[Resolved] uacinit.dll left after malwarebytes

spinach1 Topic Starter

Post #1June 25, 2009, 3:18 AM UTC

Hiya, redoing this after being redirected for updated HJT while posting, cannot see previous post.

We had sysguard, trayicon balloons and notifications, multiple instances (33) of iexplore in processes, AVGfree 8.5 got some, unable to install spybot, tracked sysguard.exe and renamed. Downloaded and renamed Malwarebytes scanned and cleaned, system restore will not set points and reports no points available to restore, service is auto and started. Currently Dcom launcher svc is disabled, this prevents new iexplore processes. Malwarebytes continues to report uacinit.dll and a registry key after reboot and rescan.

Then found this forum………………………have installed and run ERUNT and HJT, then had another go,

Here's the log, I look forward to your advice.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:34 PM, on 6/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe
C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.xtramsn.co.nz/0SEENNZ/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.xtramsn.co.nz/0SEENNZ/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.nzcity.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.xtramsn.co.nz/0SEENNZ/SAOS01?FORM=TOOLBR
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.66 antivirsystem-pro.microsoft.com
O1 - Hosts: 94.232.248.66 antivir-system-pro.com
O1 - Hosts: 94.232.248.66 www.antivir-system-pro.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [WD Spindown Utility] "C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe"
O4 - HKCU\..\Run: [Mobile Partner] "C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe"
O4 - HKUS\S-1-5-21-3182933676-324156410-679323072-1003\..\Run: [Mobile Partner] "C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe" (User '?')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1235938159906
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1235938137750
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} (BoardCtl Class) - http://www.intel.com/design/motherbd/boardid/BoardID.cab
O16 - DPF: {EA1B8527-E422-4909-825A-70BE0694F18E} (PortfolioManagerWT ProfileManager Class) - https://online.westpac.com.au/wtoa/wtOtherA…iomanagerwt.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{597D4523-8065-4F9C-ABB6-464CCC19D52D}: NameServer = 10.176.66.71 10.188.66.103
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate1c9df80439b86a6) (gupdate1c9df80439b86a6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 6726 bytes

CatByte

Post #2June 25, 2009, 2:48 PM UTC

Hi and

NOTE:

Malware removal is NOT instantaneous. Most infections require more than one round to properly eradicate.
Absence of symptoms does not always mean the job is complete. You can be certain that I will advise you when the computer is clean.
Kindly follow my instructions in the order posted. While we are working together, please do not run any scans or fix items without my direction.
If you have any questions please ask before proceeding.

NEXT

Please download DDS from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

NEXT

Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

spinach1

Post #3June 25, 2009, 8:44 PM UTC

Hi catbyte, thanks for picking this up, First up I'll just mention again that I have disabled the Dcomlauncher service, please advise if this should be left or re-activated prior to further action. I got dds down from the first link and saved to desktop, disabled AVG 8.5 resident shield as described and ran the script. I cannot think that any other script blocking is in place. The script failed with this reply in a dos box, 'FINDSTR.EXE' is not recognized as aninternal or external command, operable program or batch file. I rebooted and confirmed AVG resident shield was confirmed disabled then tried again with same result, thats as far as I went. TMG…………….

CatByte

Post #4June 25, 2009, 11:03 PM UTC

Hi,

Please run the GMER scan, try it in safe mode…malware is interfering:

Then try this tool instead of DDS

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

spinach1

Post #5June 26, 2009, 12:52 AM UTC

Hiya, I tried GMER in safe mode, which failed to start at all, rebooted to normal and tried again and failed so printed instructions and ran OTL, this popped a dialog box:

Titled: windows - no disk
Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c

Options: cancel, try again, continue,

I hit try again a few times it just repeated so I moved to continue and hit it repeatedly until the scan resumed and logfiles were generated, here they are……….

OTL logfile created on: 6/26/2009 10:25:32 AM - Run 1
OTL by OldTimer - Version 3.0.5.3 Folder = C:\Documents and Settings\OEM\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

759.48 Mb Total Physical Memory | 454.36 Mb Available Physical Memory | 59.82% Memory free
1.06 Gb Paging File | 0.79 Gb Available in Paging File | 74.05% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 5.74 Gb Free Space | 15.42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 23.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 596.02 Gb Total Space | 531.21 Gb Free Space | 89.13% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LOUIETHEFLY
Current User Name: OEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\System32\HPZipm12.exe (HP)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe (Western Digital Technologies, Inc.)
PRC - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE (Hewlett-Packard Company)
PRC - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE (Hewlett-Packard Company)
PRC - C:\Program Files\Internet Explorer\Iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\Iexplore.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\OEM\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Auto | Running]) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (gupdate1c9df80439b86a6 [On_Demand | Stopped]) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (helpsvc [On_Demand | Stopped]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (Kiwi Syslog Daemon [Disabled | Stopped]) – c:\program files\syslogd\syslogd_service.exe (Kiwi Enterprises)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Unknown | Running]) – C:\WINDOWS\System32\HPZipm12.exe (HP)
SRV - (usnjsvc [On_Demand | Stopped]) – C:\Program Files\MSN Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (UxTuneUp [Disabled | Stopped]) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (HP Port Resolver [On_Demand | Stopped]) – C:\WINDOWS\System32\spool\drivers\w32x86\3\HPBPRO.EXE (Hewlett-Packard Company)
SRV - (HP Status Server [On_Demand | Stopped]) – C:\WINDOWS\System32\spool\drivers\w32x86\3\HPBOID.EXE (Hewlett-Packard Company)

