10:41:42 AM | Computer Name = Victor-Lappy | Source = HTTP | ID = 15016
Description =
Error - 9/10/2011 10:42:45 AM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/10/2011 10:42:49 AM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/10/2011 10:43:06 AM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
Error - 9/10/2011 10:43:06 AM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
< End of report >
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Victor\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 69.29% Memory free
6.19 Gb Paging File | 5.36 Gb Available in Paging File | 86.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99.72 Gb Total Space | 10.98 Gb Free Space | 11.01% Space Free | Partition Type: NTFS
Drive D: | 12.07 Gb Total Space | 1.99 Gb Free Space | 16.53% Space Free | Partition Type: NTFS
Drive F: | 465.11 Gb Total Space | 53.70 Gb Free Space | 11.54% Space Free | Partition Type: NTFS
Computer Name: VICTOR-LAPPY | User Name: Victor | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_USERS\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2811368694-1360954036-796960686-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 3
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A521A31-0CEC-4C34-A529-86B71AA744AB}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |
"{0C567C69-62A2-4569-BDD7-A09BFF189925}" = lport=6939 | protocol=17 | dir=in | name=league of legends launcher |
"{0C70251B-B1B0-491F-96F2-726B23ABFE3C}" = lport=8379 | protocol=6 | dir=in | name=league of legends launcher |
"{0DC6D33F-13B8-431D-8707-6C68115D3B41}" = lport=6915 | protocol=17 | dir=in | name=league of legends launcher |
"{10EBA7D3-7B94-4A03-A95E-1C8D32698D27}" = lport=8382 | protocol=6 | dir=in | name=league of legends launcher |
"{1E00D2AA-67C1-417E-BB50-B66BFC625674}" = lport=6985 | protocol=6 | dir=in | name=league of legends launcher |
"{1F06BE27-982D-4976-B258-7A945253991F}" = lport=8379 | protocol=17 | dir=in | name=league of legends launcher |
"{2129E83F-F5E1-4D0E-9993-720A729675EC}" = lport=6887 | protocol=17 | dir=in | name=league of legends launcher |
"{2493F93E-ABA5-4E36-B390-9156AC1E7E84}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby |
"{2C5FC9BF-787D-4334-A7D3-F02070EBE9EE}" = lport=139 | protocol=6 | dir=in | app=system |
"{2F65D0D3-87EF-4EBA-B116-C87DE5384E08}" = lport=8380 | protocol=17 | dir=in | name=league of legends launcher |
"{30EEF6C2-34EA-4132-8469-10A0EC73663F}" = lport=8383 | protocol=17 | dir=in | name=league of legends launcher |
"{3664EF17-CD01-41C9-8901-01620419AA39}" = lport=6945 | protocol=6 | dir=in | name=league of legends launcher |
"{41F37E40-7B3D-4C00-B7C8-A5DA5660F6E6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{480D5559-AAEC-4A0A-B867-3D54DD1C7276}" = lport=6973 | protocol=6 | dir=in | name=league of legends launcher |
"{4FE81F4B-3E2B-4B67-B78F-99FE65D76842}" = lport=6939 | protocol=6 | dir=in | name=league of legends launcher |
"{6140199A-0B06-4BE7-96C9-1763A19F3EAF}" = rport=139 | protocol=6 | dir=out | app=system |
"{62815315-237E-4199-BA39-6071669D4ACC}" = lport=6887 | protocol=6 | dir=in | name=league of legends launcher |
"{6AFF6A58-3A69-4878-8AD2-BA627E6B4F26}" = lport=138 | protocol=17 | dir=in | app=system |
"{720345A5-6CB7-4CB9-8C95-F5064BBE0531}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |
"{79C17C62-3B8E-4E04-91A0-BA69086E3D7D}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |
"{80999A0B-E893-46AB-8557-D8DC8F5861E5}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client |
"{90131E6F-46A6-4A7D-8528-2983BD886CCD}" = lport=6969 | protocol=6 | dir=in | name=league of legends launcher |
"{95408A78-53DD-453A-9F32-1A122F6A1E0F}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
"{97CF301E-C371-4490-B075-B93162D0F58F}" = lport=6958 | protocol=17 | dir=in | name=league of legends launcher |
"{A71F4CF6-7AED-4095-814F-300BE1EEF980}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
"{A989FD17-538D-4533-A830-8423CE1F6B95}" = rport=137 | protocol=17 | dir=out | app=system |
"{AD2CB4E3-6A5A-48CA-A1C0-B71B8E395DCD}" = rport=445 | protocol=6 | dir=out | app=system |
"{ADBFB0B7-78B0-4163-94A0-21E7C7207919}" = lport=6975 | protocol=6 | dir=in | name=league of legends launcher |
"{BD726FEA-480E-4EE6-A8CD-9462F88941AA}" = lport=6969 | protocol=17 | dir=in | name=league of legends launcher |
"{BDE4BA31-E55C-4B6F-8CDA-C6336A6672F0}" = lport=6945 | protocol=17 | dir=in | name=league of legends launcher |
"{BE1FE395-76DB-46A2-A05B-37718A29C5D4}" = lport=8383 | protocol=6 | dir=in | name=league of legends launcher |
"{CB65A7B6-CC6D-4277-9B38-B8505D62B803}" = lport=445 | protocol=6 | dir=in | app=system |
"{CB9A2141-084E-45B5-99B7-C55E7924983A}" = lport=8378 | protocol=6 | dir=in | name=league of legends launcher |
