[RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Started By johnboy, Dec 04 2011 07:59 PM

You cannot start a new topic
You cannot reply to this topic
Go to first unread post

30 replies to this topic

#1 johnboy

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 04 December 2011 - 07:59 PM

Originally it was thought that she only had the Cloud AV virus. The steps at the following site were taken by her to eliminate it. http://malwaretips.c...Uninstall-Guide

Apparently there were more issues though. It might be worth noting that her computer seems to run fine without the internet connected, then it starts acting extremely slow. Unfortunately I am working on her computer at my home which I only have an AT&T aircard, therefore I cannot connect the infected computer to the internet at the moment.

Below are all of the scans that was requested in the "Before you post, read this!" sticky.

#2 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 04 December 2011 - 08:00 PM

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7622

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

11/26/2011 8:58:10 PM
mbam-log-2011-11-26 (20-58-10).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 258837
Time elapsed: 25 minute(s), 54 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 23
Registry Values Infected: 5
Registry Data Items Infected: 3
Folders Infected: 11
Files Infected: 31

Memory Processes Infected:
c:\program files\357C2\lvvm.exe (Malware.Packer) -> 160 -> Unloaded process successfully.
c:\program files\LP\26B5\731.exe (Malware.Packer) -> 2040 -> Unloaded process successfully.
c:\documents and settings\compaq_owner\application data\54435\8C926.exe (Malware.Packer) -> 1148 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3ED5288-F558-4F6E-8D5C-740CB6F89029} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\731.exe (Malware.Packer) -> Value: 731.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CZqjYCwkIrOtAuS (Malware.Packer) -> Value: CZqjYCwkIrOtAuS -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iH5J7dEL8RYwUlN8234A (Rogue.CloudAV2012) -> Value: iH5J7dEL8RYwUlN8234A -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Value: (default) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
c:\documents and settings\compaq_owner\start menu\Programs\cloud av 2012 (Rogue.CloudAV2012) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\funwebproducts\Data (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\funwebproducts\Data\compaq_owner (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\screensaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\screensaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
c:\program files\357C2\lvvm.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\program files\LP\26B5\731.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\54435\8C926.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\dwme.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\Sun\Java\deployment\cache\6.0\55\781ffd37-2f43e5c9 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\local settings\application data\iec.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\local settings\Temp\dwme.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\local settings\Temp\thpm6005120732032758855.tmp (Trojan.Exploit.Drop.THPM) -> Quarantined and deleted successfully.
c:\program files\LP\26B5\86.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\program files\LP\26B5\8E.tmp (Malware.Packer) -> Quarantined and deleted successfully.
c:\program files\LP\26B5\91.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0416028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0416038.exe (Malware.Packer) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0417028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0418028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0419028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0420028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0421028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0422028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0423028.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\system volume information\_restore{00eff98b-5705-4d9a-ba78-7681a60afb54}\RP1800\A0423039.sys (Rootkit.0Access) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\ahst.lni (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\Desktop\cloud av 2012.lnk (Rogue.CloudAV2012) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\start menu\Programs\cloud av 2012\cloud av 2012.lnk (Rogue.CloudAV2012) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\cloud av 2012v121.exe (Rogue.CloudAV2012) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_owner\application data\funwebproducts\Data\compaq_owner\wffavs.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\screensaver\Images\0D1350A8.urr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\History\search2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

#3 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 04 December 2011 - 08:00 PM

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-12-04 12:58:18
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 ST3120213AS rev.3.AHH
Running: 78uny3po.exe; Driver: C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\uwlcraoc.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xB9A9CF3C]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xB9A9CFE4]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xB9A9D080]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xB9A9D11C]

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6365360, 0x20574D, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\$NtUninstallKB51023$\2362424085 0 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786 0 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\@ 2048 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\bckfg.tmp 952 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\cfg.ini 199 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\Desktop.ini 4608 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\keywords 0 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\kwrd.dll 223744 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\L 0 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\L\bfhdmwap 62976 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\lsflt7.ver 5176 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\U 0 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\U\00000001.@ 2048 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\U\00000002.@ 224768 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\U\00000004.@ 1024 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\U\80000000.@ 1024 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\U\80000004.@ 12800 bytes
File C:\WINDOWS\$NtUninstallKB51023$\3639418786\U\80000032.@ 97792 bytes

---- EOF - GMER 1.0.15 ----

#4 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 04 December 2011 - 08:01 PM

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-12-04 12:59:30
-----------------------------
12:59:30.484 OS Version: Windows 5.1.2600 Service Pack 3
12:59:30.484 Number of processors: 1 586 0x2F02
12:59:30.484 ComputerName: YOUR-D0F670B45A UserName: Compaq_Owner
12:59:34.968 Initialize success
12:59:46.875 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5
12:59:46.875 Disk 0 Vendor: ST3120213AS 3.AHH Size: 114473MB BusType: 3
12:59:48.921 Disk 0 MBR read successfully
12:59:48.921 Disk 0 MBR scan
12:59:48.937 Disk 0 unknown MBR code
12:59:48.953 Disk 0 scanning sectors +234436545
12:59:49.171 Disk 0 scanning C:\WINDOWS\system32\drivers
13:00:19.984 Service scanning
13:00:21.578 Modules scanning
13:01:04.250 Disk 0 trace - called modules:
13:01:04.281 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
13:01:04.296 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84dce5e0]
13:01:04.296 3 CLASSPNP.SYS[f751cfd7] -> nt!IofCallDriver -> \Device\00000068[0x84d22f18]
13:01:04.296 5 ACPI.sys[f73b3620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-5[0x84cd18e8]
13:01:04.812 Scan finished successfully
13:40:02.156 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Compaq_Owner\Desktop\MBR.dat"
13:40:02.156 The log file has been saved successfully to "C:\Documents and Settings\Compaq_Owner\Desktop\aswMBR.txt"

#5 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 04 December 2011 - 08:01 PM