========== Driver Services (SafeList) ==========

DRV - (ac97intc [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ac97intc.sys (Intel Corporation)
DRV - (aeaudio [On_Demand | Running]) – C:\WINDOWS\System32\drivers\aeaudio.sys (Andrea Electronics Corporation)
DRV - (AvgLdx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (E100B [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (FINEPIX_PCC [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\V4CB012D.SYS (FUJI PHOTO FILM CO.,LTD.)
DRV - (gameenum [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (hwdatacard [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (MotDev [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motodrv.sys (Motorola Inc)
DRV - (motmodem [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motmodem.sys (Motorola)
DRV - (ms_mpu401 [On_Demand | Running]) – C:\WINDOWS\System32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (NwlnkIpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (PhilCam8116_XP [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\CamDrL20.sys (Logitech Inc.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (smwdm [On_Demand | Running]) – C:\WINDOWS\System32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (StillCam [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\serscan.sys (Microsoft Corporation)
DRV - (usbaudio [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.xtramsn.co.nz/0SEENNZ/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.nzcity.co.nz/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,AutoSearch = http://ie.search.msn.com/{SUB_RFC1766}/src…autosearch.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (163 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.66 antivirsystem-pro.microsoft.com
O1 - Hosts: 94.232.248.66 antivir-system-pro.com
O1 - Hosts: 94.232.248.66 www.antivir-system-pro.com
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [WD Spindown Utility] C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe (Western Digital Technologies, Inc.)
O4 - HKCU..\Run: [Mobile Partner] C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm ()
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm ()
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdat…b?1235938159906 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1235938137750 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} http://www.intel.com/design/motherbd/boardid/BoardID.cab (BoardCtl Class)
O16 - DPF: {EA1B8527-E422-4909-825A-70BE0694F18E} https://online.westpac.com.au/wtoa/wtOtherA…iomanagerwt.cab (PortfolioManagerWT ProfileManager Class)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - File not found
O20 - HKLM Winlogon: UIHost - (logonui.exe) - File not found
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - File not found
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - File not found
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - File not found
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - File not found
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - File not found
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - File not found
O29 - HKLM SecurityProviders - (msapsspc.dll) - File not found
O29 - HKLM SecurityProviders - (schannel.dll) - File not found
O29 - HKLM SecurityProviders - (digest.dll) - File not found
O29 - HKLM SecurityProviders - (msnsspc.dll) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/07/12 15:38:49 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2008/09/03 10:07:56 | 00,114,688 | R— | M] (Huawei Technologies Co., Ltd.) - F:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2008/09/03 10:07:56 | 00,000,047 | R— | M] () - F:\AUTORUN.INF – [ CDFS ]
O32 - AutoRun File - [2002/10/17 09:56:50 | 00,000,036 | RH– | M] () - G:\AUTORUN.INF – [ FAT32 ]
O32 - AutoRun File - [2003/03/21 12:00:56 | 00,000,000 | RH-D | M] - G:\AUTORUN – [ FAT32 ]
O33 - MountPoints2\{0d113f06-f19e-11dd-a448-0007e9964637}\Shell - "" = AutoRun
O33 - MountPoints2\{0d113f06-f19e-11dd-a448-0007e9964637}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0d113f06-f19e-11dd-a448-0007e9964637}\Shell\AutoRun\command - "" = E:\AutoRun.exe – File not found
O33 - MountPoints2\{f8c22236-fbd4-11dd-9d9c-0007e9964637}\Shell - "" = AutoRun
O33 - MountPoints2\{f8c22236-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f8c22236-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun\command - "" = E:\AutoRun.exe – File not found
O33 - MountPoints2\{f8c2223a-fbd4-11dd-9d9c-0007e9964637}\Shell - "" = AutoRun
O33 - MountPoints2\{f8c2223a-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f8c2223a-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun\command - "" = E:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/06/26 10:00:10 | 00,286,208 | —- | C] () – C:\Documents and Settings\OEM\Desktop\gmer.exe
[2009/06/26 09:49:33 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Desktop\gmer
[2009/06/26 09:46:27 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\OEM\Desktop\OTL.exe
[2009/06/26 09:45:34 | 00,278,221 | —- | C] () – C:\Documents and Settings\OEM\Desktop\gmer.zip
[2009/06/26 06:09:01 | 00,359,893 | —- | C] () – C:\Documents and Settings\OEM\Desktop\dds.scr
[2009/06/25 12:56:27 | 00,001,734 | —- | C] () – C:\Documents and Settings\OEM\Desktop\HijackThis.lnk
[2009/06/25 12:56:27 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/06/25 12:45:27 | 00,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\OEM\Desktop\vir_HJTInstall.exe
[2009/06/25 12:24:11 | 00,000,650 | —- | C] () – C:\Documents and Settings\OEM\Desktop\del_Hijackthis.lnk
[2009/06/25 12:24:11 | 00,000,000 | —D | C] – C:\Program Files\Hijackthis
[2009/06/25 11:40:30 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/06/25 11:38:36 | 00,000,611 | —- | C] () – C:\Documents and Settings\OEM\Desktop\NTREGOPT.lnk
[2009/06/25 11:38:36 | 00,000,592 | —- | C] () – C:\Documents and Settings\OEM\Desktop\ERUNT.lnk
[2009/06/25 11:38:35 | 00,000,000 | —D | C] – C:\Program Files\ERUNT
[2009/06/25 11:32:17 | 00,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\OEM\Desktop\erunt_setup.exe
[2009/06/25 11:21:18 | 00,488,144 | —- | C] (Soeperman Enterprises Ltd ) – C:\Documents and Settings\OEM\Desktop\del_HJTsetup.exe
[2009/06/24 20:07:56 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations
[2009/06/24 16:40:43 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Desktop\Amy-Lee
[2009/06/24 09:45:51 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Application Data\Malwarebytes
[2009/06/24 09:15:06 | 00,000,740 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/24 09:15:03 | 00,038,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/06/24 09:15:01 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/06/24 09:15:01 | 00,000,000 | —D | C] – C:\Program Files\VIR_Malwarebytes' Anti-Malware
[2009/06/24 09:15:01 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/06/23 15:27:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/06/22 10:39:25 | 00,292,368 | —- | C] () – C:\WINDOWS\delsysguard.exe
[2009/06/15 09:57:55 | 00,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpshims.dll
[2009/06/15 09:57:54 | 00,246,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieproxy.dll
[2009/06/15 09:57:46 | 00,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2009/06/15 09:57:09 | 00,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iecompat.dll
[2009/06/15 09:53:44 | 00,000,000 | —D | C] – C:\WINDOWS\ie8
[2009/06/11 09:40:59 | 00,002,008 | —- | C] () – C:\Documents and Settings\OEM\Desktop\WD Spindown or Stop Utility.lnk
[2009/06/11 09:40:59 | 00,000,000 | —D | C] – C:\Program Files\Western Digital Technologies
[2009/06/11 09:39:07 | 00,000,000 | —D | C] – C:\Program Files\Western Digital Corporation
[2009/06/11 08:31:15 | 00,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2009/06/09 11:17:59 | 00,000,000 | —D | C] – C:\WINDOWS\PIF
[2009/06/09 11:17:23 | 00,000,000 | —D | C] – C:\xxSYND
[2009/06/09 11:11:29 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Analog Devices
[2009/06/09 11:11:14 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\My Documents\Analog Devices
[2009/06/09 09:44:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Soundmax
[2009/06/09 09:44:14 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\My Documents\Soundmax
[2009/06/04 16:33:54 | 00,000,000 | —D | C] – C:\Program Files\VDMSound
[2009/06/04 09:07:49 | 00,000,000 | —D | C] – C:\xxULTIMA8
[2009/06/04 08:46:27 | 00,000,000 | —D | C] – C:\xxxULTIMA8
[2009/05/31 17:04:01 | 00,000,750 | —- | C] () – C:\Documents and Settings\All Users\Desktop\D-Fend Reloaded.lnk
[2009/05/31 17:03:26 | 00,000,000 | —D | C] – C:\Program Files\D-Fend Reloaded
[2009/05/31 16:25:38 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Local Settings\Application Data\DOSBox
[2009/05/31 16:19:43 | 00,001,561 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DOSBox 0.73.lnk
[2009/05/31 16:19:40 | 00,000,000 | —D | C] – C:\Program Files\DOSBox-0.73
[2009/05/28 20:40:13 | 00,001,836 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/05/28 20:37:14 | 00,000,876 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009/02/20 17:48:44 | 00,000,083 | —- | C] () – C:\WINDOWS\BRGHTSTR.INI
[2008/12/31 17:04:42 | 00,691,560 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2008/11/07 02:37:32 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/11/07 02:34:00 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/11/07 02:34:00 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/11/07 02:33:02 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/09/07 16:30:09 | 00,014,381 | —- | C] () – C:\WINDOWS\Tw533a.ini
[2008/09/07 16:30:09 | 00,002,068 | —- | C] () – C:\WINDOWS\Ca533a.ini
[2008/09/07 16:30:09 | 00,000,163 | —- | C] () – C:\WINDOWS\Setup533.ini
[2007/10/21 14:21:26 | 00,077,824 | —- | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2007/10/21 14:20:51 | 00,000,161 | —- | C] () – C:\WINDOWS\System32\AddPort.ini
[2007/10/21 14:20:12 | 00,000,735 | —- | C] () – C:\WINDOWS\hpntwksetup.ini
[2007/02/12 15:09:23 | 00,000,218 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2006/10/23 09:36:46 | 00,000,076 | —- | C] () – C:\WINDOWS\eregreg.ini
[2006/10/23 09:33:00 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\IFORCE.DLL
[2006/08/08 17:20:12 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/07/17 09:24:07 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/07/12 15:48:53 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2004/08/04 22:00:00 | 00,000,664 | —- | C] () – C:\WINDOWS\win.ini
[2004/08/04 22:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2003/01/07 13:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/07 00:00:00 | 00,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1999/01/27 10:39:06 | 00,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1997/06/13 04:56:08 | 00,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/06/26 10:04:33 | 00,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/06/26 10:03:25 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/06/26 09:46:32 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\OEM\Desktop\OTL.exe
[2009/06/26 09:45:34 | 00,278,221 | —- | M] () – C:\Documents and Settings\OEM\Desktop\gmer.zip
[2009/06/26 06:09:06 | 00,359,893 | —- | M] () – C:\Documents and Settings\OEM\Desktop\dds.scr
[2009/06/25 20:37:18 | 37,447,729 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/06/25 20:37:18 | 00,096,101 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/06/25 18:36:47 | 00,216,064 | —- | M] () – C:\Documents and Settings\OEM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/25 12:56:27 | 00,001,734 | —- | M] () – C:\Documents and Settings\OEM\Desktop\HijackThis.lnk
[2009/06/25 12:45:35 | 00,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\OEM\Desktop\vir_HJTInstall.exe
[2009/06/25 12:24:11 | 00,000,650 | —- | M] () – C:\Documents and Settings\OEM\Desktop\del_Hijackthis.lnk
[2009/06/25 11:38:36 | 00,000,611 | —- | M] () – C:\Documents and Settings\OEM\Desktop\NTREGOPT.lnk
[2009/06/25 11:38:36 | 00,000,592 | —- | M] () – C:\Documents and Settings\OEM\Desktop\ERUNT.lnk
[2009/06/25 11:32:24 | 00,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\OEM\Desktop\erunt_setup.exe
[2009/06/25 11:21:24 | 00,488,144 | —- | M] (Soeperman Enterprises Ltd ) – C:\Documents and Settings\OEM\Desktop\del_HJTsetup.exe
[2009/06/24 11:03:16 | 00,000,740 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/23 13:53:10 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/06/22 14:40:38 | 02,108,254 | -H– | M] () – C:\Documents and Settings\OEM\Local Settings\Application Data\IconCache.db
[2009/06/22 10:39:09 | 00,292,368 | —- | M] () – C:\WINDOWS\delsysguard.exe
[2009/06/17 11:27:56 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/06/17 11:27:44 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/06/15 10:15:44 | 00,130,888 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/15 10:09:45 | 00,000,664 | —- | M] () – C:\WINDOWS\win.ini
[2009/06/15 10:02:04 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/06/11 09:40:59 | 00,002,008 | —- | M] () – C:\Documents and Settings\OEM\Desktop\WD Spindown or Stop Utility.lnk
[2009/06/01 09:51:14 | 23,635,392 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/05/31 17:04:01 | 00,000,750 | —- | M] () – C:\Documents and Settings\All Users\Desktop\D-Fend Reloaded.lnk
[2009/05/31 16:19:43 | 00,001,561 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DOSBox 0.73.lnk
[2009/05/28 20:40:13 | 00,001,836 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/05/28 20:37:14 | 00,000,876 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job

