Spyware / Malware / Virus Removal

[Resolved] pop up problem

19 min read

Looking for the outcome? Ask AI

electriccrayon Topic Starter

Post #1July 26, 2009, 7:16 AM UTC

i just had my pc cleaned up on here, and now i have these pop-ups. i have the blocker on, but they still get through. i noticed my winpatrol has an bho that i cannot remove, called "jibikuba.dll". i dont know if thats what causing the popups. i think i accepted the bho by mistake. if im in the wrong forum, let me know.

oldman960

Post #2July 26, 2009, 7:27 AM UTC

Hi electriccrayon,

No you are in the right forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Download OTListIt2 to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Thanks

electriccrayon

Post #3July 26, 2009, 11:57 AM UTC

OTL Extras logfile created on: 7/26/2009 7:42:50 AM - Run 1
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\Tony Gymetric\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.54 Mb Total Physical Memory | 475.42 Mb Available Physical Memory | 49.60% Memory free
2.26 Gb Paging File | 1.78 Gb Available in Paging File | 78.81% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 80.48 Gb Free Space | 72.00% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MOTOROLA
Current User Name: Tony Gymetric
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\BearShare\BearShare.exe" = C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare – (Free Peers, Inc.)
"C:\WINDOWS\system32\lxdvcoms.exe" = C:\WINDOWS\system32\lxdvcoms.exe:*:Enabled:X5400 Series Server – ( )
"C:\Program Files\Lexmark X5400 Series\lxdvmon.exe" = C:\Program Files\Lexmark X5400 Series\lxdvmon.exe:*:Enabled:Printer Device Monitor – ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdvpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdvpswx.exe:*:Enabled:Printer Status Window Interface – ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdvtime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdvtime.exe:*:Enabled:Lexmark Connect Time Executable – (Lexmark International, Inc.)
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdvjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdvjswx.exe:*:Enabled:Job Status Window Interface – ()
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\MySpace\IM\MySpaceIM.exe" = C:\Program Files\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpaceIM – ()
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Explorer – (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 14
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{64649281-4B5D-4425-A0F7-E79F6756FFC8}" = Tweak UI
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{83CD44C3-0CDB-61A6-DAEB-5181713A7092}" = imeem Uploader
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A7050037-F0EA-4BAB-BCD5-FC05507D6147}" = Alt-Tab Task Switcher Powertoy for Windows XP
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0.1
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2BC4969-2DE3-499A-9A3D-1B7C34ED12C3}" = HP Webcam
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 SP1 with Hotfixes
"{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
"{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
"53F13DB4D9611FD63BE580F06F0729BF236ABE68" = Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"AVG8Uninstall" = AVG Free 8.5
"B6E4AD11B487308A361AACB990AC314D7DEAD995" = Windows Driver Package - usbvm326 (usbvm328) Image (10/12/2006 326.1.061012.25)
"BearShare" = BearShare
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
"CCleaner" = CCleaner (remove only)
"CNXT_HDAUDIO" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_wis30B5m" = HDAUDIO Soft Data Fax Modem with SmartCP
"ERUNT_is1" = ERUNT 1.1j
"EsetOnlineScanner" = ESET Online Scanner
"HijackThis" = HijackThis 2.0.2
"HP Photosmart Essential" = HP Photosmart Essential 3.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.7.5 (Full)
"Lexmark X5400 Series" = Lexmark X5400 Series
"Living Marine Aquarium 2 Screen Saver" = Living Marine Aquarium 2 Screen Saver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.5.1)" = Mozilla Firefox (3.5.1)
"MySpaceIM" = MySpaceIM
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"SpywareBlaster_is1" = SpywareBlaster 4.1
"SpywareGuard_is1" = SpywareGuard v2.2
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPatrol" = WinPatrol 2008
"WinRAR archiver" = WinRAR archiver
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"YInstHelper" = Yahoo! Install Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/10/2008 12:27:44 PM | Computer Name = WINDOWS-DD0A5C9 | Source = Application Error | ID = 1000
Description = Faulting application myspaceim.exe, version 1.0.756.0, faulting module
unknown, version 0.0.0.0, fault address 0x1001ba73.