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Compaq_Owner at 13:46:52 on 2011-12-04
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.69 [GMT -6:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SelectRebates\SelectRebates.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\AVG\AVG2012\avgemcx.exe
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\AVG\AVG2012\avgrsx.exe
C:\Program Files\AVG\AVG2012\avgcsrvx.exe
C:\WINDOWS\system32\NOTEPAD.EXE
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.40\AVG Secure Search_toolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: hpWebHelper Class: {aaae832a-5fff-4661-9c8f-369692d1dcb9} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\webhelper.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7018.1622\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: ShopAtHomeIEHelper Class: {e8daaa30-6caa-4b58-9603-8e54238219e2} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dll
BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers runtime\YontooIEClient.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: ShopAtHome.com Toolbar: {98279c38-de4b-4bcf-93c9-8ec26069d6f4} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.40\AVG Secure Search_toolbar.dll
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [InstallIQUpdater] "c:\program files\w3i\installiqupdater\InstallIQUpdater.exe" /silent /autorun
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [ALCMTR] ALCMTR.EXE
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SelectRebates] c:\program files\selectrebates\SelectRebates.exe
mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: mswsock.dll
Trusted Zone: alltel.com\care
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - hxxps://activation.alltel.com/wizlet/WINDSTREAM/static/controls/WebflowActiveXInstaller_2-0-0.cab
DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://mn102.coolsavings.com/download/cscmv5X.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: Interfaces\{80443072-5384-4D29-A197-604ECE8884D8} : DhcpNameServer = 16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\8.0.1\ViProtocol.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]
R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\8.0.1\ToolbarUpdater.exe [2011-11-27 246624]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664]
.
=============== Created Last 30 ================
.
2011-12-02 02:54:28 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-11-27 21:39:12 -------- d-----w- c:\documents and settings\compaq_owner\application data\AVG2012
2011-11-27 21:37:16 -------- d-----w- c:\documents and settings\compaq_owner\application data\AVG Secure Search
2011-11-27 21:37:11 -------- d-----w- c:\program files\common files\AVG Secure Search
2011-11-27 21:37:11 -------- d-----w- c:\program files\AVG Secure Search
2011-11-27 21:35:38 -------- d-----w- c:\windows\system32\drivers\AVG
2011-11-27 21:35:38 -------- d-----w- c:\documents and settings\all users\application data\AVG2012
2011-11-27 03:06:24 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro
2011-11-27 02:04:36 -------- d-----w- c:\documents and settings\compaq_owner\application data\Malwarebytes
2011-11-27 02:04:29 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-11-27 02:04:26 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-27 02:04:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-27 01:44:08 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-11-25 21:45:58 -------- d-----w- c:\documents and settings\compaq_owner\application data\WmG5aQJ6d
2011-11-25 21:45:58 -------- d-----w- c:\documents and settings\compaq_owner\application data\LqjYwkVrzNx0v2b
2011-11-24 16:33:37 -------- d-----w- c:\documents and settings\compaq_owner\application data\aHsKfLgXqUeIr
2011-11-24 16:33:36 -------- d-----w- c:\documents and settings\compaq_owner\application data\EQJ6dEK8gZhXkVl
2011-11-24 04:39:51 -------- d-----w- c:\documents and settings\compaq_owner\application data\TycA1ivD2n4m5W7
2011-11-24 04:39:50 -------- d-----w- c:\documents and settings\compaq_owner\application data\qhTXwjUCeItP
2011-11-24 03:11:12 -------- d-----w- c:\documents and settings\compaq_owner\application data\RUVrlONtx0c2b3n
2011-11-24 03:11:11 -------- d-----w- c:\documents and settings\compaq_owner\application data\RTqUeIrPyADoFpH
2011-11-24 02:06:12 -------- d-----w- c:\documents and settings\compaq_owner\application data\qrlONtx0uSiFpGa
2011-11-24 02:06:11 -------- d-----w- c:\documents and settings\compaq_owner\application data\RH5sWJ7dE8TqYwI
2011-11-24 01:53:09 -------- d-----w- c:\documents and settings\compaq_owner\application data\drzPNyx1v2b4
2011-11-24 01:53:08 -------- d-----w- c:\documents and settings\compaq_owner\application data\bfRL9hTXqUe
2011-11-24 01:19:32 -------- d-----w- c:\documents and settings\compaq_owner\application data\QvonF4amHsJfLgZ
2011-11-24 01:19:31 -------- d-----w- c:\documents and settings\compaq_owner\application data\jaQH6dWK8R9TwUe
2011-11-24 01:13:48 -------- d-----w- c:\documents and settings\compaq_owner\application data\gdEK8gRZqYwUrO
2011-11-24 01:13:47 -------- d-----w- c:\documents and settings\compaq_owner\application data\f9gTXqjYCkBzNx1
2011-11-24 01:11:17 -------- d-----w- c:\program files\357C2
2011-11-24 01:10:40 -------- d-----w- c:\documents and settings\compaq_owner\application data\54435
2011-11-24 01:10:31 -------- d-----w- c:\program files\LP
2011-11-24 01:10:12 -------- d-----w- c:\documents and settings\compaq_owner\application data\vYXwkUVrlB
2011-11-24 01:10:12 -------- d-----w- c:\documents and settings\compaq_owner\application data\c0uc1ib3pGaHWfL
2011-11-24 01:10:02 -------- d-----w- c:\documents and settings\compaq_owner\application data\aivD2onF4m5W7E8
2011-11-24 01:09:59 -------- d-----w- c:\documents and settings\compaq_owner\application data\RkIVrzONyAuSoF
2011-11-19 04:35:34 -------- d-----w- C:\e
2011-11-19 04:35:20 -------- d-----w- C:\Data
2011-11-19 04:30:19 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2011-11-19 04:30:16 -------- d-----w- c:\program files\W3i
2011-11-19 04:30:16 -------- d-----w- c:\documents and settings\all users\application data\W3i
2011-11-19 04:28:46 -------- d-----w- c:\program files\Yontoo Layers Runtime
2011-11-19 04:28:46 -------- d-----w- c:\program files\Free Offers from Freeze.com
2011-11-19 04:28:29 -------- d-----w- c:\documents and settings\all users\application data\Tarma Installer
2011-11-19 04:28:12 -------- d-----w- c:\program files\Yahoo!
.
==================== Find3M ====================
.
2011-11-27 01:54:14 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
2011-10-26 03:04:42 398760 ----a-r- c:\windows\system32\cpnprt2.cid
2011-10-07 12:23:48 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 12:21:42 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-09-13 12:30:10 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
.
============= FINISH: 13:47:46.25 ===============

#6 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 04 December 2011 - 08:01 PM

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7/22/2006 5:05:47 PM
System Uptime: 12/4/2011 10:00:26 AM (3 hours ago)
.
Motherboard: ASUSTek Computer INC. | | NAGAMI2L
Processor: AMD Sempron™ Processor 3200+ | Socket 939 | 1803/199mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 105 GiB total, 85.07 GiB free.
D: is FIXED (FAT32) - 7 GiB total, 0.361 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1721: 9/4/2011 1:44:58 AM - System Checkpoint
RP1722: 9/5/2011 2:06:54 AM - System Checkpoint
RP1723: 9/6/2011 3:06:54 AM - System Checkpoint
RP1724: 9/7/2011 4:06:55 AM - System Checkpoint
RP1725: 9/8/2011 5:06:54 AM - System Checkpoint
RP1726: 9/9/2011 6:06:54 AM - System Checkpoint
RP1727: 9/10/2011 7:09:10 AM - System Checkpoint
RP1728: 9/11/2011 8:06:54 AM - System Checkpoint
RP1729: 9/12/2011 9:25:57 AM - System Checkpoint
RP1730: 9/13/2011 10:06:54 AM - System Checkpoint
RP1731: 9/14/2011 10:20:53 AM - System Checkpoint
RP1732: 9/15/2011 11:06:55 AM - System Checkpoint
RP1733: 9/16/2011 12:15:03 PM - System Checkpoint
RP1734: 9/17/2011 1:06:55 PM - System Checkpoint
RP1735: 9/18/2011 2:24:40 PM - System Checkpoint
RP1736: 9/19/2011 2:48:43 PM - System Checkpoint
RP1737: 9/20/2011 3:38:03 PM - System Checkpoint
RP1738: 9/21/2011 4:04:09 PM - System Checkpoint
RP1739: 9/22/2011 4:44:57 PM - System Checkpoint
RP1740: 9/23/2011 4:56:59 PM - System Checkpoint
RP1741: 9/24/2011 5:44:57 PM - System Checkpoint
RP1742: 9/25/2011 6:44:57 PM - System Checkpoint
RP1743: 9/26/2011 7:02:28 PM - System Checkpoint
RP1744: 9/27/2011 8:30:53 PM - System Checkpoint
RP1745: 9/28/2011 9:02:19 PM - System Checkpoint
RP1746: 9/29/2011 10:05:30 PM - System Checkpoint
RP1747: 9/30/2011 10:20:43 PM - System Checkpoint
RP1748: 10/1/2011 11:20:10 PM - System Checkpoint
RP1749: 10/2/2011 11:54:25 PM - System Checkpoint
RP1750: 10/4/2011 12:25:43 AM - System Checkpoint
RP1751: 10/5/2011 1:16:05 AM - System Checkpoint
RP1752: 10/6/2011 2:16:06 AM - System Checkpoint
RP1753: 10/7/2011 3:16:03 AM - System Checkpoint
RP1754: 10/8/2011 4:16:03 AM - System Checkpoint
RP1755: 10/9/2011 8:00:19 AM - System Checkpoint
RP1756: 10/10/2011 8:05:07 AM - System Checkpoint
RP1757: 10/11/2011 8:09:11 AM - System Checkpoint
RP1758: 10/12/2011 9:37:46 AM - System Checkpoint
RP1759: 10/13/2011 10:44:02 AM - System Checkpoint
RP1760: 10/14/2011 11:45:43 AM - System Checkpoint
RP1761: 10/15/2011 12:22:44 PM - System Checkpoint
RP1762: 10/16/2011 12:58:09 PM - System Checkpoint
RP1763: 10/17/2011 1:22:43 PM - System Checkpoint
RP1764: 10/18/2011 1:37:35 PM - System Checkpoint
RP1765: 10/19/2011 2:22:43 PM - System Checkpoint
RP1766: 10/20/2011 3:40:20 PM - System Checkpoint
RP1767: 10/21/2011 4:22:43 PM - System Checkpoint
RP1768: 10/22/2011 5:22:44 PM - System Checkpoint
RP1769: 10/23/2011 6:55:05 PM - System Checkpoint
RP1770: 10/24/2011 7:14:07 PM - System Checkpoint
RP1771: 10/25/2011 8:16:56 PM - System Checkpoint
RP1772: 10/26/2011 8:40:01 PM - System Checkpoint
RP1773: 10/27/2011 9:15:41 PM - System Checkpoint
RP1774: 10/28/2011 9:33:27 PM - System Checkpoint
RP1775: 10/29/2011 9:55:38 PM - System Checkpoint
RP1776: 10/30/2011 10:23:29 PM - System Checkpoint
RP1777: 10/31/2011 10:51:03 PM - System Checkpoint
RP1778: 11/1/2011 11:53:04 PM - System Checkpoint
RP1779: 11/3/2011 12:43:05 AM - System Checkpoint
RP1780: 11/4/2011 12:51:03 AM - System Checkpoint
RP1781: 11/5/2011 1:44:54 AM - System Checkpoint
RP1782: 11/6/2011 1:00:15 AM - System Checkpoint
RP1783: 11/7/2011 2:00:15 AM - System Checkpoint
RP1784: 11/8/2011 3:00:16 AM - System Checkpoint
RP1785: 11/9/2011 4:00:14 AM - System Checkpoint
RP1786: 11/10/2011 5:00:13 AM - System Checkpoint
RP1787: 11/11/2011 5:42:18 AM - System Checkpoint
RP1788: 11/12/2011 6:42:19 AM - System Checkpoint
RP1789: 11/13/2011 7:58:29 AM - System Checkpoint
RP1790: 11/14/2011 8:42:19 AM - System Checkpoint
RP1791: 11/15/2011 9:42:19 AM - System Checkpoint
RP1792: 11/16/2011 9:45:31 AM - System Checkpoint
RP1793: 11/17/2011 9:56:42 AM - System Checkpoint
RP1794: 11/18/2011 10:43:25 AM - System Checkpoint
RP1795: 11/18/2011 10:38:31 PM - Removed NetAssistant
RP1796: 11/19/2011 1:55:58 PM - Removed Bonjour
RP1797: 11/20/2011 2:22:30 PM - System Checkpoint
RP1798: 11/21/2011 3:05:48 PM - System Checkpoint
RP1799: 11/22/2011 3:43:11 PM - System Checkpoint
RP1800: 11/23/2011 4:27:20 PM - System Checkpoint
RP1801: 11/26/2011 10:37:41 PM - System Checkpoint
RP1802: 11/27/2011 3:34:11 PM - Installed AVG 2012
RP1803: 11/27/2011 3:35:05 PM - Installed AVG 2012
RP1804: 11/30/2011 9:13:07 PM - System Checkpoint
RP1805: 12/1/2011 9:20:26 PM - System Checkpoint
RP1806: 12/4/2011 1:14:59 PM - System Checkpoint
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Reader 7.1.0
Agere Systems PCI-SV92PP Soft Modem
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AudibleManager
AVG 2012
Brother MFL-Pro Suite
Compaq Connections (remove only)
Coupon Printer for Windows
Creative System Information
Destinations
DeviceFunctionQFolder
Digital Photo Navigator 1.5
eSupportQFolder
Google Toolbar for Internet Explorer
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2443685)
HP Deskjet 3900 series
HP Imaging Device Functions 7.0
HP Photosmart Essential
HP Solution Center & Imaging Support Tools 5.0
HP Support Overview
HP Update
HP Web Helper
HPDeskjet3900Series
HPPhotoSmartExpress
HPProductAssistant
HpSdpAppCoreApp
InstallIQ Updater
iTunes
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 5
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 17
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ SE Runtime Environment 6 Update 1
Malwarebytes' Anti-Malware version 1.51.2.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MobileMe Control Panel
Move Networks Media Player for Internet Explorer
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA Drivers
PaperPort
PowerCinema NE for Everio
QuickTime
Realtek High Definition Audio Driver
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB982132)
ShopAtHome.com Toolbar
SolutionCenter
Sonic Update Manager
Status
TrayApp
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB971029)
WebFldrs XP
WebReg
WildTangent Web Driver
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
Yahoo! Software Update
Yahoo! Toolbar
Yontoo Layers Runtime 1.10.01
ZENcast Organizer
.
==== Event Viewer Messages From Past Week ========
.
11/30/2011 8:11:37 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
11/27/2011 7:45:21 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
.
==== End Of File ===========================