========== LOP Check ==========

[2009/06/24 16:21:51 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2009/03/31 16:01:43 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2009/02/04 11:03:20 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2009/03/31 16:02:33 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2009/06/26 09:50:31 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/12/02 13:54:20 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2006/08/13 15:09:23 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
[2009/06/24 09:45:51 | 00,000,000 | RH-D | M] – C:\Documents and Settings\OEM\Application Data
[2008/06/01 15:37:55 | 00,000,000 | —D | M] – C:\Documents and Settings\OEM\Application Data\AVGTOOLBAR
[2007/12/02 13:54:45 | 00,000,000 | —D | M] – C:\Documents and Settings\OEM\Application Data\TuneUp Software
[2009/02/27 17:15:00 | 00,000,386 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2004/08/04 22:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/05/28 20:37:14 | 00,000,876 | —- | M] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
[2009/03/02 10:47:47 | 00,000,264 | —- | M] () – C:\WINDOWS\Tasks\OGADaily.job
[2009/03/02 11:38:36 | 00,000,264 | —- | M] () – C:\WINDOWS\Tasks\OGALogon.job
[2009/03/02 13:00:50 | 00,000,006 | —- | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B4BB726
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A9662AE0
< End of report >

OTL Extras logfile created on: 6/26/2009 10:25:32 AM - Run 1
OTL by OldTimer - Version 3.0.5.3 Folder = C:\Documents and Settings\OEM\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

759.48 Mb Total Physical Memory | 454.36 Mb Available Physical Memory | 59.82% Memory free
1.06 Gb Paging File | 0.79 Gb Available in Paging File | 74.05% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 5.74 Gb Free Space | 15.42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 23.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 596.02 Gb Total Space | 531.21 Gb Free Space | 89.13% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LOUIETHEFLY
Current User Name: OEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – C:\WINDOWS\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.reg [@ = regfile] – regedit.exe "%1"

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"514:UDP" = 514:UDP:192.168.1.1/255.255.255.255:Enabled:dsl_log

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) File not found
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 (Microsoft Corporation)
C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Files and Settings Transfer Wizard (Microsoft Corporation)
C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation)
C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire (Lime Wire, LLC)
C:\Games\Descent3\MAIN.EXE:*:Enabled:MAIN ()
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Sierra\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth ()
C:\Program Files\Motorola\Software Update\msu.exe:*:Enabled:msu File not found
C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 (Microsoft Corporation)
C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) (Microsoft Corporation)
D:\setup\HPZNET01.EXE:*:Enabled:hpznet01.exe File not found
D:\setup\HPONICIFS01.EXE:*:Enabled:hponicifs01.exe File not found
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe ()
C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe (Hewlett-Packard)
C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe (Hewlett-Packard)
C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe (Hewlett-Packard)
C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe ( )
C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe (Hewlett-Packard Development Company, L.P.)
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe (Hewlett-Packard Development Company, L.P.)
C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console (Microsoft Corporation)
C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe (AVG Technologies CZ, s.r.o.)
C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe (AVG Technologies CZ, s.r.o.)
C:\Program Files\DAP\DAP.exe:*:Enabled:Download Accelerator Plus (DAP) (Speedbit Ltd.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow
"{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig
"{1A9DEF19-760C-4e01-958F-D9B8E6C61B90}" = c5100_Help
"{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}" = Windows Live Sign-in Assistant
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{25F6C900-C138-4888-A56C-91D3D063023A}" = HP Update
"{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone
"{3E5CBADD-2E51-47C1-BBE2-B802DB6DA56A}" = LatitudeFX MT4 4.00
"{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder
"{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy
"{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7646-A70000000000}" = Adobe Reader 7.0
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B148AB4B-C8FA-474B-B981-F2943C5B5BCD}" = OGA Notifier 1.7.0105.35.0
"{B2157760-AA3C-4E2E-BFE6-D20BC52495D9}" = cp_PosterPrintConfig
"{B3B9BC18-2A09-4728-9B46-12E85FF3F628}" = C5100
"{B6286A44-7505-471A-A72B-04EC2DB2F442}" = CueTour
"{B69CFE29-FD03-4E0A-87A7-6ED97F98E5B3}" = CP_Panorama1Config
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{BE6F412F-C276-4FD8-B3E1-F996CC172776}" = WD Spindown or Stop Utility for External Drive, v1.00
"{C1C6767D-B395-43CB-BF99-051B58B86DA6}" = PhotoGallery
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC016F21-3970-11DE-B878-005056806466}" = Google Earth
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{E40CE517-0D42-4198-96B4-C8232B257EB5}" = Data Lifeguard Diagnostic for Windows
"{ED2C557E-9C18-41FF-B58E-A05EEF0B3B5F}" = CP_CalendarTemplates1
"{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"{FE7E1DD7-EBCE-4696-ADE2-22BDBF2372DA}" = DocumentViewer
"3 MobileBroadband" = 3 MobileBroadband
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AVG8Uninstall" = AVG Free 8.5
"D'Accord Personal Guitarist 1.2_is1" = D'Accord Personal Guitarist 1.2
"Descent2DeinstKey" = DESCENT II
"Descent3" = Descent 3
"Descent3 Mercenary" = Descent 3: Mercenary
"D-Fend Reloaded" = D-Fend Reloaded 0.7.0 (deinstall)
"Digital Camera" = Digital Camera
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"ERUNT_is1" = ERUNT 1.1j
"HijackThis" = HijackThis 2.0.2
"Hijackthis_is1" = Hijackthis 1.99.1
"HP Document Viewer" = HP Document Viewer 7.0
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Photo & Imaging" = HP Photosmart Premier Software 6.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPOCR" = OCR Software by I.R.I.S 7.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"Kiwi Syslog Daemon" = Kiwi Syslog Daemon 8.2.18 (Service Edition)
"LimeWire" = LimeWire PRO 4.9.23
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel® PRO Network Adapters and Drivers
"VMidi" = vanBasco's Karaoke Player
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"OpenOffice.org 1.1.0" = OpenOffice.org 1.1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/23/2009 8:28:13 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\a716119.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 8:28:13 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\a716119.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 8:28:13 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\a716154.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 8:28:13 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\a716154.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 8:28:15 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\78b6796.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 8:28:15 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\78b6796.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 8:28:15 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\a71613c.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 8:28:15 AM | Computer Name = LOUIETHEFLY | Source = MsiInstaller | ID = 1008
Description = The installation of C:\WINDOWS\Installer\a71613c.msi is not permitted
due to an error in software restriction policy processing. The object cannot be
trusted.

Error - 6/23/2009 10:41:18 PM | Computer Name = LOUIETHEFLY | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 6/23/2009 10:41:19 PM | Computer Name = LOUIETHEFLY | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

[ System Events ]
Error - 6/24/2009 4:26:27 AM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD AvgLdx86 AvgMfx86 AvgTdiX Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss Tcpip

Error - 6/24/2009 4:35:56 AM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7001
Description = The DHCP Client service depends on the NetBios over Tcpip service
which failed to start because of the following error: %%31

Error - 6/24/2009 4:35:56 AM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 6/24/2009 4:35:56 AM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD AvgLdx86 AvgMfx86 AvgTdiX Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss Tcpip

Error - 6/24/2009 5:03:47 AM | Computer Name = LOUIETHEFLY | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring
the volume.

Error - 6/24/2009 5:38:45 AM | Computer Name = LOUIETHEFLY | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring
the volume.

Error - 6/25/2009 4:16:35 PM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7034
Description = The AVG8 E-mail Scanner service terminated unexpectedly. It has done
this 1 time(s).

Error - 6/25/2009 7:56:32 PM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7001
Description = The DHCP Client service depends on the NetBios over Tcpip service
which failed to start because of the following error: %%31

Error - 6/25/2009 7:56:32 PM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 6/25/2009 7:56:32 PM | Computer Name = LOUIETHEFLY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD AvgLdx86 AvgMfx86 AvgTdiX Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss Tcpip

< End of report >

CatByte

Post #6June 26, 2009, 1:37 AM UTC

Hi,

Please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
[2009/06/22 10:39:25 | 00,292,368 | —- | C] () – C:\WINDOWS\delsysguard.exe
[2009/06/22 10:39:09 | 00,292,368 | —- | M] () – C:\WINDOWS\delsysguard.exe

:Commands
[resethosts]
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

NEXT

Try running the GMER program again: try renaming to gmer.com if it will not run

spinach1

Post #7June 26, 2009, 3:44 AM UTC

Ok, ran OTL fix as instructed and rebooted, reran OTL scan, results below, GMER failed so renamed and ran as .com. GMER did not complete its scan, windows stopped it and produced an error report to send which I fired up the connection and sent.

I grabbed a copy of the error generated text file and copied as much of the GMER as was produced before it closed, find these also below, sheesh……….