Error - 10/14/2008 4:51:02 AM | Computer Name = WINDOWS-DD0A5C9 | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.0.3.0, faulting module
js3250.dll, version 4.0.0.0, fault address 0x000084f7.

Error - 10/15/2008 3:19:57 PM | Computer Name = WINDOWS-DD0A5C9 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16735, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/14/2008 4:52:58 PM | Computer Name = MOTOROLA | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16735, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 12/4/2008 11:31:49 PM | Computer Name = MOTOROLA | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16735, faulting
module ntdll.dll, version 5.1.2600.5512, fault address 0x0001b1fa.

Error - 12/20/2008 4:56:51 AM | Computer Name = MOTOROLA | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16762, faulting
module ntdll.dll, version 5.1.2600.5512, fault address 0x0001b1fa.

Error - 12/20/2008 4:57:49 PM | Computer Name = MOTOROLA | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16762, faulting
module lnod32upd.dll, version 0.0.0.0, fault address 0x00004e5b.

Error - 12/20/2008 5:02:40 PM | Computer Name = MOTOROLA | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16762, faulting
module lnod32upd.dll, version 0.0.0.0, fault address 0x00004e5b.

Error - 12/20/2008 5:06:51 PM | Computer Name = MOTOROLA | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16762, faulting
module lnod32upd.dll, version 0.0.0.0, fault address 0x00004e5b.

Error - 1/8/2009 5:15:25 AM | Computer Name = MOTOROLA | Source = Application Hang | ID = 1002
Description = Hanging application BearShare.exe, version 5.1.0.27, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 6/8/2009 1:42:54 AM | Computer Name = MOTOROLA | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 6/8/2009 1:42:54 AM | Computer Name = MOTOROLA | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 6/8/2009 1:00:30 PM | Computer Name = MOTOROLA | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.118 for the Network Card with network
address 0014A5D8BB9C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 6/9/2009 12:29:31 AM | Computer Name = MOTOROLA | Source = PlugPlayManager | ID = 12
Description = The device 'HL-DT-ST DVDRAM GSA-4084N' (IDE\CdRomHL-DT-ST_DVDRAM_GSA-4084N_______________KQ09____\304b363138423234343320362020202020202020)
disappeared from the system without first being prepared for removal.

Error - 6/10/2009 12:00:49 AM | Computer Name = MOTOROLA | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Internet Explorer 8 for Windows XP.

Error - 6/11/2009 7:06:05 PM | Computer Name = MOTOROLA | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.105 for the Network Card with network
address 0014A5D8BB9C has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 7/3/2009 3:03:00 AM | Computer Name = MOTOROLA | Source = PlugPlayManager | ID = 12
Description = The device 'HL-DT-ST DVDRAM GSA-4084N' (IDE\CdRomHL-DT-ST_DVDRAM_GSA-4084N_______________KQ09____\304b363138423234343320362020202020202020)
disappeared from the system without first being prepared for removal.

Error - 7/22/2009 1:15:25 AM | Computer Name = MOTOROLA | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.2.3 for the Network Card with network
address 0014A5D8BB9C has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 7/22/2009 3:22:05 AM | Computer Name = MOTOROLA | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.2.3 for the Network Card with network
address 0014A5D8BB9C has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 7/22/2009 3:32:01 AM | Computer Name = MOTOROLA | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring
the volume.