#7 Broni Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Malware Annihilator

24,883 posts
Joined: October 04, 2004
1,860 topics
Age: 57
Skin: IPBoard wide
Local time: 07:18 AM

Zodiac:Virgo
Gender:Male
Location:Daly City, CA
OS:Windows Vista
Country:

Offline

Time Online: 57d 10h 30m 28s

Posted 04 December 2011 - 08:24 PM

Welcome aboard Posted Image

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

===================================================================================

I'm not sure if I understand why you can't connect to the internet.
We'll need internet connection.
For instance MBAM version is very outdated.
We need to update it.

#8 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 04 December 2011 - 08:45 PM

Well I have another computer I'm using to get on the Internet with. The computer I'm testing doesnt have the driver for the aircard but I can install if needed. I don't understand why Malwarebytes is out of date... I downloaded the latest update and transferred that to her computer. I will load the driver for the aircard and try and update malwarebytes. Do I need to do all of the steps again or just the Malwarebytes scan?

#9 Broni Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Malware Annihilator

24,883 posts
Joined: October 04, 2004
1,860 topics
Age: 57
Skin: IPBoard wide
Local time: 07:18 AM

Zodiac:Virgo
Gender:Male
Location:Daly City, CA
OS:Windows Vista
Country:

Offline

Time Online: 57d 10h 30m 28s

Posted 04 December 2011 - 08:56 PM

Update MBAM, run "Quick scan" from NORMAL mode.
Post new log.

Then....

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

#10 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 05 December 2011 - 12:34 AM

I am trying to do everything you have asked but I cannot get combofix to run. All that happens is a black screen pops up and goes away immediately. I ran RKill and it worked. But still not letting combofix do anything.

Edit: Just tried your second link for combofix and the filesize seems quite a bit larger. Im in the process of trying that one out now. Stay tuned..

#11 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 05 December 2011 - 12:53 AM

It will run but after the initial "scanning" screen (black with green text) a blue screen appears. Immediately after the blue screen a message appears stating "Current date is 2011-12-04. Combofix has expired. Click YES to run in REDUCED FUNCTIONALITY MODE. Click NO to exit.

If I click YES I cannot tell that anything happens.

#12 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 05 December 2011 - 12:55 AM

It may be worth noting that when I do select "YES" it deletes the combofix icon on my desktop.

#13 Broni Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Malware Annihilator

24,883 posts
Joined: October 04, 2004
1,860 topics
Age: 57
Skin: IPBoard wide
Local time: 07:18 AM

Zodiac:Virgo
Gender:Male
Location:Daly City, CA
OS:Windows Vista
Country:

Offline

Time Online: 57d 10h 30m 28s

Posted 05 December 2011 - 02:09 AM

Try to download fresh file.

#14 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 06 December 2011 - 03:18 AM

Below are the logs...

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8310

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/4/2011 3:44:35 PM
mbam-log-2011-12-04 (15-44-34).txt

Scan type: Quick scan
Objects scanned: 162806
Time elapsed: 23 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#15 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 06 December 2011 - 03:18 AM