"{CDA8DA27-FE48-489E-8740-A8D8CC70CE65}" = lport=6985 | protocol=17 | dir=in | name=league of legends launcher |
"{D098CDD7-21CE-43A1-B285-8A10FB83310C}" = lport=6915 | protocol=6 | dir=in | name=league of legends launcher |
"{D67FE716-EDF2-4E77-B44F-908FA89E60B4}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client |
"{D8A37A6F-F504-44A8-A419-53E4870093DB}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby |
"{DA5A9F53-0ED4-4CAE-AFFA-43BD56FABD98}" = lport=6973 | protocol=17 | dir=in | name=league of legends launcher |
"{DD93CF6E-FDDA-48FB-915F-0732B4545059}" = lport=8380 | protocol=6 | dir=in | name=league of legends launcher |
"{DDB6C156-AA81-4F46-844B-BC2BF7FDF4B5}" = rport=138 | protocol=17 | dir=out | app=system |
"{E0EC921C-FD69-4C25-9683-001202F0A876}" = lport=8378 | protocol=17 | dir=in | name=league of legends launcher |
"{E9A4A6F6-2740-4753-9AA9-D4CC323E3135}" = lport=6975 | protocol=17 | dir=in | name=league of legends launcher |
"{EB742E87-D7AA-4E08-BADC-C9940CBF3008}" = lport=6958 | protocol=6 | dir=in | name=league of legends launcher |
"{ED4DC38D-8814-4ED1-806B-00BEF6A81DA2}" = lport=8382 | protocol=17 | dir=in | name=league of legends launcher |
"{F986F0C9-532B-4C95-AD74-6C3A5DF962DC}" = lport=137 | protocol=17 | dir=in | app=system |
"{FA5119D1-29F7-4DF0-8543-A2B4F38737C0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FEC24560-75B6-4EEB-A398-52EC66ECFD8A}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03AB5076-B967-4346-A3DA-707B4CEA0614}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{0ABA2273-5D10-4F0B-9DAF-3F94E5EDFE38}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{2F8E9585-51DC-4AEE-89A1-C01A2DA9B7D7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{35519B5D-59B3-4E70-964B-541EBAF6DAFC}" = protocol=6 | dir=in | app=c:\program files\league\lol.launcher.exe |
"{5D0506C7-BEC9-4CEB-9483-E92BC89348AF}" = protocol=17 | dir=in | app=c:\program files\league\lol.launcher.exe |
"{D5168629-58AB-458A-A2A5-85858A480B4D}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{D73318BE-A9CE-45A2-8EF8-048ABDC2203F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E3D16098-FFE7-403E-AF72-62F79B69D238}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{E6350F94-0E85-425B-8317-2CC21404F6F1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{FEC19BE9-4A1E-4682-BD68-A8DDC8EC02EE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83216026F0}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{31753CDD-A7DA-4667-BEFC-B3EA3BDF366E}" = Foxit Phantom
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E1
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.16
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7DC4A410-9986-4329-9E5D-687B2C42CA39}" = HP QuickTouch 1.00 C4
"{7F362F06-A9A3-440F-8B19-6A01A72723C4}" = AuthenTec Fingerprint Sensor Minimum Install
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{b02df929-29a7-4fd2-9a70-81a644b635f7}" = HP Total Care Advisor
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B9CA59A0-3B70-48F8-9054-67595DE6E72B}" = League of Legends
"{C7AF7F33-9092-997E-2D29-DE8095863FE3}" = DigitalPersona Personal 3.0.0
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}" = HP Wireless Assistant
"{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}" = Cisco Systems VPN Client 5.0.00.0340
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"Cisco Packet Tracer 5.3.2_is1" = Cisco Packet Tracer 5.3.2
"CoreAVC Professional Edition" = CoreAVC Professional Edition (remove only)
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.53.1
"EPSON WorkForce 610 Series" = EPSON WorkForce 610 Series Printer Uninstall
"Google Chrome" = Google Chrome
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.5.3 (Standard)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 6.0.2 (x86 en-US)" = Mozilla Firefox 6.0.2 (x86 en-US)
"MSMONEYV60" = Microsoft Money 98
"MV RegClean 5.9 English_is1" = MV RegClean 5.9 English
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Revo Uninstaller" = Revo Uninstaller 1.75
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.0
"WinRAR archiver" = WinRAR archiver
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 9/9/2011 9:09:42 AM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
Description =
Error - 9/9/2011 9:16:52 AM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
Description =
Error - 9/9/2011 9:23:43 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:09 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:09 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:59 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:24:59 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:25:33 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 9:25:33 AM | Computer Name = Victor-Lappy | Source = Windows Search Service | ID = 3013