This to microsoft…

OTL logfile created on: 6/26/2009 12:35:18 PM - Run 2
OTL by OldTimer - Version 3.0.5.3 Folder = C:\Documents and Settings\OEM\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

759.48 Mb Total Physical Memory | 457.36 Mb Available Physical Memory | 60.22% Memory free
1.06 Gb Paging File | 0.79 Gb Available in Paging File | 74.34% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 6.41 Gb Free Space | 17.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 23.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 596.02 Gb Total Space | 531.21 Gb Free Space | 89.13% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LOUIETHEFLY
Current User Name: OEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\System32\HPZipm12.exe (HP)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\Iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe (Western Digital Technologies, Inc.)
PRC - C:\Program Files\Internet Explorer\Iexplore.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\OEM\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Auto | Running]) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (gupdate1c9df80439b86a6 [On_Demand | Stopped]) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (helpsvc [On_Demand | Stopped]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (HP Port Resolver [On_Demand | Stopped]) – C:\WINDOWS\System32\spool\drivers\w32x86\3\HPBPRO.EXE (Hewlett-Packard Company)
SRV - (HP Status Server [On_Demand | Stopped]) – C:\WINDOWS\System32\spool\drivers\w32x86\3\HPBOID.EXE (Hewlett-Packard Company)
SRV - (Kiwi Syslog Daemon [Disabled | Stopped]) – c:\program files\syslogd\syslogd_service.exe (Kiwi Enterprises)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [Unknown | Running]) – C:\WINDOWS\System32\HPZipm12.exe (HP)
SRV - (usnjsvc [On_Demand | Stopped]) – C:\Program Files\MSN Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (UxTuneUp [Disabled | Stopped]) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)

========== Driver Services (SafeList) ==========

DRV - (ac97intc [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\ac97intc.sys (Intel Corporation)
DRV - (aeaudio [On_Demand | Running]) – C:\WINDOWS\System32\drivers\aeaudio.sys (Andrea Electronics Corporation)
DRV - (AvgLdx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (E100B [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (FINEPIX_PCC [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\V4CB012D.SYS (FUJI PHOTO FILM CO.,LTD.)
DRV - (gameenum [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (hwdatacard [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (MotDev [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motodrv.sys (Motorola Inc)
DRV - (motmodem [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\motmodem.sys (Motorola)
DRV - (ms_mpu401 [On_Demand | Running]) – C:\WINDOWS\System32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (NwlnkIpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (PhilCam8116_XP [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\CamDrL20.sys (Logitech Inc.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (smwdm [On_Demand | Running]) – C:\WINDOWS\System32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (StillCam [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\serscan.sys (Microsoft Corporation)
DRV - (usbaudio [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.xtramsn.co.nz/0SEENNZ/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.nzcity.co.nz/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,AutoSearch = http://ie.search.msn.com/{SUB_RFC1766}/src…autosearch.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (56 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [WD Spindown Utility] C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe (Western Digital Technologies, Inc.)
O4 - HKCU..\Run: [Mobile Partner] C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm ()
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm ()
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdat…b?1235938159906 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1235938137750 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} http://www.intel.com/design/motherbd/boardid/BoardID.cab (BoardCtl Class)
O16 - DPF: {EA1B8527-E422-4909-825A-70BE0694F18E} https://online.westpac.com.au/wtoa/wtOtherA…iomanagerwt.cab (PortfolioManagerWT ProfileManager Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - File not found
O20 - HKLM Winlogon: UIHost - (logonui.exe) - File not found
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - File not found
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - File not found
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - File not found
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - File not found
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - File not found
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - File not found
O29 - HKLM SecurityProviders - (msapsspc.dll) - File not found
O29 - HKLM SecurityProviders - (schannel.dll) - File not found
O29 - HKLM SecurityProviders - (digest.dll) - File not found
O29 - HKLM SecurityProviders - (msnsspc.dll) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/07/12 15:38:49 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2008/09/03 10:07:56 | 00,114,688 | R— | M] (Huawei Technologies Co., Ltd.) - F:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2008/09/03 10:07:56 | 00,000,047 | R— | M] () - F:\AUTORUN.INF – [ CDFS ]
O32 - AutoRun File - [2002/10/17 09:56:50 | 00,000,036 | RH– | M] () - G:\AUTORUN.INF – [ FAT32 ]
O32 - AutoRun File - [2003/03/21 12:00:56 | 00,000,000 | RH-D | M] - G:\AUTORUN – [ FAT32 ]
O33 - MountPoints2\{0d113f06-f19e-11dd-a448-0007e9964637}\Shell - "" = AutoRun
O33 - MountPoints2\{0d113f06-f19e-11dd-a448-0007e9964637}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0d113f06-f19e-11dd-a448-0007e9964637}\Shell\AutoRun\command - "" = E:\AutoRun.exe – File not found
O33 - MountPoints2\{f8c22236-fbd4-11dd-9d9c-0007e9964637}\Shell - "" = AutoRun
O33 - MountPoints2\{f8c22236-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f8c22236-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun\command - "" = E:\AutoRun.exe – File not found
O33 - MountPoints2\{f8c2223a-fbd4-11dd-9d9c-0007e9964637}\Shell - "" = AutoRun
O33 - MountPoints2\{f8c2223a-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f8c2223a-fbd4-11dd-9d9c-0007e9964637}\Shell\AutoRun\command - "" = E:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/06/26 12:06:14 | 00,000,000 | —D | C] – C:\_OTL
[2009/06/26 10:00:10 | 00,286,208 | —- | C] () – C:\Documents and Settings\OEM\Desktop\gmer.exe
[2009/06/26 09:49:33 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Desktop\gmer
[2009/06/26 09:46:27 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\OEM\Desktop\OTL.exe
[2009/06/26 09:45:34 | 00,278,221 | —- | C] () – C:\Documents and Settings\OEM\Desktop\gmer.zip
[2009/06/26 06:09:01 | 00,359,893 | —- | C] () – C:\Documents and Settings\OEM\Desktop\dds.scr
[2009/06/25 12:56:27 | 00,001,734 | —- | C] () – C:\Documents and Settings\OEM\Desktop\HijackThis.lnk
[2009/06/25 12:56:27 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/06/25 12:45:27 | 00,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\OEM\Desktop\vir_HJTInstall.exe
[2009/06/25 12:24:11 | 00,000,650 | —- | C] () – C:\Documents and Settings\OEM\Desktop\del_Hijackthis.lnk
[2009/06/25 12:24:11 | 00,000,000 | —D | C] – C:\Program Files\Hijackthis
[2009/06/25 11:40:30 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/06/25 11:38:36 | 00,000,611 | —- | C] () – C:\Documents and Settings\OEM\Desktop\NTREGOPT.lnk
[2009/06/25 11:38:36 | 00,000,592 | —- | C] () – C:\Documents and Settings\OEM\Desktop\ERUNT.lnk
[2009/06/25 11:38:35 | 00,000,000 | —D | C] – C:\Program Files\ERUNT
[2009/06/25 11:32:17 | 00,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\OEM\Desktop\erunt_setup.exe
[2009/06/25 11:21:18 | 00,488,144 | —- | C] (Soeperman Enterprises Ltd ) – C:\Documents and Settings\OEM\Desktop\del_HJTsetup.exe
[2009/06/24 20:07:56 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations
[2009/06/24 16:40:43 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Desktop\Amy-Lee
[2009/06/24 09:45:51 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Application Data\Malwarebytes
[2009/06/24 09:15:06 | 00,000,740 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/24 09:15:03 | 00,038,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/06/24 09:15:01 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/06/24 09:15:01 | 00,000,000 | —D | C] – C:\Program Files\VIR_Malwarebytes' Anti-Malware
[2009/06/24 09:15:01 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/06/23 15:27:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/06/15 09:57:55 | 00,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpshims.dll
[2009/06/15 09:57:54 | 00,246,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieproxy.dll
[2009/06/15 09:57:46 | 00,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2009/06/15 09:57:09 | 00,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iecompat.dll
[2009/06/15 09:53:44 | 00,000,000 | —D | C] – C:\WINDOWS\ie8
[2009/06/11 09:40:59 | 00,002,008 | —- | C] () – C:\Documents and Settings\OEM\Desktop\WD Spindown or Stop Utility.lnk
[2009/06/11 09:40:59 | 00,000,000 | —D | C] – C:\Program Files\Western Digital Technologies
[2009/06/11 09:39:07 | 00,000,000 | —D | C] – C:\Program Files\Western Digital Corporation
[2009/06/11 08:31:15 | 00,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2009/06/09 11:17:59 | 00,000,000 | —D | C] – C:\WINDOWS\PIF
[2009/06/09 11:17:23 | 00,000,000 | —D | C] – C:\xxSYND
[2009/06/09 11:11:29 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Analog Devices
[2009/06/09 11:11:14 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\My Documents\Analog Devices
[2009/06/09 09:44:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Soundmax
[2009/06/09 09:44:14 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\My Documents\Soundmax
[2009/06/04 16:33:54 | 00,000,000 | —D | C] – C:\Program Files\VDMSound
[2009/06/04 09:07:49 | 00,000,000 | —D | C] – C:\xxULTIMA8
[2009/06/04 08:46:27 | 00,000,000 | —D | C] – C:\xxxULTIMA8
[2009/05/31 17:04:01 | 00,000,750 | —- | C] () – C:\Documents and Settings\All Users\Desktop\D-Fend Reloaded.lnk
[2009/05/31 17:03:26 | 00,000,000 | —D | C] – C:\Program Files\D-Fend Reloaded
[2009/05/31 16:25:38 | 00,000,000 | —D | C] – C:\Documents and Settings\OEM\Local Settings\Application Data\DOSBox
[2009/05/31 16:19:43 | 00,001,561 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DOSBox 0.73.lnk
[2009/05/31 16:19:40 | 00,000,000 | —D | C] – C:\Program Files\DOSBox-0.73
[2009/05/28 20:40:13 | 00,001,836 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/05/28 20:37:14 | 00,000,876 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009/02/20 17:48:44 | 00,000,083 | —- | C] () – C:\WINDOWS\BRGHTSTR.INI
[2008/12/31 17:04:42 | 00,691,560 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2008/11/07 02:37:32 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/11/07 02:34:00 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/11/07 02:34:00 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/11/07 02:33:02 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/09/07 16:30:09 | 00,014,381 | —- | C] () – C:\WINDOWS\Tw533a.ini
[2008/09/07 16:30:09 | 00,002,068 | —- | C] () – C:\WINDOWS\Ca533a.ini
[2008/09/07 16:30:09 | 00,000,163 | —- | C] () – C:\WINDOWS\Setup533.ini
[2007/10/21 14:21:26 | 00,077,824 | —- | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2007/10/21 14:20:51 | 00,000,161 | —- | C] () – C:\WINDOWS\System32\AddPort.ini
[2007/10/21 14:20:12 | 00,000,735 | —- | C] () – C:\WINDOWS\hpntwksetup.ini
[2007/02/12 15:09:23 | 00,000,218 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2006/10/23 09:36:46 | 00,000,076 | —- | C] () – C:\WINDOWS\eregreg.ini
[2006/10/23 09:33:00 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\IFORCE.DLL
[2006/08/08 17:20:12 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/07/17 09:24:07 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/07/12 15:48:53 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2004/08/04 22:00:00 | 00,000,664 | —- | C] () – C:\WINDOWS\win.ini
[2004/08/04 22:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2003/01/07 13:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/07 00:00:00 | 00,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1999/01/27 10:39:06 | 00,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1997/06/13 04:56:08 | 00,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/06/26 12:32:58 | 00,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/06/26 12:32:01 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/06/26 09:46:32 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\OEM\Desktop\OTL.exe
[2009/06/26 09:45:34 | 00,278,221 | —- | M] () – C:\Documents and Settings\OEM\Desktop\gmer.zip
[2009/06/26 06:09:06 | 00,359,893 | —- | M] () – C:\Documents and Settings\OEM\Desktop\dds.scr
[2009/06/25 20:37:18 | 37,447,729 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/06/25 20:37:18 | 00,096,101 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/06/25 18:36:47 | 00,216,064 | —- | M] () – C:\Documents and Settings\OEM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/25 12:56:27 | 00,001,734 | —- | M] () – C:\Documents and Settings\OEM\Desktop\HijackThis.lnk
[2009/06/25 12:45:35 | 00,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\OEM\Desktop\vir_HJTInstall.exe
[2009/06/25 12:24:11 | 00,000,650 | —- | M] () – C:\Documents and Settings\OEM\Desktop\del_Hijackthis.lnk
[2009/06/25 11:38:36 | 00,000,611 | —- | M] () – C:\Documents and Settings\OEM\Desktop\NTREGOPT.lnk
[2009/06/25 11:38:36 | 00,000,592 | —- | M] () – C:\Documents and Settings\OEM\Desktop\ERUNT.lnk
[2009/06/25 11:32:24 | 00,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\OEM\Desktop\erunt_setup.exe
[2009/06/25 11:21:24 | 00,488,144 | —- | M] (Soeperman Enterprises Ltd ) – C:\Documents and Settings\OEM\Desktop\del_HJTsetup.exe
[2009/06/24 11:03:16 | 00,000,740 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/23 13:53:10 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/06/22 14:40:38 | 02,108,254 | -H– | M] () – C:\Documents and Settings\OEM\Local Settings\Application Data\IconCache.db
[2009/06/17 11:27:56 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/06/17 11:27:44 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/06/15 10:15:44 | 00,130,888 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/15 10:09:45 | 00,000,664 | —- | M] () – C:\WINDOWS\win.ini
[2009/06/15 10:02:04 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/06/11 09:40:59 | 00,002,008 | —- | M] () – C:\Documents and Settings\OEM\Desktop\WD Spindown or Stop Utility.lnk
[2009/06/01 09:51:14 | 23,635,392 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/05/31 17:04:01 | 00,000,750 | —- | M] () – C:\Documents and Settings\All Users\Desktop\D-Fend Reloaded.lnk
[2009/05/31 16:19:43 | 00,001,561 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DOSBox 0.73.lnk
[2009/05/28 20:40:13 | 00,001,836 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/05/28 20:37:14 | 00,000,876 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job