ComboFix 11-12-05.04 - Compaq_Owner 12/05/2011 20:46:04.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.204 [GMT -6:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
c:\data\ho0dico0_o\us_sres.data
c:\documents and settings\All Users\Application Data\Tarma Installer
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\_Setup.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\_Setupx.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\Setup.dat
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\Setup.exe
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\Setup.ico
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Compaq_Owner\Application Data\aHsKfLgXqUeIr\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\Application Data\c0uc1ib3pGaHWfL
c:\documents and settings\Compaq_Owner\Application Data\c0uc1ib3pGaHWfL\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\Application Data\drzPNyx1v2b4\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\Application Data\gdEK8gRZqYwUrO
c:\documents and settings\Compaq_Owner\Application Data\gdEK8gRZqYwUrO\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\program files\LP
c:\program files\LP\26B5\13.tmp
c:\program files\LP\26B5\1A.tmp
c:\program files\LP\26B5\1B.tmp
c:\program files\LP\26B5\1C.tmp
c:\program files\LP\26B5\1D.tmp
c:\program files\LP\26B5\2A.tmp
c:\program files\LP\26B5\44.tmp
c:\program files\LP\26B5\6C.tmp
c:\program files\LP\26B5\86.tmp
c:\program files\LP\26B5\90.tmp
c:\program files\LP\26B5\91.tmp
c:\program files\SelectRebates
c:\program files\SelectRebates\FFToolbar\chrome.manifest
c:\program files\SelectRebates\FFToolbar\chrome\sahtoolbar.jar
c:\program files\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js
c:\program files\SelectRebates\FFToolbar\install.rdf
c:\program files\SelectRebates\SahImages\alert.png
c:\program files\SelectRebates\SahImages\check.png
c:\program files\SelectRebates\SahImages\close.png
c:\program files\SelectRebates\SelectAlerts.dat
c:\program files\SelectRebates\SelectRebates.exe
c:\program files\SelectRebates\SelectRebates.ini
c:\program files\SelectRebates\SelectRebatesA.dat
c:\program files\SelectRebates\SelectRebatesApi.exe
c:\program files\SelectRebates\SelectRebatesB.dat
c:\program files\SelectRebates\SelectRebatesBT.dat
c:\program files\SelectRebates\SelectRebatesDownload.exe
c:\program files\SelectRebates\SelectRebatesH.dat
c:\program files\SelectRebates\SelectRebatesUninstall.exe
c:\program files\SelectRebates\SRebates.dll
c:\program files\SelectRebates\SRFF3.dll
c:\program files\SelectRebates\Toolbar\AddtoList.bmp
c:\program files\SelectRebates\Toolbar\basis.xml
c:\program files\SelectRebates\Toolbar\Basis.xml.dym
c:\program files\SelectRebates\Toolbar\Blank.bmp
c:\program files\SelectRebates\Toolbar\CashBack.bmp
c:\program files\SelectRebates\Toolbar\Coupons.bmp
c:\program files\SelectRebates\Toolbar\GroceryCoupon.bmp
c:\program files\SelectRebates\Toolbar\i_magnifying.bmp
c:\program files\SelectRebates\Toolbar\icons.bmp
c:\program files\SelectRebates\Toolbar\logo.bmp
c:\program files\SelectRebates\Toolbar\logo_24.bmp
c:\program files\SelectRebates\Toolbar\logo_HotSpots.bmp
c:\program files\SelectRebates\Toolbar\ReviewSite.bmp
c:\program files\SelectRebates\Toolbar\RightControls.dym
c:\program files\SelectRebates\Toolbar\sahtb-alert.bmp
c:\program files\SelectRebates\Toolbar\sahtb-go.bmp
c:\program files\SelectRebates\Toolbar\sahtb-grocerycoupons.bmp
c:\program files\SelectRebates\Toolbar\sahtb-icons.bmp
c:\program files\SelectRebates\Toolbar\sahtb-restaurant.bmp
c:\program files\SelectRebates\Toolbar\sahtb-wishlist.bmp
c:\program files\SelectRebates\Toolbar\Scissors.bmp
c:\program files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll
c:\windows\$NtUninstallKB51023$
c:\windows\$NtUninstallKB51023$\2362424085
c:\windows\$NtUninstallKB51023$\3639418786\@
c:\windows\$NtUninstallKB51023$\3639418786\bckfg.tmp
c:\windows\$NtUninstallKB51023$\3639418786\cfg.ini
c:\windows\$NtUninstallKB51023$\3639418786\Desktop.ini
c:\windows\$NtUninstallKB51023$\3639418786\keywords
c:\windows\$NtUninstallKB51023$\3639418786\kwrd.dll
c:\windows\$NtUninstallKB51023$\3639418786\L\bfhdmwap
c:\windows\$NtUninstallKB51023$\3639418786\lsflt7.ver
c:\windows\$NtUninstallKB51023$\3639418786\U\00000001.@
c:\windows\$NtUninstallKB51023$\3639418786\U\00000002.@
c:\windows\$NtUninstallKB51023$\3639418786\U\00000004.@
c:\windows\$NtUninstallKB51023$\3639418786\U\80000000.@
c:\windows\$NtUninstallKB51023$\3639418786\U\80000004.@
c:\windows\$NtUninstallKB51023$\3639418786\U\80000032.@
c:\windows\HPCPCUninstaller-6.3.2.116-5577497.exe
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\drivers\etc\hosts.txt
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-11-06 to 2011-12-06 )))))))))))))))))))))))))))))))
.
.
2011-12-05 00:29 . 2011-12-05 00:29 -------- d--h--w- c:\windows\PIF
2011-12-04 21:09 . 2011-12-04 21:09 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Bytemobile
2011-12-04 21:01 . 2011-12-04 21:01 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\DBUpdater
2011-12-04 21:00 . 2008-11-21 03:59 27072 ----a-w- c:\windows\system32\drivers\PCASp50.sys
2011-12-04 21:00 . 2011-12-04 21:00 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\AT&T
2011-12-04 21:00 . 2008-08-22 16:05 26760 ----a-r- c:\windows\system32\drivers\swmsflt.sys
2011-12-04 20:55 . 2007-01-18 16:24 26496 ----a-r- c:\windows\system32\drivers\RimSerial.sys
2011-12-04 20:55 . 2011-12-04 20:55 -------- d-----w- c:\program files\Common Files\Motorola Shared
2011-12-04 20:53 . 2011-12-04 20:53 -------- d-----w- C:\Research in Motion
2011-12-04 20:53 . 2011-12-04 20:53 -------- d-----w- c:\program files\Common Files\Research in Motion
2011-12-04 20:52 . 2011-12-04 20:52 -------- d-----w- c:\program files\AT&T
2011-12-04 20:52 . 2011-12-04 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AT&T
2011-12-04 20:51 . 2011-12-04 20:51 -------- d-----w- c:\program files\Option
2011-12-04 20:49 . 2011-12-04 20:49 -------- d-----w- c:\program files\Sierra Wireless Inc
2011-12-04 20:49 . 2011-12-04 20:49 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Sierra Wireless
2011-11-27 03:06 . 2011-11-27 03:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2011-11-27 02:04 . 2011-11-27 02:04 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Malwarebytes
2011-11-27 02:04 . 2011-11-27 02:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-11-27 02:04 . 2011-11-27 02:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-27 02:04 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-27 01:44 . 2008-04-13 19:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-11-25 21:45 . 2011-11-25 21:45 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\WmG5aQJ6d
2011-11-25 21:45 . 2011-11-25 21:45 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\LqjYwkVrzNx0v2b
2011-11-24 16:33 . 2011-12-06 02:59 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\aHsKfLgXqUeIr
2011-11-24 16:33 . 2011-11-24 16:33 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\EQJ6dEK8gZhXkVl
2011-11-24 04:39 . 2011-11-24 04:39 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\TycA1ivD2n4m5W7
2011-11-24 04:39 . 2011-11-24 04:39 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\qhTXwjUCeItP
2011-11-24 03:11 . 2011-11-24 03:11 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\RUVrlONtx0c2b3n
2011-11-24 03:11 . 2011-11-24 03:11 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\RTqUeIrPyADoFpH
2011-11-24 02:06 . 2011-11-24 02:06 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\qrlONtx0uSiFpGa
2011-11-24 02:06 . 2011-11-24 02:06 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\RH5sWJ7dE8TqYwI
2011-11-24 01:53 . 2011-12-06 02:59 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\drzPNyx1v2b4
2011-11-24 01:53 . 2011-11-24 01:53 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\bfRL9hTXqUe
2011-11-24 01:19 . 2011-11-24 01:19 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\QvonF4amHsJfLgZ
2011-11-24 01:19 . 2011-11-24 01:19 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\jaQH6dWK8R9TwUe
2011-11-24 01:13 . 2011-11-24 01:13 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\f9gTXqjYCkBzNx1
2011-11-24 01:11 . 2011-11-27 02:58 -------- d-----w- c:\program files\357C2
2011-11-24 01:10 . 2011-11-24 01:11 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\54435
2011-11-24 01:10 . 2011-11-24 01:10 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\vYXwkUVrlB
2011-11-24 01:10 . 2011-11-24 01:10 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\aivD2onF4m5W7E8
2011-11-24 01:09 . 2011-11-24 01:09 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\RkIVrzONyAuSoF
2011-11-21 22:48 . 2011-11-21 22:48 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2011-11-19 04:35 . 2011-11-19 04:35 -------- d-----w- C:\e
2011-11-19 04:30 . 2011-11-19 04:30 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2011-11-19 04:30 . 2011-11-19 04:30 -------- d-----w- c:\program files\W3i
2011-11-19 04:30 . 2011-11-19 04:30 -------- d-----w- c:\documents and settings\All Users\Application Data\W3i
2011-11-19 04:29 . 2011-11-19 04:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2011-11-19 04:28 . 2011-11-19 04:29 -------- d-----w- c:\program files\Free Offers from Freeze.com
2011-11-19 04:28 . 2011-11-19 04:28 -------- d-----w- c:\program files\Yontoo Layers Runtime
2011-11-19 04:28 . 2011-11-19 04:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2011-11-19 04:28 . 2011-11-19 04:28 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Yahoo!
2011-11-19 04:28 . 2011-11-19 04:29 -------- d-----w- c:\program files\Yahoo!
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-27 01:54 . 2004-08-04 11:00 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
2011-10-26 03:04 . 2011-10-26 03:04 398760 ----a-r- c:\windows\system32\cpnprt2.cid
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn0\yt.dll" [2011-11-02 2015544]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2011-09-30 17:27 194848 ----a-w- c:\program files\Yontoo Layers Runtime\YontooIEClient.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-10-11 1179648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 16010240]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-11 149280]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-25 7311360]
"nwiz"="nwiz.exe" [2006-01-25 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-01-25 86016]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-06-29 77824]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2008-12-01 33280]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-5-24 27136]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2006-06-28 12:46 622592 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EverioService]
2008-04-03 15:45 151552 ------w- c:\program files\CyberLink\PCM4Everio\EverioService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 05:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2005-03-17 19:45 40960 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 16:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2005-03-17 19:25 57393 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2005-07-23 05:14 237568 ----a-w- c:\windows\SMINST\Recguard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
2005-01-26 23:02 49152 ----a-w- c:\program files\Brother\Brmfl06a\BrStDvPt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 15:22 155648 ----a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-06-14 02:51 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"odserv"=3 (0x3)
"iPod Service"=3 (0x3)
"IntuitUpdateService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"Creative Service for CDROM Access"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"=
.
R3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);c:\windows\system32\drivers\swnc8u80.sys [8/20/2008 1:35 PM 168192]
R3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);c:\windows\system32\drivers\swumx80.sys [8/20/2008 1:36 PM 142976]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/30/2010 8:52 AM 135664]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [11/20/2008 10:07 PM 113152]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/30/2010 8:52 AM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2011-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 14:52]
.
2011-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 14:52]
.
2011-12-06 c:\windows\Tasks\User_Feed_Synchronization-{8680FA2D-C1D3-4137-8BD5-26C367F99DC6}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: bmnet.dll
Trusted Zone: alltel.com\care
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKLM-Run-SelectRebates - c:\program files\SelectRebates\SelectRebates.exe
SafeBoot-80676442.sys
AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\docume~1\ALLUSE~1\APPLIC~1\TARMAI~1\{889DF~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-05 21:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(888)
c:\windows\system32\bmnet.dll
.
- - - - - - - > 'explorer.exe'(1316)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\RTHDCPL.EXE
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-12-05 21:13:51 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-06 03:13
.
Pre-Run: 91,255,861,248 bytes free
Post-Run: 91,727,380,480 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - D1FC65EB5D0B64BF4D99F2DCF00471BC