Description =
Error - 9/9/2011 12:38:03 PM | Computer Name = Victor-Lappy | Source = WinMgmt | ID = 10
Description =
[ DigitalPersona Pro Events ]
Error - 1/23/2010 5:25:56 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/25/2010 1:07:59 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/26/2010 1:41:06 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/27/2010 1:57:47 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/28/2010 2:20:04 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 1/29/2010 4:53:43 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 2/10/2010 1:29:23 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 2/12/2010 1:47:35 AM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 3/2/2010 9:33:51 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
Error - 3/2/2010 9:42:59 PM | Computer Name = Victor-Lappy | Source = DigitalPersona Pro | ID = 17827075
Description = Agent cannot start. Description: Found other running Agent.
[ Media Center Events ]
Error - 6/17/2009 1:32:10 AM | Computer Name = Victor-Lappy | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.
Error - 9/22/2009 1:25:24 PM | Computer Name = Victor-Lappy | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.
[ System Events ]
Error - 9/9/2011 11:12:06 PM | Computer Name = Victor-Lappy | Source = HTTP | ID = 15016
Description =
Error - 9/9/2011 11:13:10 PM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/9/2011 11:13:13 PM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/9/2011 11:13:29 PM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
Error - 9/9/2011 11:13:29 PM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
Error - 9/10/2011 10:41:42 AM | Computer Name = Victor-Lappy | Source = HTTP | ID = 15016
Description =
Error - 9/10/2011 10:42:45 AM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/10/2011 10:42:49 AM | Computer Name = Victor-Lappy | Source = DCOM | ID = 10016
Description =
Error - 9/10/2011 10:43:06 AM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
Error - 9/10/2011 10:43:06 AM | Computer Name = Victor-Lappy | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Broni
Posts: 56,041 +516
We need to remove old Java version and its remnants...
Download JavaRa to your desktop and unzip it to its own folder
===================================================================
Run OTL
=================================================================
Last scans....
1. Download Security Check from HERE, and save it to your Desktop.
2. Download Temp File Cleaner (TFC)
3. Please run a free online scan with the ESET Online Scanner
Download JavaRa to your desktop and unzip it to its own folder
- Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
- Accept any prompts.
===================================================================
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
Code::OTL FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet) O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet) O15 - HKU\S-1-5-21-2811368694-1360954036-796960686-1000\..Trusted Ranges: Range1 ([http] in Local intranet) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.) [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2011/09/06 04:54:43 | 000,001,244 | -HS- | M] () -- C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33 :Services :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" =- :Files :Commands [purity] [emptytemp] [emptyflash] [Reboot] - Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- You will get a log that shows the results of the fix. Please post it.
=================================================================
Last scans....
1. Download Security Check from HERE, and save it to your Desktop.
- Double-click SecurityCheck.exe
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.
2. Download Temp File Cleaner (TFC)
- Double click on TFC.exe to run the program.
- Click on Start button to begin cleaning process.
- TFC will close all running programs, and it may ask you to restart computer.
3. Please run a free online scan with the ESET Online Scanner
- Disable your antivirus program
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- Accept any security warnings from your browser.
- Check Scan archives
- Click Start
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push List of found threats
- Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- NOTE. If Eset won't find any threats, it won't produce any log.
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http not found.
Registry value HKEY_USERS\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
C:\Windows\System32\ConduitEngine.tmp deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33 moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\DisableMonitoring deleted successfully.