< End of report >

OTL logfile created on: 7/26/2009 7:42:50 AM - Run 1
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\Tony Gymetric\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.54 Mb Total Physical Memory | 475.42 Mb Available Physical Memory | 49.60% Memory free
2.26 Gb Paging File | 1.78 Gb Available in Paging File | 78.81% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 80.48 Gb Free Space | 72.00% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MOTOROLA
Current User Name: Tony Gymetric
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\System32\lxdvcoms.exe ( )
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\WINDOWS\System32\wdfmgr.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\taskswitch.exe ()
PRC - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe (Hewlett-Packard)
PRC - C:\Program Files\Lexmark X5400 Series\lxdvmon.exe ()
PRC - C:\Program Files\Lexmark X5400 Series\lxdvamon.exe ()
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\SpywareGuard\sgbhp.exe ()
PRC - C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe (Yahoo! Inc.)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Auto | Running]) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (lxdvCATSCustConnectService [Auto | Stopped]) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdvserv.exe (Lexmark International, Inc.)
SRV - (lxdv_device [Auto | Running]) – C:\WINDOWS\System32\lxdvcoms.exe ( )
SRV - (NVSvc [Auto | Running]) – C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
SRV - (NWCWorkstation [Auto | Running]) – C:\WINDOWS\System32\nwwks.dll (Microsoft Corporation)
SRV - (UMWdf [Auto | Running]) – C:\WINDOWS\System32\wdfmgr.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AmdK8 [System | Running]) – C:\WINDOWS\System32\DRIVERS\AmdK8.sys (Advanced Micro Devices)
DRV - (AvgLdx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (BCM43XX [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\bcmwl5.sys (Broadcom Corporation)
DRV - (Flash1 [On_Demand | Stopped]) – C:\SwSetup\SP36119\winphlash\Flash1.sys ()
DRV - (HdAudAddService [On_Demand | Running]) – C:\WINDOWS\System32\drivers\CHDAud.sys (Conexant Systems Inc.)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (HSFHWAZL [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (mdmxsdk [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvata [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (NVENETFD [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvnetbus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nvnetbus.sys (NVIDIA Corporation)
DRV - (nvsmu [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nvsmu.sys (NVIDIA Corporation)
DRV - (NwlnkIpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (NWRDR [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nwrdr.sys (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (rimmptsk [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rimmptsk.sys (REDC)
DRV - (rimsptsk [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rimsptsk.sys (REDC)
DRV - (rismxdp [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rixdptsk.sys (REDC)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (winachsf [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.myspace.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: avg@igeared:2.506.026.001
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.1
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type;=yahoo_avg_hs2-tb-web_us&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/07/01 03:02:42 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008/12/19 14:39:00 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/07/22 03:30:16 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/22 23:38:55 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/07/22 23:38:55 | 00,000,000 | —D | M]