#16 Broni Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Malware Annihilator

24,883 posts
Joined: October 04, 2004
1,860 topics
Age: 57
Skin: IPBoard wide
Local time: 07:18 AM

Zodiac:Virgo
Gender:Male
Location:Daly City, CA
OS:Windows Vista
Country:

Offline

Time Online: 57d 10h 30m 28s

Posted 06 December 2011 - 03:32 AM

1. Please open Notepad (Start>All Programs>Accessories>Notepad).

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::

Folder::
c:\documents and settings\Compaq_Owner\Application Data\RkIVrzONyAuSoF
c:\documents and settings\Compaq_Owner\Application Data\aivD2onF4m5W7E8
c:\documents and settings\Compaq_Owner\Application Data\vYXwkUVrlB
c:\documents and settings\Compaq_Owner\Application Data\54435
c:\program files\357C2
c:\documents and settings\Compaq_Owner\Application Data\f9gTXqjYCkBzNx1
c:\documents and settings\Compaq_Owner\Application Data\jaQH6dWK8R9TwUe
c:\documents and settings\Compaq_Owner\Application Data\QvonF4amHsJfLgZ
c:\documents and settings\Compaq_Owner\Application Data\bfRL9hTXqUe
c:\documents and settings\Compaq_Owner\Application Data\drzPNyx1v2b4
c:\documents and settings\Compaq_Owner\Application Data\RH5sWJ7dE8TqYwI
c:\documents and settings\Compaq_Owner\Application Data\qrlONtx0uSiFpGa
c:\documents and settings\Compaq_Owner\Application Data\RTqUeIrPyADoFpH
c:\documents and settings\Compaq_Owner\Application Data\RUVrlONtx0c2b3n
c:\documents and settings\Compaq_Owner\Application Data\qhTXwjUCeItP
c:\documents and settings\Compaq_Owner\Application Data\TycA1ivD2n4m5W7
c:\documents and settings\Compaq_Owner\Application Data\EQJ6dEK8gZhXkVl
c:\documents and settings\Compaq_Owner\Application Data\aHsKfLgXqUeIr
c:\documents and settings\Compaq_Owner\Application Data\LqjYwkVrzNx0v2b
c:\documents and settings\Compaq_Owner\Application Data\WmG5aQJ6d


DDS::
Trusted Zone: alltel.com\care

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

#17 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 08 December 2011 - 03:02 AM

ComboFix 11-12-05.04 - Compaq_Owner 12/07/2011 20:23:09.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.124 [GMT -6:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Compaq_Owner\Application Data\54435
c:\documents and settings\Compaq_Owner\Application Data\54435\57C2.443
c:\documents and settings\Compaq_Owner\Application Data\aHsKfLgXqUeIr
c:\documents and settings\Compaq_Owner\Application Data\aHsKfLgXqUeIr\Thumbs.db
c:\documents and settings\Compaq_Owner\Application Data\aivD2onF4m5W7E8
c:\documents and settings\Compaq_Owner\Application Data\bfRL9hTXqUe
c:\documents and settings\Compaq_Owner\Application Data\drzPNyx1v2b4
c:\documents and settings\Compaq_Owner\Application Data\drzPNyx1v2b4\Thumbs.db
c:\documents and settings\Compaq_Owner\Application Data\EQJ6dEK8gZhXkVl
c:\documents and settings\Compaq_Owner\Application Data\f9gTXqjYCkBzNx1
c:\documents and settings\Compaq_Owner\Application Data\jaQH6dWK8R9TwUe
c:\documents and settings\Compaq_Owner\Application Data\LqjYwkVrzNx0v2b
c:\documents and settings\Compaq_Owner\Application Data\qhTXwjUCeItP
c:\documents and settings\Compaq_Owner\Application Data\qrlONtx0uSiFpGa
c:\documents and settings\Compaq_Owner\Application Data\qrlONtx0uSiFpGa\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\Application Data\QvonF4amHsJfLgZ
c:\documents and settings\Compaq_Owner\Application Data\QvonF4amHsJfLgZ\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\Application Data\RH5sWJ7dE8TqYwI
c:\documents and settings\Compaq_Owner\Application Data\RkIVrzONyAuSoF
c:\documents and settings\Compaq_Owner\Application Data\RTqUeIrPyADoFpH
c:\documents and settings\Compaq_Owner\Application Data\RUVrlONtx0c2b3n
c:\documents and settings\Compaq_Owner\Application Data\RUVrlONtx0c2b3n\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\Application Data\TycA1ivD2n4m5W7
c:\documents and settings\Compaq_Owner\Application Data\TycA1ivD2n4m5W7\Cloud AV 2012.ico
c:\documents and settings\Compaq_Owner\Application Data\vYXwkUVrlB
c:\documents and settings\Compaq_Owner\Application Data\WmG5aQJ6d
c:\documents and settings\Compaq_Owner\Application Data\WmG5aQJ6d\Cloud AV 2012.ico
c:\program files\357C2
.
.
((((((((((((((((((((((((( Files Created from 2011-11-08 to 2011-12-08 )))))))))))))))))))))))))))))))
.
.
2011-12-05 00:29 . 2011-12-05 00:29 -------- d--h--w- c:\windows\PIF
2011-12-04 21:09 . 2011-12-04 21:09 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Bytemobile
2011-12-04 21:01 . 2011-12-04 21:01 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\DBUpdater
2011-12-04 21:00 . 2008-11-21 03:59 27072 ----a-w- c:\windows\system32\drivers\PCASp50.sys
2011-12-04 21:00 . 2011-12-04 21:00 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\AT&T
2011-12-04 21:00 . 2008-08-22 16:05 26760 ----a-r- c:\windows\system32\drivers\swmsflt.sys
2011-12-04 20:55 . 2007-01-18 16:24 26496 ----a-r- c:\windows\system32\drivers\RimSerial.sys
2011-12-04 20:55 . 2011-12-04 20:55 -------- d-----w- c:\program files\Common Files\Motorola Shared
2011-12-04 20:53 . 2011-12-04 20:53 -------- d-----w- C:\Research in Motion
2011-12-04 20:53 . 2011-12-04 20:53 -------- d-----w- c:\program files\Common Files\Research in Motion
2011-12-04 20:52 . 2011-12-04 20:52 -------- d-----w- c:\program files\AT&T
2011-12-04 20:52 . 2011-12-04 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AT&T
2011-12-04 20:51 . 2011-12-04 20:51 -------- d-----w- c:\program files\Option
2011-12-04 20:49 . 2011-12-04 20:49 -------- d-----w- c:\program files\Sierra Wireless Inc
2011-12-04 20:49 . 2011-12-04 20:49 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Sierra Wireless
2011-11-27 03:06 . 2011-11-27 03:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2011-11-27 02:04 . 2011-11-27 02:04 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Malwarebytes
2011-11-27 02:04 . 2011-11-27 02:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-11-27 02:04 . 2011-11-27 02:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-27 02:04 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-27 01:44 . 2008-04-13 19:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-11-21 22:48 . 2011-11-21 22:48 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2011-11-19 04:35 . 2011-11-19 04:35 -------- d-----w- C:\e
2011-11-19 04:30 . 2011-11-19 04:30 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2011-11-19 04:30 . 2011-11-19 04:30 -------- d-----w- c:\program files\W3i
2011-11-19 04:30 . 2011-11-19 04:30 -------- d-----w- c:\documents and settings\All Users\Application Data\W3i
2011-11-19 04:29 . 2011-11-19 04:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2011-11-19 04:28 . 2011-11-19 04:29 -------- d-----w- c:\program files\Free Offers from Freeze.com
2011-11-19 04:28 . 2011-11-19 04:28 -------- d-----w- c:\program files\Yontoo Layers Runtime
2011-11-19 04:28 . 2011-11-19 04:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2011-11-19 04:28 . 2011-11-19 04:28 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Yahoo!
2011-11-19 04:28 . 2011-11-19 04:29 -------- d-----w- c:\program files\Yahoo!
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-27 01:54 . 2004-08-04 11:00 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
2011-10-26 03:04 . 2011-10-26 03:04 398760 ----a-r- c:\windows\system32\cpnprt2.cid
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn0\yt.dll" [2011-11-02 2015544]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2011-09-30 17:27 194848 ----a-w- c:\program files\Yontoo Layers Runtime\YontooIEClient.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-10-11 1179648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 16010240]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-11 149280]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-25 7311360]
"nwiz"="nwiz.exe" [2006-01-25 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-01-25 86016]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-06-29 77824]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2008-12-01 33280]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-5-24 27136]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2006-06-28 12:46 622592 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EverioService]
2008-04-03 15:45 151552 ------w- c:\program files\CyberLink\PCM4Everio\EverioService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 05:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2005-03-17 19:45 40960 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 16:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2005-03-17 19:25 57393 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2005-07-23 05:14 237568 ----a-w- c:\windows\SMINST\Recguard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
2005-01-26 23:02 49152 ----a-w- c:\program files\Brother\Brmfl06a\BrStDvPt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 15:22 155648 ----a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-06-14 02:51 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"odserv"=3 (0x3)
"iPod Service"=3 (0x3)
"IntuitUpdateService"=2 (0x2)
"idsvc"=3 (0x3)
"gusvc"=3 (0x3)
"Creative Service for CDROM Access"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"=
.
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/30/2010 8:52 AM 135664]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [11/20/2008 10:07 PM 113152]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/30/2010 8:52 AM 135664]
S3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);c:\windows\system32\drivers\swnc8u80.sys [8/20/2008 1:35 PM 168192]
S3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);c:\windows\system32\drivers\swumx80.sys [8/20/2008 1:36 PM 142976]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2011-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 14:52]
.
2011-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 14:52]
.
2011-12-08 c:\windows\Tasks\User_Feed_Synchronization-{8680FA2D-C1D3-4137-8BD5-26C367F99DC6}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: bmnet.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-07 20:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\bmnet.dll
.
Completion time: 2011-12-07 20:41:38
ComboFix-quarantined-files.txt 2011-12-08 02:41
ComboFix2.txt 2011-12-06 03:13
.
Pre-Run: 91,702,038,528 bytes free
Post-Run: 91,689,422,848 bytes free
.
- - End Of File - - D84C0DBE811692F73D2D422002A290DF