========== Alternate Data Streams ==========

@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B4BB726
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A9662AE0
< End of report >

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-26 13:26:48
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

Code 82E738E0 ZwEnumerateKey
Code 82D91950 ZwFlushInstructionCache
Code 82C36E56 IofCallDriver
Code 82FE5D96 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!IofCallDriver 804E37C5 5 Bytes JMP 82C36E5B
.text ntoskrnl.exe!IofCompleteRequest 804E3BF6 5 Bytes JMP 82FE5D9B
PAGE ntoskrnl.exe!ZwEnumerateKey 80570D64 5 Bytes JMP 82E738E4
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80577693 5 Bytes JMP 82D91954

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\AVG\AVG8\avgcsrvx.exe[336] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 009E000A
.text C:\Program Files\AVG\AVG8\avgcsrvx.exe[336] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 009F000A
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[436] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00BD000A
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[436] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00BE000A
.text C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe[476] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 009B000A
.text C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe[476] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 009C000A
.text C:\WINDOWS\System32\alg.exe[536] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 006F000A
.text C:\WINDOWS\System32\alg.exe[536] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0070000A
.text C:\WINDOWS\system32\winlogon.exe[668] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\winlogon.exe[668] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\services.exe[716] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\services.exe[716] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\lsass.exe[728] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 006F000A
.text C:\WINDOWS\system32\lsass.exe[728] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0072000A
.text C:\WINDOWS\system32\spoolsv.exe[1344] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0097000A
.text C:\WINDOWS\system32\spoolsv.exe[1344] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0098000A
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[1484] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0070000A
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[1484] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0071000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A0000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00A1000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED2C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E40B6CB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E40B5FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E40B668 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E40B4CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E40B530 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E40B72E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E40B592 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WININET.dll!HttpAddRequestHeadersA 3D94D02E 5 Bytes JMP 00DE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WININET.dll!HttpAddRequestHeadersW 3D94FF29 5 Bytes JMP 00EF000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00F0F9F0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F10A60 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00F108A0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F10780 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00F0FDA0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[1532] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F0FFD0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\WINDOWS\Explorer.EXE[1544] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00C0000A
.text C:\WINDOWS\Explorer.EXE[1544] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00C1000A
.text C:\WINDOWS\system32\HPZipm12.exe[1604] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 006B000A
.text C:\WINDOWS\system32\HPZipm12.exe[1604] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 006C000A
.text C:\Documents and Settings\OEM\Desktop\gmer.com[1760] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 009E000A
.text C:\Documents and Settings\OEM\Desktop\gmer.com[1760] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 009F000A
.text C:\PROGRA~1\AVG\AVG8\avgemc.exe[1884] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A3000A
.text C:\PROGRA~1\AVG\AVG8\avgemc.exe[1884] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00A4000A
.text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[1916] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0073000A
.text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[1916] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0074000A
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[1924] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0075000A
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[1924] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0076000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A0000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00A1000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9261 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DC8A9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED2C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254254 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E40B6CB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E40B5FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E40B668 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E40B4CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E40B530 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E40B72E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E40B592 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED320 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WININET.dll!HttpAddRequestHeadersA 3D94D02E 5 Bytes JMP 00DE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WININET.dll!HttpAddRequestHeadersW 3D94FF29 5 Bytes JMP 00EF000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00F0F9F0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F10A60 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00F108A0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F10780 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00F0FDA0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2072] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F0FFD0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Program Files\Internet Explorer\Iexplore.exe[2072] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1A7B] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [924] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1204] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [1532] 0x00F00000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1664] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1692] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [2072] 0x00F00000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\UACkllrwldksixdulkya.sys (*** hidden *** ) [SYSTEM] UACd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACvholwerrnrwowilte.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACpyrscdjfwtowrtexw.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACkcjgsxjkqpjlxfswr.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACqxgvxdtypejufvrov.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACmyqthnmxyquphxpjc.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACaccyftfbrtmgfjxcb.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACgvamvmckdbokqaskm.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACmctbvrqmqcvbnhpfb.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACvholwerrnrwowilte.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACpyrscdjfwtowrtexw.dat
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACkcjgsxjkqpjlxfswr.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACqxgvxdtypejufvrov.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACmyqthnmxyquphxpjc.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACaccyftfbrtmgfjxcb.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACgvamvmckdbokqaskm.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACmctbvrqmqcvbnhpfb.log

—- Files - GMER 1.0.15 —-

File C:\Documents and Settings\OEM\Desktop\uac9.tmp 0 bytes
File C:\Documents and Settings\OEM\Desktop\uacinit_dll left after malwarebytes.mht 574790 bytes
File C:\Documents and Settings\OEM\Favorites\uacinit.dll left after malwarebytes.url 331 bytes
File C:\Documents and Settings\OEM\Local Settings\Temp\UAC73a8.tmp 343040 bytes executable
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\0Z52IRBO\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\0Z52IRBO\uacinit_dll_left_after_malwarebytes_t104510[1].html 92504 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[1].html 65791 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[1].html 92503 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[2].html 65793 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\8YPIT4UL\uacinit_dll_left_after_malwarebytes_t104510[1].html 65792 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\CGC7V9JT\uac.dll[1].htm 16533 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\ENRDLJVA\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\ENRDLJVA\uacinit_dll_left_after_malwarebytes_t104510[1].html&gopid=571950 169586 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\ENRDLJVA\uacinit_dll_removal_help_t103851[1].html 175851 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\G2F6L1WH\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\G2F6L1WH\uacinit_dll_left_after_malwarebytes_t104510[1].html 65792 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\G2F6L1WH\uacinit_dll_left_after_malwarebytes_t104510[1].html 77789 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_left_after_malwarebytes_t104510[1].html&gopid=571950 177945 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_Please_help_remove_malicous_malware_t103853[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_Please_help_remove_malicous_malware_t103853[1].html&gopid=567010 313854 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\RYN0TSGQ\uac.dll_data[1].xml 307 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\T4FMM6R5\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\T4FMM6R5\uacinit_dll_left_after_malwarebytes_t104510[1].html 65814 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\T4FMM6R5\uacinit_dll_left_after_malwarebytes_t104510[1].html&gopid=571877 84217 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TNRXMD15\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TNRXMD15\uacinit_dll_left_after_malwarebytes_t104510[1].html 65793 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TNRXMD15\uacinit_dll_left_after_malwarebytes_t104510[1].html 77789 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TR58XLT3\uacinit_dll_t104481[1].html 63561 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\U1FVBTMT\uacinit_dll_t104481[1].html 139203 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\UQD3XNX1\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\UQD3XNX1\uacinit_dll_left_after_malwarebytes_t104510[1].html 92503 bytes

spinach1

Post #8June 26, 2009, 7:10 AM UTC

Hiya, reading back I realized I had not followed the instructions for GMER scan so Ihave redone it and this time it completed, read on…………

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-26 17:05:06
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

Code 82E738E0 ZwEnumerateKey
Code 82D91950 ZwFlushInstructionCache
Code 82C36E56 IofCallDriver
Code 82FE5D96 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!IofCallDriver 804E37C5 5 Bytes JMP 82C36E5B
.text ntoskrnl.exe!IofCompleteRequest 804E3BF6 5 Bytes JMP 82FE5D9B
PAGE ntoskrnl.exe!ZwEnumerateKey 80570D64 5 Bytes JMP 82E738E4
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80577693 5 Bytes JMP 82D91954

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\AVG\AVG8\avgcsrvx.exe[336] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 009E000A
.text C:\Program Files\AVG\AVG8\avgcsrvx.exe[336] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 009F000A
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[436] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00BD000A
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[436] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00BE000A
.text C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe[476] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 009B000A
.text C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe[476] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 009C000A
.text C:\WINDOWS\System32\alg.exe[536] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 006F000A
.text C:\WINDOWS\System32\alg.exe[536] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0070000A
.text C:\WINDOWS\system32\winlogon.exe[668] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\winlogon.exe[668] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\services.exe[716] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\services.exe[716] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\lsass.exe[728] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 006F000A
.text C:\WINDOWS\system32\lsass.exe[728] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0072000A
.text C:\WINDOWS\system32\spoolsv.exe[1344] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0097000A
.text C:\WINDOWS\system32\spoolsv.exe[1344] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0098000A
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[1484] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0070000A
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[1484] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0071000A
.text C:\WINDOWS\Explorer.EXE[1544] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00C0000A
.text C:\WINDOWS\Explorer.EXE[1544] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00C1000A
.text C:\WINDOWS\system32\HPZipm12.exe[1604] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 006B000A
.text C:\WINDOWS\system32\HPZipm12.exe[1604] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 006C000A
.text C:\PROGRA~1\AVG\AVG8\avgemc.exe[1884] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A3000A
.text C:\PROGRA~1\AVG\AVG8\avgemc.exe[1884] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00A4000A
.text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[1916] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0073000A
.text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[1916] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0074000A
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[1924] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 0075000A
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[1924] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 0076000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A0000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00A1000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9261 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DC8A9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED2C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254254 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E40B6CB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E40B5FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E40B668 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E40B4CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E40B530 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E40B72E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E40B592 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED320 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WININET.dll!HttpAddRequestHeadersA 3D94D02E 5 Bytes JMP 00DE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WININET.dll!HttpAddRequestHeadersW 3D94FF29 5 Bytes JMP 00EF000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00F0F9F0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F10A60 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00F108A0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F10780 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00F0FDA0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2712] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F0FFD0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A0000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 00A1000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2151D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED2C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E40B6CB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E40B5FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E40B668 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E40B4CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E40B530 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E40B72E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E40B592 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WININET.dll!HttpAddRequestHeadersA 3D94D02E 5 Bytes JMP 00DE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WININET.dll!HttpAddRequestHeadersW 3D94FF29 5 Bytes JMP 00EF000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00F0F9F0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F10A60 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00F108A0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F10780 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00F0FDA0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2872] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F0FFD0 \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
.text C:\Documents and Settings\OEM\Desktop\gmer.com[3820] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 009E000A
.text C:\Documents and Settings\OEM\Desktop\gmer.com[3820] ntdll.dll!LdrUnloadDll 7C91738B 5 Bytes JMP 009F000A

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Program Files\Internet Explorer\Iexplore.exe[2712] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1A7B] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [924] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1204] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1664] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1692] 0x00A10000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [2712] 0x00F00000
Library \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [2872] 0x00F00000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\UACkllrwldksixdulkya.sys (*** hidden *** ) [SYSTEM] UACd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACvholwerrnrwowilte.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACpyrscdjfwtowrtexw.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACkcjgsxjkqpjlxfswr.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACqxgvxdtypejufvrov.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACmyqthnmxyquphxpjc.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACaccyftfbrtmgfjxcb.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACgvamvmckdbokqaskm.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACmctbvrqmqcvbnhpfb.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkllrwldksixdulkya.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACvholwerrnrwowilte.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACpyrscdjfwtowrtexw.dat
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACkcjgsxjkqpjlxfswr.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACqxgvxdtypejufvrov.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACmyqthnmxyquphxpjc.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACpuwmerqrkuqpvaqtt.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACaccyftfbrtmgfjxcb.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACgvamvmckdbokqaskm.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACmctbvrqmqcvbnhpfb.log

—- Files - GMER 1.0.15 —-

File C:\Documents and Settings\OEM\Desktop\uac9.tmp 0 bytes
File C:\Documents and Settings\OEM\Desktop\uacinit_dll left after malwarebytes.mht 574790 bytes
File C:\Documents and Settings\OEM\Favorites\uacinit.dll left after malwarebytes.url 331 bytes
File C:\Documents and Settings\OEM\Local Settings\Temp\UAC73a8.tmp 343040 bytes executable
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\0Z52IRBO\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\0Z52IRBO\uacinit_dll_left_after_malwarebytes_t104510[1].html 92504 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[1].html 65791 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[1].html 92503 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\29238OM9\uacinit_dll_left_after_malwarebytes_t104510[2].html 65793 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\652MV9NK\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\652MV9NK\uacinit_dll_left_after_malwarebytes_t104510[1].html 178029 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\8YPIT4UL\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\8YPIT4UL\uacinit_dll_left_after_malwarebytes_t104510[1].html 65792 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\8YPIT4UL\uacinit_dll_left_after_malwarebytes_t104510[1].html&gopid=572022 280064 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\CGC7V9JT\uac.dll[1].htm 16533 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\ENRDLJVA\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\ENRDLJVA\uacinit_dll_left_after_malwarebytes_t104510[1].html&gopid=571950 169586 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\ENRDLJVA\uacinit_dll_removal_help_t103851[1].html 175851 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\G2F6L1WH\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\G2F6L1WH\uacinit_dll_left_after_malwarebytes_t104510[1].html 65792 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\G2F6L1WH\uacinit_dll_left_after_malwarebytes_t104510[1].html 77789 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_left_after_malwarebytes_t104510[1].html&gopid=571950 177945 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_Please_help_remove_malicous_malware_t103853[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\KD8BTA75\uacinit_dll_Please_help_remove_malicous_malware_t103853[1].html&gopid=567010 313854 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\RYN0TSGQ\uac.dll_data[1].xml 307 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\T4FMM6R5\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\T4FMM6R5\uacinit_dll_left_after_malwarebytes_t104510[1].html 65814 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\T4FMM6R5\uacinit_dll_left_after_malwarebytes_t104510[1].html&gopid=571877 84217 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TNRXMD15\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TNRXMD15\uacinit_dll_left_after_malwarebytes_t104510[1].html 65793 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TNRXMD15\uacinit_dll_left_after_malwarebytes_t104510[1].html 77789 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\TR58XLT3\uacinit_dll_t104481[1].html 63561 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\U1FVBTMT\uacinit_dll_t104481[1].html 139203 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\UQD3XNX1\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\UQD3XNX1\uacinit_dll_left_after_malwarebytes_t104510[1].html 92503 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\WFMNMUM4\uacinit_dll_left_after_malwarebytes_t104510[1].htm 0 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\WFMNMUM4\uacinit_dll_left_after_malwarebytes_t104510[1].html 92506 bytes
File C:\Documents and Settings\OEM\Local Settings\Temporary Internet Files\Content.IE5\WFMNMUM4\update[1].gif 343 bytes
File C:\Documents and Settings\OEM\Recent\uacinit_dll left after malwarebytes.mht.lnk 638 bytes
File C:\WINDOWS\Prefetch\UACLAUNCHER.EXE-3B49C191.pf 17178 bytes
File C:\WINDOWS\system32\drivers\UACkllrwldksixdulkya.sys 51712 bytes executable <– ROOTKIT !!!
File C:\WINDOWS\system32\UACaccyftfbrtmgfjxcb.log 33666 bytes
File C:\WINDOWS\system32\uacinit.dll 6113 bytes
File C:\WINDOWS\system32\UACkcjgsxjkqpjlxfswr.dll 19968 bytes executable
File C:\WINDOWS\system32\UACmyqthnmxyquphxpjc.dll 19456 bytes executable
File C:\WINDOWS\system32\UACpuwmerqrkuqpvaqtt.dll 66560 bytes
File C:\WINDOWS\system32\UACpyrscdjfwtowrtexw.dat 224 bytes
File C:\WINDOWS\system32\UACqxgvxdtypejufvrov.dll 17408 bytes executable
File C:\WINDOWS\system32\UACvholwerrnrwowilte.dll 23552 bytes executable
File C:\WINDOWS\Temp\UAC8703.tmp 49152 bytes
File C:\WINDOWS\Temp\UACb80b.tmp 45056 bytes
File C:\WINDOWS\Temp\UACf898.tmp 66560 bytes

—- EOF - GMER 1.0.15 —-

CatByte

Post #9June 26, 2009, 9:11 AM UTC last edited June 26, 2009, 9:15 AM UTC

Hi,

Please do the following:

Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

———————————————————–
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  ———————————————————–
- Close any open browsers.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
———————————————————–
Go to Start then Run
Copy and paste the folowing command (with quotation marks) "%userprofile%/Desktop/Combo-Fix.exe" /killall
into the run box.
Press OK to start ComboFix
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

spinach1

Post #10June 26, 2009, 10:13 AM UTC

Alrighty then, that had a good crack at it, here's the results,

ComboFix 09-06-25.04 - OEM 06/26/2009 19:50.1 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: /killall
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\UACkllrwldksixdulkya.sys
c:\windows\system32\UACaccyftfbrtmgfjxcb.log
c:\windows\system32\UACgvamvmckdbokqaskm.log
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkcjgsxjkqpjlxfswr.dll
c:\windows\system32\UACmctbvrqmqcvbnhpfb.log
c:\windows\system32\UACmyqthnmxyquphxpjc.dll
c:\windows\system32\UACpuwmerqrkuqpvaqtt.dll
c:\windows\system32\UACpyrscdjfwtowrtexw.dat
c:\windows\system32\UACqxgvxdtypejufvrov.dll
c:\windows\system32\UACvholwerrnrwowilte.dll
G:\AUTORUN.INF

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 )))))))))))))))))))))))))))))))
.

2009-06-26 02:06 . 2009-06-26 02:06 ——– d—–w- C:\_OTL
2009-06-25 02:56 . 2009-06-25 02:56 ——– d—–w- c:\program files\Trend Micro
2009-06-25 01:38 . 2009-06-25 01:39 ——– d—–w- c:\program files\ERUNT
2009-06-24 10:07 . 2009-06-24 10:07 ——– d—–w- c:\documents and settings\OEM\Local Settings\Application Data\Downloaded Installations
2009-06-24 08:47 . 2009-06-24 08:47 ——– d-sh–w- c:\documents and settings\OEM\IECompatCache
2009-06-23 23:50 . 2009-06-23 23:50 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-06-23 23:45 . 2009-06-23 23:45 ——– d—–w- c:\documents and settings\OEM\Application Data\Malwarebytes
2009-06-23 23:15 . 2009-06-17 01:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-23 23:15 . 2009-06-23 23:33 ——– d—–w- c:\program files\VIR_Malwarebytes' Anti-Malware
2009-06-23 23:15 . 2009-06-23 23:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 23:15 . 2009-06-17 01:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-23 05:27 . 2009-06-23 06:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-23 04:38 . 2008-04-14 00:12 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-22 00:39 . 2009-06-22 00:39 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-18 03:25 . 2009-06-18 03:25 ——– d-sh–w- c:\documents and settings\OEM\PrivacIE
2009-06-15 02:21 . 2009-06-15 02:21 ——– d-sh–w- c:\documents and settings\Everybody\PrivacIE
2009-06-15 02:19 . 2009-06-15 02:19 ——– d-sh–w- c:\documents and settings\Everybody\IETldCache
2009-06-15 00:16 . 2009-06-15 00:16 ——– d-sh–w- c:\documents and settings\OEM\IETldCache
2009-06-14 23:57 . 2009-04-30 21:22 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2009-06-14 23:57 . 2009-04-30 21:22 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-14 23:57 . 2009-06-14 23:57 ——– d—–w- c:\windows\ie8updates
2009-06-14 23:57 . 2009-05-12 05:11 102912 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2009-06-14 23:53 . 2009-06-14 23:55 ——– dc—-w- c:\windows\ie8
2009-06-10 23:41 . 2009-06-10 23:41 1078 —-a-r- c:\documents and settings\OEM\Application Data\Microsoft\Installer\{BE6F412F-C276-4FD8-B3E1-F996CC172776}\_69525f90.exe
2009-06-10 23:41 . 2009-06-10 23:41 1078 —-a-r- c:\documents and settings\OEM\Application Data\Microsoft\Installer\{BE6F412F-C276-4FD8-B3E1-F996CC172776}\_2cd672ae.exe
2009-06-10 23:41 . 2009-06-10 23:41 1078 —-a-r- c:\documents and settings\OEM\Application Data\Microsoft\Installer\{BE6F412F-C276-4FD8-B3E1-F996CC172776}\_16496df1.exe
2009-06-10 23:40 . 2009-06-10 23:40 ——– d—–w- c:\program files\Western Digital Technologies
2009-06-10 23:39 . 2009-06-10 23:39 ——– d—–w- c:\program files\Western Digital Corporation
2009-06-10 22:31 . 2009-06-10 22:50 ——– d—–w- c:\windows\system32\NtmsData
2009-06-09 01:18 . 2009-06-09 01:18 ——– d—–w- c:\windows\system32\wbem\Repository
2009-06-09 01:17 . 2009-06-09 01:17 ——– d—–w- c:\windows\PIF
2009-06-01 06:22 . 2009-06-01 06:22 ——– d—–w- c:\documents and settings\Everybody\Local Settings\Application Data\DOSBox
2009-05-31 21:54 . 2009-06-09 01:18 ——– d—–w- c:\documents and settings\Everybody\VirtualHDD
2009-05-31 08:19 . 2009-06-09 00:34 ——– d—–w- c:\documents and settings\Everybody\D-Fend Reloaded
2009-05-31 07:03 . 2009-06-09 00:34 ——– d—–w- c:\documents and settings\OEM\D-Fend Reloaded
2009-05-31 07:03 . 2009-06-09 01:16 ——– d—–w- c:\program files\D-Fend Reloaded
2009-05-31 06:25 . 2009-05-31 06:25 ——– d—–w- c:\documents and settings\OEM\Local Settings\Application Data\DOSBox
2009-05-31 06:19 . 2009-06-09 01:16 ——– d—–w- c:\program files\DOSBox-0.73