[2009/07/07 18:18:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Extensions
[2009/07/07 18:18:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/07/26 03:32:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Firefox\Profiles\r6htrlaj.default\extensions
[2009/07/07 18:18:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Firefox\Profiles\r6htrlaj.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2008/12/12 14:23:54 | 00,002,158 | —- | M] () – C:\Documents and Settings\Tony Gymetric\Application Data\Mozilla\FireFox\Profiles\r6htrlaj.default\searchplugins\MySpace.xml
[2009/07/07 18:18:08 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/07/22 23:38:55 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/07/22 23:38:50 | 00,023,544 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/07/22 23:38:50 | 00,137,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/07/22 23:38:53 | 00,065,016 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009/06/24 07:27:00 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/06/24 07:27:00 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/07/07 18:18:30 | 00,001,498 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml
[2009/06/24 07:27:00 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/06/24 07:27:00 | 00,002,344 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/06/24 07:27:00 | 00,002,371 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/06/24 07:27:00 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/06/24 07:27:00 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {abccdc55-d644-4c70-ab81-474306b921b4} - C:\WINDOWS\System32\duduhahi.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe ()
O4 - HKLM..\Run: [CPM73f17527] C:\WINDOWS\System32\reguligu.DLL ()
O4 - HKLM..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Lexmark X5400 Series Fax Server] C:\Program Files\Lexmark X5400 Series\fm3032.exe ()
O4 - HKLM..\Run: [lxdvamon] C:\Program Files\Lexmark X5400 Series\lxdvamon.exe ()
O4 - HKLM..\Run: [lxdvmon.exe] C:\Program Files\Lexmark X5400 Series\lxdvmon.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [peyajuyipe] C:\WINDOWS\System32\tuhenato.DLL ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Tony Gymetric\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Tony Gymetric\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_14.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: 26 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/buxus/docs/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\windows\system32\reguligu.dll) - C:\WINDOWS\System32\reguligu.dll ()
O20 - AppInit_DLLs: (C:\WINDOWS\system32\hididofu.dll) - C:\WINDOWS\System32\hididofu.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - C:\WINDOWS\System32\reguligu.dll ()
O22 - SharedTaskScheduler: {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - STS - C:\WINDOWS\System32\reguligu.dll ()
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/03 17:58:09 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/07/26 07:41:52 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe
[2009/07/23 02:01:34 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/07/22 15:40:55 | 02,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe
[2009/07/22 15:40:55 | 02,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe
[2009/07/22 15:40:55 | 01,614,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll
[2009/07/22 15:40:55 | 01,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\explorer.exe
[2009/07/22 15:40:55 | 00,989,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kernel32.dll
[2009/07/22 15:40:55 | 00,927,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mfc40u.dll
[2009/07/22 15:40:55 | 00,827,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wininet.dll
[2009/07/22 15:40:55 | 00,792,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comres.dll
[2009/07/22 15:40:55 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comctl32.dll
[2009/07/22 15:40:55 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\user32.dll
[2009/07/22 15:40:55 | 00,507,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\winlogon.exe
[2009/07/22 15:40:55 | 00,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll
[2009/07/22 15:40:55 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rpcss.dll
[2009/07/22 15:40:55 | 00,361,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tcpip.sys
[2009/07/22 15:40:55 | 00,295,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\termsrv.dll
[2009/07/22 15:40:55 | 00,182,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ndis.sys
[2009/07/22 15:40:55 | 00,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\srsvc.dll