#18 Broni Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Malware Annihilator

24,883 posts
Joined: October 04, 2004
1,860 topics
Age: 57
Skin: IPBoard wide
Local time: 07:18 AM

Zodiac:Virgo
Gender:Male
Location:Daly City, CA
OS:Windows Vista
Country:

Offline

Time Online: 57d 10h 30m 28s

Posted 08 December 2011 - 03:15 AM

Good :)

How is computer doing?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

#19 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 09 December 2011 - 01:29 AM

OTL logfile created on: 12/8/2011 6:52:06 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = F:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.48 Mb Total Physical Memory | 129.42 Mb Available Physical Memory | 28.99% Memory free
1.03 Gb Paging File | 0.79 Gb Available in Paging File | 76.59% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 104.68 Gb Total Space | 85.42 Gb Free Space | 81.60% Space Free | Partition Type: NTFS
Drive D: | 7.09 Gb Total Space | 0.36 Gb Free Space | 5.09% Space Free | Partition Type: FAT32
Drive F: | 3.77 Gb Total Space | 3.77 Gb Free Space | 99.99% Space Free | Partition Type: FAT32

Computer Name: YOUR-D0F670B45A | User Name: Compaq_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/08 18:47:50 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
PRC - [2011/10/11 12:49:14 | 001,179,648 | ---- | M] (W3i, LLC) -- C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/17 10:03:38 | 000,868,352 | ---- | M] () -- C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

========== Modules (No Company Name) ==========

MOD - [2009/10/23 16:01:58 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2007/07/17 10:03:38 | 000,868,352 | ---- | M] () -- C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
MOD - [2007/02/07 15:51:20 | 000,188,416 | ---- | M] () -- C:\Program Files\Creative\Sync Manager Unicode\CTSyncRs.crl

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2008/11/20 22:07:42 | 000,113,152 | ---- | M] (SmithMicro Inc.) [On_Demand | Stopped] -- C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe -- (ATTRcAppSvc)
SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

========== Driver Services (SafeList) ==========

DRV - [2008/11/20 22:02:48 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2008/11/20 21:59:02 | 000,032,408 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCTINDIS5.sys -- (PCTINDIS5)
DRV - [2008/11/20 21:59:02 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PCASp50.sys -- (PCASp50)
DRV - [2008/08/22 10:05:42 | 000,026,760 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\swmsflt.sys -- (swmsflt)
DRV - [2008/08/20 13:36:36 | 000,142,976 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\swumx80.sys -- (SWUMX80) Sierra Wireless USB MUX Driver (UMTS80)
DRV - [2008/08/20 13:35:40 | 000,168,192 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\swnc8u80.sys -- (SWNC8U80) Sierra Wireless MUX NDIS Driver (UMTS80)
DRV - [2006/03/08 14:27:12 | 004,246,016 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/03/03 15:31:04 | 000,013,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/03/03 15:31:02 | 000,034,176 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2006/01/25 17:24:30 | 001,149,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2005/06/29 18:03:18 | 000,175,104 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys -- (ftsata2)
DRV - [2005/03/09 15:53:00 | 000,036,352 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2003/11/05 08:45:12 | 000,017,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\bb-run.sys -- (bb-run)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.h...ARIO&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...ARIO&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...ARIO&pf=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...ARIO&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...ARIO&pf=desktop
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...ARIO&pf=desktop
IE - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...ie=utf8&oe=utf8
IE - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