========== FILES ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Nata
->Temp folder emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Victor
->Temp folder emptied: 3181 bytes
->Temporary Internet Files folder emptied: 252033 bytes
->Java cache emptied: 1 bytes
->FireFox cache emptied: 161311693 bytes
->Google Chrome cache emptied: 67058813 bytes
->Flash cache emptied: 11926 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 218.00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Nata
User: Public
User: Victor
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.27.0 log created on 09102011_162759
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http not found.
Registry value HKEY_USERS\S-1-5-21-2811368694-1360954036-796960686-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
C:\Windows\System32\ConduitEngine.tmp deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
C:\ProgramData\71g87371chqc05ub2e2nb70127b55ibt6nkser0jkc33 moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\DisableMonitoring deleted successfully.
========== FILES ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Nata
->Temp folder emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Victor
->Temp folder emptied: 3181 bytes
->Temporary Internet Files folder emptied: 252033 bytes
->Java cache emptied: 1 bytes
->FireFox cache emptied: 161311693 bytes
->Google Chrome cache emptied: 67058813 bytes
->Flash cache emptied: 11926 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 218.00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Nata
User: Public
User: Victor
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.27.0 log created on 09102011_162759
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Results of screen317's Security Check version 0.99.7
Windows Vista Service Pack 1 (UAC is disabled!)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
Avira AntiVir Personal - Free Antivirus
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
TuneUp Utilities 2007
CCleaner
Java(TM) 6 Update 26
Java(TM) 6 Update 27
Out of date Java installed!
Adobe Flash Player 10.3.183.7
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
``````````End of Log````````````
Windows Vista Service Pack 1 (UAC is disabled!)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
Avira AntiVir Personal - Free Antivirus
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
TuneUp Utilities 2007
CCleaner
Java(TM) 6 Update 26
Java(TM) 6 Update 27
Out of date Java installed!
Adobe Flash Player 10.3.183.7
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
``````````End of Log````````````
Here is what ESET found
C:\Documents and Settings\Victor\AppData\Local\Google\Chrome\User Data\Default\Default\ockadbodpbkcggncpellnpfpmknldgga\contentscript.js Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Documents and Settings\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{aa7b9bfa-4feb-4f84-bfb3-6cdcfc6e4a2c}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{5936b4c6-e34a-404d-81e8-b9a113182aa8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{5936b4c6-e34a-404d-81e8-b9a113182aa8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
C:\Documents and Settings\Victor\AppData\Local\Google\Chrome\User Data\Default\Default\ockadbodpbkcggncpellnpfpmknldgga\contentscript.js Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Documents and Settings\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{aa7b9bfa-4feb-4f84-bfb3-6cdcfc6e4a2c}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{5936b4c6-e34a-404d-81e8-b9a113182aa8}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Victor\AppData\Roaming\Mozilla\Firefox\Profiles\g349ce76.default\extensions\{5936b4c6-e34a-404d-81e8-b9a113182aa8}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan deleted - quarantined
Broni
Posts: 56,041 +516
Your computer is clean
1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:
Run OTL
2. Now, we'll remove all tools, we used during our cleaning process
Clean up with OTL:
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
3. Make sure, Windows Updates are current (including Service Pack 2 installation and upgrading Internet Explorer to version 9!!!)
4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!
5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.
6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.
7. Run Temporary File Cleaner (TFC) weekly.
8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.
9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.
10. (Windows XP only) Run defrag at your convenience.
11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.
12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
13. Please, let me know, how your computer is doing.
1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post resulting log.
2. Now, we'll remove all tools, we used during our cleaning process
Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
3. Make sure, Windows Updates are current (including Service Pack 2 installation and upgrading Internet Explorer to version 9!!!)
4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!
5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.
6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.
7. Run Temporary File Cleaner (TFC) weekly.
8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.
9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.
10. (Windows XP only) Run defrag at your convenience.
11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.
12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
13. Please, let me know, how your computer is doing.
All processes killed
========== OTL ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Nata
->Temp folder emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Victor
->Temp folder emptied: 46941624 bytes
->Temporary Internet Files folder emptied: 46689261 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 104153204 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2379 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 4695583766 bytes
Total Files Cleaned = 4,667.00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Nata
User: Public
User: Victor
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.27.0 log created on 09102011_234654
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
========== OTL ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Nata
->Temp folder emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Victor
->Temp folder emptied: 46941624 bytes
->Temporary Internet Files folder emptied: 46689261 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 104153204 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2379 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 4695583766 bytes
Total Files Cleaned = 4,667.00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Nata
User: Public
User: Victor
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.27.0 log created on 09102011_234654
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
- Status
Similar threads