[2009/07/22 15:40:55 | 00,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\appmgmts.dll
[2009/07/22 15:40:55 | 00,142,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\aec.sys
[2009/07/22 15:40:55 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\services.exe
[2009/07/22 15:40:55 | 00,110,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\imm32.dll
[2009/07/22 15:40:55 | 00,088,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rasauto.dll
[2009/07/22 15:40:55 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ws2_32.dll
[2009/07/22 15:40:55 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\spoolsv.exe
[2009/07/22 15:40:55 | 00,051,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wuauclt.exe
[2009/07/22 15:40:55 | 00,036,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ip6fw.sys
[2009/07/22 15:40:55 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\msgsvc.dll
[2009/07/22 15:40:55 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\userinit.exe
[2009/07/22 15:40:55 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kbdclass.sys
[2009/07/22 15:40:55 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lpk.dll
[2009/07/22 15:40:55 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\powrprof.dll
[2009/07/22 15:40:55 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ctfmon.exe
[2009/07/22 15:40:55 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\svchost.exe
[2009/07/22 15:40:55 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lsass.exe
[2009/07/22 15:40:55 | 00,011,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\acpiec.sys
[2009/07/22 15:40:55 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfc.dll
[2009/07/22 15:40:55 | 00,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\null.sys
[2009/07/22 15:40:55 | 00,000,000 | —D | C] – C:\WINDOWS\System32\dllcache\cache
[2009/07/22 01:52:20 | 00,000,000 | —- | C] () – C:\1891780116
[2009/07/10 08:31:14 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\My Documents\Downloads
[2009/07/07 18:18:30 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\AVG Security Toolbar
[2009/07/07 18:18:03 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\Mozilla
[2009/07/07 18:03:32 | 00,001,602 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2009/07/07 18:03:29 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2009/07/05 18:49:42 | 00,265,216 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\TFC.exe
[2009/06/29 05:35:38 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Application Data\com.imeem.DesktopUploader.6C3F108F466C0F04F30B58747CAA4DF34281133B.1
[2009/06/29 05:35:09 | 00,000,690 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\imeem Uploader.lnk
[2009/06/29 05:35:09 | 00,000,000 | —D | C] – C:\Program Files\imeem Uploader
[2009/06/29 05:33:09 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2009/06/29 00:14:44 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2009/04/26 07:14:27 | 00,050,688 | -HS- | C] () – C:\WINDOWS\System32\tuhenato.dll
[2009/04/26 07:14:27 | 00,050,688 | -HS- | C] () – C:\WINDOWS\System32\hididofu.dll
[2009/04/26 07:14:27 | 00,050,688 | -HS- | C] () – C:\WINDOWS\System32\duduhahi.dll
[2009/04/26 07:13:55 | 00,085,504 | -HS- | C] () – C:\WINDOWS\System32\reguligu.dll
[2009/04/26 07:13:55 | 00,050,688 | -HS- | C] () – C:\WINDOWS\System32\tupabezu.dll
[2009/04/25 19:13:28 | 00,086,016 | -HS- | C] () – C:\WINDOWS\System32\yapiniti.dll
[2009/04/21 14:08:16 | 00,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/04/21 14:08:14 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/04/21 14:08:14 | 00,795,648 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/04/21 14:08:14 | 00,130,048 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/04/21 14:08:13 | 00,067,584 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/04/21 14:08:13 | 00,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/11/06 01:36:40 | 00,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2008/09/06 18:20:46 | 00,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/08/24 13:09:40 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\LXDVPMON.DLL
[2008/08/24 13:09:40 | 00,032,768 | —- | C] () – C:\WINDOWS\System32\LXDVFXPU.DLL
[2008/08/24 13:09:20 | 00,069,632 | —- | C] () – C:\WINDOWS\System32\lxdvoem.dll
[2008/08/24 12:58:53 | 00,000,060 | -H– | C] () – C:\WINDOWS\System32\lxdvrwrd.ini
[2008/08/24 12:58:51 | 00,438,272 | —- | C] ( ) – C:\WINDOWS\System32\LXDVhcp.dll
[2008/08/24 12:58:51 | 00,348,160 | —- | C] () – C:\WINDOWS\System32\LXDVinst.dll
[2008/08/24 12:56:55 | 00,348,160 | R— | C] () – C:\WINDOWS\System32\lxdvcoin.dll