O1 HOSTS File: ([2011/12/07 20:37:08 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: <Company name>)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AT&T Communication Manager] C:\Program Files\AT&T\Communication Manager\ATTCM.exe (ATT)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe ()
O4 - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\mswsock.dll File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akama...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} https://activation.a...aller_2-0-0.cab (Reg Error: Value error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_05)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{80443072-5384-4D29-A197-604ECE8884D8}: DhcpNameServer = 16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/05 00:50:26 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/05 20:34:51 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/12/05 20:30:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/12/05 20:30:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/12/05 20:30:08 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/12/05 20:30:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/12/05 20:29:32 | 004,329,111 | R--- | C] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\ComboFix.exe
[2011/12/04 18:39:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/12/04 18:39:15 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/12/04 18:29:31 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2011/12/04 16:03:27 | 008,821,856 | ---- | C] (OPSWAT, Inc.) -- C:\Documents and Settings\Compaq_Owner\Desktop\AppRemover.exe
[2011/12/04 15:09:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Bytemobile
[2011/12/04 15:01:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\DBUpdater
[2011/12/04 15:00:57 | 000,027,072 | ---- | C] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\System32\drivers\PCASp50.sys
[2011/12/04 15:00:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\AT&T
[2011/12/04 14:55:14 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motorola Shared
[2011/12/04 14:54:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AT&T
[2011/12/04 14:54:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Sierra Wireless
[2011/12/04 14:53:14 | 000,000,000 | ---D | C] -- C:\Research in Motion
[2011/12/04 14:53:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Research in Motion
[2011/12/04 14:52:50 | 000,000,000 | ---D | C] -- C:\Program Files\AT&T
[2011/12/04 14:52:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AT&T
[2011/12/04 14:51:39 | 000,000,000 | ---D | C] -- C:\Program Files\Option
[2011/12/04 14:49:14 | 000,000,000 | ---D | C] -- C:\Program Files\Sierra Wireless Inc
[2011/12/04 14:49:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\Sierra Wireless
[2011/12/04 13:40:42 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Administrative Tools
[2011/12/04 10:08:45 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Compaq_Owner\Desktop\aswMBR.exe
[2011/12/04 10:08:45 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\dds.scr
[2011/11/26 21:06:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/11/26 20:04:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
[2011/11/26 20:04:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/11/26 20:04:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/11/26 20:04:26 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/11/26 20:04:26 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/11/21 16:48:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Yahoo!
[2011/11/18 22:35:34 | 000,000,000 | ---D | C] -- C:\e
[2011/11/18 22:30:19 | 000,000,000 | -HSD | C] -- C:\WINDOWS\System32\AI_RecycleBin
[2011/11/18 22:30:16 | 000,000,000 | ---D | C] -- C:\Program Files\W3i
[2011/11/18 22:30:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\W3i
[2011/11/18 22:30:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\InstallIQ Updater
[2011/11/18 22:29:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo!
[2011/11/18 22:28:46 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo Layers Runtime
[2011/11/18 22:28:46 | 000,000,000 | ---D | C] -- C:\Program Files\Free Offers from Freeze.com
[2011/11/18 22:28:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2011/11/18 22:28:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\Yahoo!
[2011/11/18 22:28:12 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo!
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/08 18:47:59 | 000,000,436 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{8680FA2D-C1D3-4137-8BD5-26C367F99DC6}.job
[2011/12/08 18:47:09 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/08 18:46:05 | 000,043,531 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/12/08 18:46:00 | 000,000,186 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.DAT
[2011/12/08 18:45:54 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/08 18:45:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/08 18:45:39 | 468,242,432 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/07 21:10:11 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/07 20:37:08 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/12/05 20:34:59 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/12/05 20:27:38 | 004,329,111 | R--- | M] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\ComboFix.exe
[2011/12/04 18:30:32 | 001,008,114 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\rkill.com
[2011/12/04 16:02:16 | 008,821,856 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\Compaq_Owner\Desktop\AppRemover.exe
[2011/12/04 14:54:59 | 000,001,859 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\at&t Communication Manager.lnk
[2011/11/30 20:23:04 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\dds.scr
[2011/11/30 20:22:52 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Compaq_Owner\Desktop\aswMBR.exe
[2011/11/30 20:22:30 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\78uny3po.exe
[2011/11/26 21:19:34 | 000,443,232 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/11/26 21:19:34 | 000,072,372 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/11/26 20:14:56 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/11/26 20:04:30 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/21 16:48:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/11/18 22:35:38 | 000,000,380 | ---- | M] () -- C:\edu.bmp
[2011/11/18 22:35:38 | 000,000,284 | ---- | M] () -- C:\srch_map_1.gif
[2011/11/18 22:35:38 | 000,000,277 | ---- | M] () -- C:\mov_1.gif
[2011/11/18 22:35:38 | 000,000,274 | ---- | M] () -- C:\trav_1.gif
[2011/11/18 22:35:38 | 000,000,273 | ---- | M] () -- C:\srch_stk_1.gif
[2011/11/18 22:35:38 | 000,000,240 | ---- | M] () -- C:\srch_site_1.gif
[2011/11/18 22:35:38 | 000,000,138 | ---- | M] () -- C:\flk2.gif
[2011/11/18 22:35:38 | 000,000,103 | ---- | M] () -- C:\del_1.gif
[2011/11/18 22:35:37 | 000,000,304 | ---- | M] () -- C:\dir.bmp
[2011/11/18 22:35:37 | 000,000,279 | ---- | M] () -- C:\hj_1.gif
[2011/11/18 22:35:37 | 000,000,268 | ---- | M] () -- C:\ab_1.gif
[2011/11/18 22:35:37 | 000,000,265 | ---- | M] () -- C:\srch_ans_1.gif
[2011/11/18 22:35:37 | 000,000,121 | ---- | M] () -- C:\srch_nws_1.gif
[2011/11/18 22:35:37 | 000,000,113 | ---- | M] () -- C:\srch_aud_1.gif
[2011/11/18 22:35:36 | 000,000,235 | ---- | M] () -- C:\srch_1.gif
[2011/11/18 22:35:36 | 000,000,131 | ---- | M] () -- C:\srch_loc_1.gif
[2011/11/18 22:35:36 | 000,000,123 | ---- | M] () -- C:\srch_sh_1.gif
[2011/11/18 22:35:36 | 000,000,112 | ---- | M] () -- C:\srch_vid_1.gif
[2011/11/18 22:35:36 | 000,000,112 | ---- | M] () -- C:\srch_img_1.gif
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/05 20:30:08 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/12/05 20:30:08 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/12/05 20:30:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/12/05 20:30:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/12/05 20:30:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/12/04 18:44:13 | 468,242,432 | -HS- | C] () -- C:\hiberfil.sys
[2011/12/04 18:31:50 | 001,008,114 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\rkill.com
[2011/12/04 15:00:08 | 000,026,760 | R--- | C] () -- C:\WINDOWS\System32\drivers\swmsflt.sys
[2011/12/04 14:54:59 | 000,001,859 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\at&t Communication Manager.lnk
[2011/12/04 10:08:45 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\78uny3po.exe
[2011/11/26 20:14:56 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/11/26 20:04:30 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/18 22:35:38 | 000,000,380 | ---- | C] () -- C:\edu.bmp
[2011/11/18 22:35:38 | 000,000,284 | ---- | C] () -- C:\srch_map_1.gif
[2011/11/18 22:35:38 | 000,000,277 | ---- | C] () -- C:\mov_1.gif
[2011/11/18 22:35:38 | 000,000,274 | ---- | C] () -- C:\trav_1.gif
[2011/11/18 22:35:38 | 000,000,273 | ---- | C] () -- C:\srch_stk_1.gif
[2011/11/18 22:35:38 | 000,000,240 | ---- | C] () -- C:\srch_site_1.gif
[2011/11/18 22:35:38 | 000,000,138 | ---- | C] () -- C:\flk2.gif
[2011/11/18 22:35:38 | 000,000,103 | ---- | C] () -- C:\del_1.gif
[2011/11/18 22:35:37 | 000,000,304 | ---- | C] () -- C:\dir.bmp
[2011/11/18 22:35:37 | 000,000,279 | ---- | C] () -- C:\hj_1.gif
[2011/11/18 22:35:37 | 000,000,268 | ---- | C] () -- C:\ab_1.gif
[2011/11/18 22:35:37 | 000,000,265 | ---- | C] () -- C:\srch_ans_1.gif
[2011/11/18 22:35:37 | 000,000,121 | ---- | C] () -- C:\srch_nws_1.gif
[2011/11/18 22:35:37 | 000,000,113 | ---- | C] () -- C:\srch_aud_1.gif
[2011/11/18 22:35:36 | 000,000,235 | ---- | C] () -- C:\srch_1.gif
[2011/11/18 22:35:36 | 000,000,131 | ---- | C] () -- C:\srch_loc_1.gif
[2011/11/18 22:35:36 | 000,000,123 | ---- | C] () -- C:\srch_sh_1.gif
[2011/11/18 22:35:36 | 000,000,112 | ---- | C] () -- C:\srch_vid_1.gif
[2011/11/18 22:35:36 | 000,000,112 | ---- | C] () -- C:\srch_img_1.gif
[2011/06/21 21:20:43 | 000,001,492 | -HS- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\2sj84r4yr1d5210755e
[2011/06/21 21:20:43 | 000,001,492 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\2sj84r4yr1d5210755e
[2010/11/03 17:32:18 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\prvlcl.dat
[2009/11/11 19:04:49 | 000,051,560 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009/08/09 20:28:22 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll
[2007/08/18 10:52:21 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2007/08/18 10:52:21 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2007/08/18 10:51:22 | 000,000,357 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2007/08/18 10:51:22 | 000,000,153 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2007/08/18 10:51:22 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf06a.dat
[2007/08/18 10:50:13 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2007/08/18 10:50:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brdfxspd.dat
[2007/08/18 10:48:52 | 000,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2007/01/07 20:42:15 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
[2006/11/28 20:18:05 | 000,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2006/11/06 09:15:16 | 000,078,998 | ---- | C] () -- C:\WINDOWS\hpfins05.dat
[2006/11/06 09:15:16 | 000,001,395 | ---- | C] () -- C:\WINDOWS\hpfmdl05.dat
[2006/11/06 09:15:01 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006/10/29 19:35:14 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\fusioncache.dat
[2006/10/26 21:52:30 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/10/16 08:06:15 | 000,006,048 | ---- | C] () -- C:\WINDOWS\System32\MCC16.dll
[2006/10/15 14:44:19 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2006/05/25 00:31:06 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/05/25 00:05:54 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys
[2006/05/25 00:00:05 | 000,667,896 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2006/05/25 00:00:05 | 000,001,227 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2006/05/24 23:59:57 | 000,012,994 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2006/05/24 23:59:51 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2006/05/24 23:57:39 | 000,000,076 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2006/05/24 23:56:19 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/05/24 23:44:07 | 000,000,056 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/05/24 23:42:27 | 000,045,929 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/05/24 23:42:27 | 000,000,698 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/05/24 23:37:35 | 000,095,822 | ---- | C] () -- C:\WINDOWS\hpqins69.dat
[2006/05/24 23:36:12 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2006/05/24 23:33:29 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/05/24 23:33:28 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/05/24 23:33:28 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/05/24 23:33:28 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/05/24 23:33:28 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/05/24 23:33:28 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/05/24 23:33:28 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/05/24 23:33:28 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/05/24 23:33:26 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/05/24 23:33:26 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/05/24 23:33:26 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/05/24 23:18:44 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006/05/24 23:15:13 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2005/12/05 01:05:38 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/12/05 00:55:08 | 000,443,232 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2005/12/05 00:55:08 | 000,072,372 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2005/12/05 00:53:22 | 000,253,472 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/12/05 00:50:02 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/12/05 00:48:22 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 05:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/06/15 15:38:00 | 000,000,592 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2002/03/04 09:16:34 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001/08/23 16:12:28 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 16:11:02 | 000,004,490 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2011/12/04 14:52:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AT&T
[2011/03/27 11:30:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/01 04:45:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/10/01 04:56:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/11/26 21:06:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011/11/26 21:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iolo
[2011/12/04 17:36:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2011/08/15 09:22:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security
[2007/08/18 10:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2011/11/18 22:30:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i
[2010/07/28 00:37:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/31 19:09:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2011/12/04 15:00:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\AT&T
[2010/10/01 05:09:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\AVG10
[2011/10/23 15:02:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Catalina Marketing Corp
[2011/12/04 15:01:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\DBUpdater
[2011/12/04 13:53:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Image Zone Express
[2007/01/31 08:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Netscape
[2011/08/15 09:24:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Panda Security
[2010/07/12 10:09:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\PC-FAX TX
[2007/09/27 07:10:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Printer Info Cache
[2011/12/04 14:49:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Sierra Wireless
[2007/01/07 20:42:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Template
[2008/08/15 20:01:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\W Photo Studio Viewer
[2011/12/04 15:09:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Bytemobile
[2011/12/08 18:47:59 | 000,000,436 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{8680FA2D-C1D3-4137-8BD5-26C367F99DC6}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2011/11/18 22:35:37 | 000,000,268 | ---- | M] () -- C:\ab_1.gif
[2005/12/05 00:50:26 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/01/18 14:37:57 | 000,000,281 | ---- | M] () -- C:\Boot.bak
[2011/12/05 20:34:59 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2007/08/18 10:52:13 | 000,000,025 | ---- | M] () -- C:\Brxpinst.log
[2004/08/03 22:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/12/07 20:41:38 | 000,014,685 | ---- | M] () -- C:\ComboFix.txt
[2005/12/05 00:50:26 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2011/11/18 22:35:38 | 000,000,103 | ---- | M] () -- C:\del_1.gif
[2011/11/18 22:35:37 | 000,000,304 | ---- | M] () -- C:\dir.bmp
[2011/11/18 22:35:38 | 000,000,380 | ---- | M] () -- C:\edu.bmp
[2011/11/18 22:35:38 | 000,000,138 | ---- | M] () -- C:\flk2.gif
[2011/12/08 18:45:39 | 468,242,432 | -HS- | M] () -- C:\hiberfil.sys
[2011/11/18 22:35:37 | 000,000,279 | ---- | M] () -- C:\hj_1.gif
[2011/12/08 18:50:55 | 304,282,958 | ---- | M] () -- C:\hpWebHelper.log
[2007/01/26 20:18:23 | 000,000,067 | ---- | M] () -- C:\inferno.log
[2005/12/05 00:50:26 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/11/18 22:35:38 | 000,000,277 | ---- | M] () -- C:\mov_1.gif
[2005/12/05 00:50:26 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/03 22:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/06 09:24:22 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/12/08 18:45:38 | 704,643,072 | -HS- | M] () -- C:\pagefile.sys
[2011/12/04 18:34:15 | 000,000,359 | ---- | M] () -- C:\rkill.log
[2011/11/18 22:35:36 | 000,000,235 | ---- | M] () -- C:\srch_1.gif
[2011/11/18 22:35:37 | 000,000,265 | ---- | M] () -- C:\srch_ans_1.gif
[2011/11/18 22:35:37 | 000,000,113 | ---- | M] () -- C:\srch_aud_1.gif
[2011/11/18 22:35:36 | 000,000,112 | ---- | M] () -- C:\srch_img_1.gif
[2011/11/18 22:35:36 | 000,000,131 | ---- | M] () -- C:\srch_loc_1.gif
[2011/11/18 22:35:38 | 000,000,284 | ---- | M] () -- C:\srch_map_1.gif
[2011/11/18 22:35:37 | 000,000,121 | ---- | M] () -- C:\srch_nws_1.gif
[2011/11/18 22:35:36 | 000,000,123 | ---- | M] () -- C:\srch_sh_1.gif
[2011/11/18 22:35:38 | 000,000,240 | ---- | M] () -- C:\srch_site_1.gif
[2011/11/18 22:35:38 | 000,000,273 | ---- | M] () -- C:\srch_stk_1.gif
[2011/11/18 22:35:36 | 000,000,112 | ---- | M] () -- C:\srch_vid_1.gif
[2011/11/26 19:53:41 | 000,046,962 | ---- | M] () -- C:\TDSSKiller.2.6.21.0_26.11.2011_19.50.58_log.txt
[2011/11/18 22:35:38 | 000,000,274 | ---- | M] () -- C:\trav_1.gif