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-26 09:15 . 2007-12-02 10:52 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-24 06:21 . 2006-07-12 05:48 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-23 22:42 . 2009-06-04 06:33 ——– d—–w- c:\program files\VDMSound
2009-06-23 05:20 . 2009-06-04 06:29 95744 —-a-w- c:\documents and settings\All Users\Application Data\SpeedBit\DAP\Updates\Condition.dll
2009-06-23 04:38 . 2008-05-22 20:05 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-06-18 03:33 . 2009-02-09 06:47 83456 —-a-w- c:\documents and settings\All Users\Application Data\SpeedBit\DAP\SDCondition.dll
2009-06-09 03:28 . 2007-12-02 03:53 ——– d—–w- c:\program files\TuneUp Utilities 2007
2009-06-09 01:15 . 2007-01-22 07:46 ——– d—–w- c:\program files\Google
2009-05-24 23:52 . 2006-08-10 05:27 ——– d—–w- c:\program files\LimeWire
2009-05-19 01:19 . 2009-02-18 00:50 ——– d—–w- c:\program files\LatitudeFX MT4
2009-05-13 05:15 . 2004-08-04 12:00 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-08 22:31 . 2008-05-22 20:06 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-05-08 22:31 . 2008-05-22 20:06 325896 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-08 22:31 . 2006-11-24 21:28 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-08 22:30 . 2008-05-22 20:06 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:32 . 2004-08-04 12:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:55 . 2009-04-29 04:55 78336 ——w- c:\windows\system32\ieencode.dll
2009-04-17 12:26 . 2004-08-04 12:00 1847168 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 12:00 585216 —-a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mobile Partner"="c:\program files\3 MobileBroadband\3 MobileBroadband.exe" [2009-02-16 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-08 1947928]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"WD Spindown Utility"="c:\program files\Western Digital Technologies\Spindown\ExSpinDn.exe" [2004-08-09 278528]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-08 22:31 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\progra~1\MESSEN~1\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"IgfxTray"=c:\windows\system32\igfxtray.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Games\\Descent3\\MAIN.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Sierra\\Empire Earth\\Empire Earth.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\DAP\\DAP.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"514:UDP"= 514:UDP:192.168.1.1/255.255.255.255:Enabled:dsl_log

R3 gupdate1c9df80439b86a6;Google Update Service (gupdate1c9df80439b86a6);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-28 133104]
R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [2006-12-13 40832]
R3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);c:\windows\system32\DRIVERS\CamDrL20.sys [2004-05-21 245760]
R4 Kiwi Syslog Daemon;Kiwi Syslog Daemon;c:\program files\syslogd\syslogd_service.exe [2007-06-12 1372160]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-05-08 325896]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-08 108552]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-05-08 908568]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-05-08 298776]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-02-27 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 06:35]

2009-05-28 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-28 10:36]

2009-03-02 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04]

2009-03-02 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 07:04]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.nzcity.co.nz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://g.xtramsn.co.nz/0SEENNZ/SAOS01?FORM=TOOLBR
IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} - hxxp://www.intel.com/design/motherbd/boardid/BoardID.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 19:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1024)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\HPZipm12.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
.
**************************************************************************
.
Completion time: 2009-06-26 20:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-26 10:04

Pre-Run: 6,823,723,008 bytes free
Post-Run: 6,804,746,240 bytes free

202 — E O F — 2007-11-02 14:02

CatByte

Post #11June 26, 2009, 11:07 AM UTC

Hi,

Please do the following:

Open your Malwarebytes Antimalware program

Click on the Update tab. Choose to update. If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so.

NEXT

It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner:
1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

You can refer to this animation by sundavis.

spinach1

Post #12June 26, 2009, 9:14 PM UTC

Hi Catbyte, Malwarebytes came back clean, kaspersky is super slow. It has been running all night and has some way to go. after only 30,000 files it is reporting 3 threats already. shortly, we are going out to stay away overnight so I will let it run and send the results when we return in approx 36 hrs from now ( Sunday evening for us), have a good weekend, TMG……… Malwarebytes' Anti-Malware 1.38 Database version: 2338 Windows 5.1.2600 Service Pack 3 6/26/2009 10:26:37 PM mbam-log-2009-06-26 (22-26-37).txt Scan type: Quick Scan Objects scanned: 103348 Time elapsed: 6 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

spinach1

Post #13June 28, 2009, 3:14 AM UTC

Hiya, back now, Kasperky finally finished after 34.5 hrs, it was terribly slow to download definitions too. Anyhoo, here's the report ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Sunday, June 28, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Friday, June 26, 2009 14:33:31 Records in database: 2391420 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ Scan statistics: Files scanned: 133339 Threat name: 8 Infected objects: 10 Suspicious objects: 0 Duration of the scan: 34:35:52 File name / Threat name / Threats count C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations\{1B4C9447-81FA-43E8-89FE-9CA0D9B4EB39}\ParetoLogic Anti-Virus PLUS.msi Infected: Trojan.Win32.FraudPack.oyp 1 C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations\{1B4C9447-81FA-43E8-89FE-9CA0D9B4EB39}\ParetoLogic Anti-Virus PLUS.msi Infected: Trojan.Win32.FraudPack.oyq 1 C:\Dumpsite\VIR_Pareto_AV_Setup_RW.exe Infected: Trojan.Win32.FraudPack.oyl 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACkcjgsxjkqpjlxfswr.dll.vir Infected: Packed.Win32.Tdss.m 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACmyqthnmxyquphxpjc.dll.vir Infected: Trojan.Win32.TDSS.adzz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACpuwmerqrkuqpvaqtt.dll.vir Infected: Trojan.Win32.TDSS.aegg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACqxgvxdtypejufvrov.dll.vir Infected: Trojan.Win32.TDSS.adzx 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACvholwerrnrwowilte.dll.vir Infected: Packed.Win32.Tdss.m 1 C:\_OTL\MovedFiles\06262009_120614\WINDOWS\delsysguard.exe Infected: not-a-virus:FraudTool.Win32.SpywareProtect2009.dl 1 G:\Dumpsite\Pareto_AV_Setup_RW.exe Infected: Trojan.Win32.FraudPack.oyl 1 The selected area was scanned.

CatByte

Post #14June 28, 2009, 3:54 AM UTC

Please do the following:

Please download OTM by OldTimer.

Save it to your desktop.
Please click OTM and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations\{1B4C9447-81FA-43E8-89FE-9CA0D9B4EB39}\ParetoLogic Anti-Virus PLUS.msi 
C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations\{1B4C9447-81FA-43E8-89FE-9CA0D9B4EB39}\ParetoLogic Anti-Virus PLUS.msi 
C:\Dumpsite\VIR_Pareto_AV_Setup_RW.exe 
G:\Dumpsite\Pareto_AV_Setup_RW.exe 

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

NEXT

Post a fresh HJT log and advise in detail, how your computer is running now and if there are any outstanding issues.

spinach1

Post #15June 28, 2009, 8:12 AM UTC

Done that, results of OTM and HJT below……..

Otherwise, In general much improved since running Combo-fix, the boot up/login seems faster than it has for a while and unexpected events no longer occur. I recognize most of the running processes as legitimate.

I was able to create a restore point, Please advise if I should keep or delete this.

A file named uac9.tmp has appeared on the desktop should I delete this?

Also some entries I added in browser favorites are now visible. ( good)

To this point AVG resident sheild remains disabled as does the Dcom launcher service,

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations\{1B4C9447-81FA-43E8-89FE-9CA0D9B4EB39}\ParetoLogic Anti-Virus PLUS.msi moved successfully.
File/Folder C:\Documents and Settings\OEM\Local Settings\Application Data\Downloaded Installations\{1B4C9447-81FA-43E8-89FE-9CA0D9B4EB39}\ParetoLogic Anti-Virus PLUS.msi not found.
C:\Dumpsite\VIR_Pareto_AV_Setup_RW.exe moved successfully.
G:\Dumpsite\Pareto_AV_Setup_RW.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Alex
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Everybody
->Temp folder emptied: 100598 bytes
->Temporary Internet Files folder emptied: 2794727 bytes
->Java cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: OEM
->Temp folder emptied: 71547209 bytes
->Temporary Internet Files folder emptied: 667462 bytes
->Java cache emptied: 379414 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2162283 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 505 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 74.06 mb

OTM by OldTimer - Version 3.0.0.2 log created on 06282009_172908

Files moved on Reboot…

Registry entries deleted on Reboot…

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:44:41 PM, on 6/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe
C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.nzcity.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.xtramsn.co.nz/0SEENNZ/SAOS01?FORM=TOOLBR
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [WD Spindown Utility] "C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe"
O4 - HKCU\..\Run: [Mobile Partner] "C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe"
O4 - HKUS\S-1-5-21-3182933676-324156410-679323072-1003\..\Run: [Mobile Partner] "C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe" (User '?')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1235938159906
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1235938137750
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} (BoardCtl Class) - http://www.intel.com/design/motherbd/boardid/BoardID.cab
O16 - DPF: {EA1B8527-E422-4909-825A-70BE0694F18E} (PortfolioManagerWT ProfileManager Class) - https://online.westpac.com.au/wtoa/wtOtherA…iomanagerwt.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{597D4523-8065-4F9C-ABB6-464CCC19D52D}: NameServer = 10.176.66.71 10.188.66.103
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate1c9df80439b86a6) (gupdate1c9df80439b86a6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 6122 bytes

[Resolved] uacinit.dll left after malwarebytes

✨ Ask AI

Ask AI