[2008/08/03 18:13:09 | 00,016,480 | —- | C] () – C:\WINDOWS\System32\rixdicon.dll
[2008/02/11 10:39:26 | 00,253,952 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLA.dll
[2008/02/11 10:39:18 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLW.dll
[2008/02/08 14:53:46 | 00,110,592 | —- | C] () – C:\WINDOWS\System32\OnlineScannerLang.dll
[2007/10/09 02:34:16 | 00,208,896 | —- | C] () – C:\WINDOWS\System32\lxdvgrd.dll
[2007/09/20 16:12:56 | 00,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxdvpmui.dll
[2007/09/20 16:09:35 | 01,069,056 | —- | C] ( ) – C:\WINDOWS\System32\lxdvserv.dll
[2007/09/20 16:06:19 | 00,569,344 | —- | C] ( ) – C:\WINDOWS\System32\lxdvlmpm.dll
[2007/09/20 16:06:19 | 00,339,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdviesc.dll
[2007/09/20 16:06:04 | 00,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxdvcomm.dll
[2007/09/20 16:05:01 | 00,663,552 | —- | C] ( ) – C:\WINDOWS\System32\lxdvhbn3.dll
[2007/09/20 16:04:32 | 00,954,368 | —- | C] ( ) – C:\WINDOWS\System32\lxdvusb1.dll
[2007/09/20 16:04:01 | 00,851,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdvcomc.dll
[2007/09/20 16:02:58 | 00,053,248 | —- | C] ( ) – C:\WINDOWS\System32\lxdvprox.dll
[2007/09/20 16:01:11 | 00,360,448 | —- | C] ( ) – C:\WINDOWS\System32\lxdvinpa.dll
[2007/09/06 16:40:36 | 00,692,224 | —- | C] () – C:\WINDOWS\System32\lxdvdrs.dll
[2007/08/10 15:49:54 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\lxdvcaps.dll
[2007/07/27 15:49:02 | 00,225,355 | —- | C] () – C:\WINDOWS\System32\lnod32apiW.dll
[2007/07/27 15:49:02 | 00,196,683 | —- | C] () – C:\WINDOWS\System32\lnod32apiA.dll
[2007/07/16 13:53:09 | 00,069,632 | —- | C] () – C:\WINDOWS\System32\lxdvcnv4.dll
[2006/08/25 01:40:00 | 01,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/25 01:40:00 | 01,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/25 01:40:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/25 01:40:00 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/25 01:40:00 | 00,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/08/01 01:53:18 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\lxdvvs.dll
[2005/12/05 20:25:22 | 00,139,264 | —- | C] () – C:\WINDOWS\System32\lnod32umc.dll
[2005/12/05 13:37:10 | 00,106,496 | —- | C] () – C:\WINDOWS\System32\lnod32upd.dll
[2005/04/27 21:42:49 | 00,000,068 | —- | C] () – C:\WINDOWS\System32\oobeinfo.ini
[2004/08/04 03:00:00 | 00,000,477 | —- | C] () – C:\WINDOWS\win.ini
[2004/08/04 03:00:00 | 00,000,246 | —- | C] () – C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[3 C:\WINDOWS\System32\*.tmp files]
[2009/07/26 07:45:00 | 00,011,168 | -H– | M] () – C:\WINDOWS\System32\gotufife
[2009/07/26 07:42:04 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe
[2009/07/26 07:14:26 | 00,050,688 | -HS- | M] () – C:\WINDOWS\System32\tupabezu.dll
[2009/07/26 07:13:56 | 00,085,504 | -HS- | M] () – C:\WINDOWS\System32\reguligu.dll
[2009/07/26 03:41:26 | 39,260,642 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/07/26 03:41:26 | 00,041,419 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/07/26 02:50:48 | 00,050,868 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009/07/26 02:49:24 | 00,013,758 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/26 02:49:24 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/07/26 02:49:23 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/07/26 02:47:35 | 04,804,404 | -H– | M] () – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\IconCache.db
[2009/07/25 19:13:29 | 00,086,016 | -HS- | M] () – C:\WINDOWS\System32\yapiniti.dll
[2009/07/22 19:21:04 | 00,000,246 | —- | M] () – C:\WINDOWS\system.ini
[2009/07/22 19:20:19 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/07/22 01:52:20 | 00,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2009/07/22 01:52:20 | 00,000,000 | —- | M] () – C:\1891780116
[2009/07/16 03:02:37 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/07/13 13:36:34 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/07/13 13:36:12 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/07/07 18:03:32 | 00,001,602 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2009/07/05 18:50:49 | 00,265,216 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\TFC.exe
[2009/07/04 17:04:31 | 00,335,752 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/06/29 16:25:32 | 00,463,779 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/06/29 05:35:09 | 00,000,690 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\imeem Uploader.lnk
[2009/06/29 00:13:23 | 00,011,952 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2009/06/29 00:13:22 | 00,027,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys

========== LOP Check ==========

[2009/06/29 00:14:44 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data
[2009/06/29 00:14:44 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2008/08/03 18:05:30 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\CyberLink
[2008/08/04 09:09:13 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
[2009/07/22 20:58:30 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2008/08/24 13:09:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\X5400 Series
[2009/06/29 05:35:38 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Tony Gymetric\Application Data
[2008/10/15 03:20:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\AVGTOOLBAR
[2009/06/29 05:35:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\com.imeem.DesktopUploader.6C3F108F466C0F04F30B58747CAA4DF34281133B.1
[2008/08/07 21:21:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\CyberLink
[2008/08/08 04:36:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\Grisoft
[2008/10/01 16:58:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\Lexmark Productivity Studio
[2009/01/14 02:05:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\WinPatrol
[2008/08/24 18:40:21 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\X5400 Series
[2004/08/04 03:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/07/26 02:49:24 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D1B5B4F1
< End of report >

oldman960

Post #4July 26, 2009, 3:42 PM UTC

Hi electriccrayon,

Please disable these programs and leave them disabled until we are finished cleaning this computer.

SPYWARE GUARD

Right click the running icon of Spywareguard in the system tray to open the program.
Then go to Menu, File, and choose Exit.

WINPATROL
Right-click the running icon of Winpatrol in the sytem tray and choose exit.

*You will also need to disable your antivirus program before running this next tool.*

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Post back with

combofix log

How's the computer?

Thanks

electriccrayon

Post #5July 26, 2009, 10:49 PM UTC

after i ran the combofix scan, instead of rebooting the system, it shutdown. when i tryed to start the system back up, it shutdown about 5 more times during attempts to restart. its not the first time its done this either. ive had this same problem a few times in the past. heres the CF log.

ComboFix 09-07-25.08 - Tony Gymetric 07/26/2009 18:28.7.2 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\run.log
c:\windows\system32\hididofu.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-26 to 2009-07-26 )))))))))))))))))))))))))))))))
.

2009-07-18 13:04 . 2009-06-29 04:13 353048 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgxch32.dll
2009-07-18 13:04 . 2009-06-29 04:13 2301208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avguiadv.dll
2009-07-04 21:05 . 2009-06-29 04:13 327688 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgldx86.sys
2009-07-04 21:05 . 2009-07-04 21:04 2054424 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgcorex.dll
2009-07-04 21:05 . 2009-07-04 21:04 2167576 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgresf.dll
2009-07-04 21:05 . 2009-06-29 04:13 906520 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgemc.exe
2009-07-04 21:05 . 2009-07-04 21:04 3403032 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgui.exe
2009-07-04 21:05 . 2009-06-29 04:13 1204504 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgabout.dll
2009-07-04 21:05 . 2009-06-29 04:12 337176 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avglogx.dll
2009-07-04 21:05 . 2009-06-29 04:12 829208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgcfgx.dll
2009-07-04 21:05 . 2009-06-29 04:12 3298072 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\setup.exe
2009-07-04 21:03 . 2009-06-29 04:11 1085208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgupd.exe
2009-07-04 21:03 . 2009-06-29 04:11 1454360 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgupd.dll
2009-06-29 09:35 . 2009-06-29 09:35 ——– d—–w- c:\program files\imeem Uploader
2009-06-29 09:33 . 2009-06-29 09:33 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-06-29 04:14 . 2009-06-29 04:14 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\AVG Security Toolbar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-26 11:14 . 2009-04-26 11:13 50688 –sha-w- c:\windows\system32\tupabezu.dll
2009-07-26 11:13 . 2009-04-26 11:13 85504 –sha-w- c:\windows\system32\reguligu.dll
2009-07-25 23:13 . 2009-04-25 23:13 86016 –sha-w- c:\windows\system32\yapiniti.dll
2009-07-23 05:51 . 2008-08-03 22:05 ——– d—–w- c:\program files\Java
2009-07-23 00:58 . 2008-08-04 13:36 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-07-22 07:23 . 2008-12-16 03:33 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-22 07:23 . 2009-01-05 18:33 3775176 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-13 17:36 . 2008-12-16 03:33 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2008-12-16 03:33 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-04 21:04 . 2008-10-15 03:17 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-29 04:13 . 2008-10-15 03:17 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-29 04:13 . 2008-10-15 03:17 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-26 01:09 . 2008-08-04 12:55 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!
2009-06-16 14:36 . 2004-08-04 07:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 07:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:09 . 2004-08-04 07:00 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-26 23:50 . 2009-06-26 01:09 607472 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-21 15:33 . 2008-12-19 18:39 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-05-08 18:48 . 2008-10-15 03:17 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:32 . 2004-08-04 07:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 07:00 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-07-23 03:38 . 2009-07-07 22:03 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2004-08-04 07:00 . 2008-08-03 22:39 73728 –sha-w- c:\windows\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
2009-04-26 11:14 . 2009-04-26 11:14 50688 –sha-w- c:\windows\system32\duduhahi.dll
2009-04-26 11:14 . 2009-04-26 11:14 50688 –sha-w- c:\windows\system32\tuhenato.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{abccdc55-d644-4c70-ab81-474306b921b4}]
2009-04-26 11:14 50688 –sha-w- c:\windows\system32\duduhahi.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-25 7569408]
"hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"lxdvmon.exe"="c:\program files\Lexmark X5400 Series\lxdvmon.exe" [2007-11-02 455336]
"lxdvamon"="c:\program files\Lexmark X5400 Series\lxdvamon.exe" [2007-11-02 25256]
"Lexmark X5400 Series Fax Server"="c:\program files\Lexmark X5400 Series\fm3032.exe" [2007-11-02 307880]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-29 1948440]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"CPM73f17527"="c:\windows\system32\reguligu.dll" [2009-07-26 85504]
"peyajuyipe"="c:\windows\system32\tuhenato.dll" [2009-04-26 50688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-4 113664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"= "c:\windows\system32\reguligu.dll" [2009-07-26 85504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"= {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\reguligu.dll [2009-07-26 85504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-29 04:13 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\BearShare\\BearShare.exe"=
"c:\\WINDOWS\\system32\\lxdvcoms.exe"=
"c:\\Program Files\\Lexmark X5400 Series\\lxdvmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvjswx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\WINDOWS\\explorer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)