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/12/05 00:49:52 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 06:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/04/08 19:43:36 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll
[2003/06/19 01:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2001/11/20 13:37:28 | 000,047,616 | R--- | M] (Black Ice Software) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\ppbiPr.dll
[2008/07/06 04:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/12/04 16:42:42 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005/12/04 16:42:42 | 000,634,880 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005/12/04 16:42:42 | 000,884,736 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/09/06 09:31:38 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2006/07/22 16:09:30 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/12/05 00:54:04 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/11/30 20:22:30 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\78uny3po.exe
[2011/12/04 16:02:16 | 008,821,856 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\Compaq_Owner\Desktop\AppRemover.exe
[2011/11/30 20:22:52 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Compaq_Owner\Desktop\aswMBR.exe
[2011/12/05 20:27:38 | 004,329,111 | R--- | M] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\ComboFix.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2006/07/22 16:09:29 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2008/11/30 21:54:03 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\Cookies\desktop.ini
[2011/12/08 18:46:07 | 001,081,344 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 18:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 02:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 02:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 08:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 11:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 18:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 02:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 02:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 02:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 02:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 02:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1998/05/07 10:04:38 | 000,052,736 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system\hpsysdrv.exe

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-19 08:08:38

< End of report >

#20 johnboy Re: [RESOLVED] Mother-In-Law's Computer Diseased with Viruses!

Member

73 posts
Joined: July 17, 2009
7 topics
Skin: IP.Board
Local time: 08:18 AM

Offline

Time Online: 3h 41m 43s

Posted 09 December 2011 - 01:31 AM

OTL Extras logfile created on: 12/8/2011 6:52:06 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = F:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.48 Mb Total Physical Memory | 129.42 Mb Available Physical Memory | 28.99% Memory free
1.03 Gb Paging File | 0.79 Gb Available in Paging File | 76.59% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 104.68 Gb Total Space | 85.42 Gb Free Space | 81.60% Space Free | Partition Type: NTFS
Drive D: | 7.09 Gb Total Space | 0.36 Gb Free Space | 5.09% Space Free | Partition Type: FAT32
Drive F: | 3.77 Gb Total Space | 3.77 Gb Free Space | 99.99% Space Free | Partition Type: FAT32

Computer Name: YOUR-D0F670B45A | User Name: Compaq_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe" = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe:*:Enabled:Compaq Connections -- (Hewlett-Packard)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe" = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe:*:Enabled:Compaq Connections -- (Hewlett-Packard)
"C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation)
"C:\Program Files\AT&T\Communication Manager\SwiApiMux.exe" = C:\Program Files\AT&T\Communication Manager\SwiApiMux.exe:*:Enabled:SwiApiMux -- (Sierra Wireless, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{3819891A-030B-4a4e-98ED-B28A649E48AB}" = HP Deskjet 3900 series
"{39CEE1F2-12B6-4C50-9131-04BFCA110578}" = PowerCinema NE for Everio
"{42F6BED9-41DD-40F1-85A8-8E0350493626}" = HPDeskjet3900Series
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{71C97545-E547-4A8B-B0C8-61FF853270AC}" = PaperPort
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{8E1CB0F1-67BF-4052-AA23-FA22E94804C1}" = InstallIQ Updater
"{9A912C12-A7DA-44D7-BD57-5CA85E2F33E1}" = Brother MFL-Pro Suite
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
"{AF64F216-D859-43FC-9068-0005A41AEBA3}" = AT&T Communication Manager
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}" = Digital Photo Navigator 1.5
"{D7DBA21A-CDE5-42EC-BB1C-AE4B3E616B9A}_is1" = HP Support Overview
"{DAAD5187-62C5-4AD6-A526-803C18C4944D}" = HP Web Helper
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{F804CAE5-50B2-4646-803A-A428325237CA}" = Driver Installer
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems PCI-SV92PP Soft Modem
"AudibleManager" = AudibleManager
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.0
"HPOOVClient-5577497 Uninstaller" = Compaq Connections (remove only)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"SysInfo" = Creative System Information
"WildTangent CDA" = WildTangent Web Driver
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update
"ZENcast Organizer" = ZENcast Organizer

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3235570389-1431137124-3005904619-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/26/2011 10:01:19 PM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 1008
Description = The installation of c:\WINDOWS\Installer\1e97ac59.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 11/26/2011 10:01:19 PM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\48222.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 11/26/2011 10:01:19 PM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\48222.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 11/26/2011 10:01:19 PM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\2774fb74.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 11/26/2011 10:01:19 PM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\2774fb74.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 11/26/2011 10:01:19 PM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\5eac4ab.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 11/26/2011 10:01:19 PM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\5eac4ab.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 11/27/2011 5:55:50 PM | Computer Name = YOUR-D0F670B45A | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/27/2011 5:56:47 PM | Computer Name = YOUR-D0F670B45A | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 12/4/2011 5:52:39 PM | Computer Name = YOUR-D0F670B45A | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 12/4/2011 8:27:57 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/4/2011 8:28:48 PM | Computer Name = YOUR-D0F670B45A | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AmdK8 Fips

Error - 12/4/2011 8:29:27 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/4/2011 8:31:44 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/4/2011 8:32:52 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/4/2011 8:38:48 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 12/4/2011 8:43:24 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/7/2011 10:16:57 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10010
Description = The server {4EB61BAC-A3B6-4760-9581-655041EF4D69} did not register
with DCOM within the required timeout.

Error - 12/7/2011 10:46:03 PM | Computer Name = YOUR-D0F670B45A | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 12/8/2011 8:46:58 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10010
Description = The server {4EB61BAC-A3B6-4760-9581-655041EF4D69} did not register
with DCOM within the required timeout.

< End of report >

Back to Virus, Spyware and Malware Removal · Next Unread Topic →

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

This topic has been visited by 12 user(s)

Bent Club, bfe71730, Broni, digger, esdog, frazzm737, jdhoward, johnboy, JohnT, Keeper, Larry(ne), peterc