R2 lxdvCATSCustConnectService;lxdvCATSCustConnectService;c:\windows\System32\spool\DRIVERS\W32X86\3\\lxdvserv.exe [2007-10-18 98984]
R3 Flash1;Flash1;c:\swsetup\SP36119\winphlash\Flash1.sys [2006-03-01 3456]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-07-04 335752]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-08 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-07-04 907032]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-06-29 298776]
S2 lxdv_device;lxdv_device;c:\windows\system32\lxdvcoms.exe [2007-10-18 594600]

.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.myspace.com
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
FF - ProfilePath - c:\documents and settings\Tony Gymetric\Application Data\Mozilla\Firefox\Profiles\r6htrlaj.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.myspace.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-26 18:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3020)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\tuhenato.dll
c:\windows\system32\reguligu.dll
.
———————— Other Running Processes ————————
.
c:\program files\SpywareGuard\sgmain.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-07-26 18:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-26 22:45

Pre-Run: 86,365,315,072 bytes free
Post-Run: 86,400,733,184 bytes free

220 — E O F — 2009-07-16 07:02

oldman960

Post #6July 27, 2009, 6:16 AM UTC

Hi electriccrayon,

You were cautioned against P2P programs in your last visit here, but I see Bearshare is still installed. Bearshare is listed as a "Caution" program in this list of safe/unsafe P2P programs.
http://malwareremoval.com/p2pindex.php

The same P2P warning as you recieved before still applies. You would be doing yourself a favor by uninstalling it.
http://forums.whatthetech.com/trojans_foun…935#entry580935

We will be using Combofix again but will run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/pop_up_problem_t105550.html

KillAll::

Collect::
c:\windows\system32\tupabezu.dll
c:\windows\system32\reguligu.dll
c:\windows\system32\yapiniti.dll
c:\windows\system32\duduhahi.dll
c:\windows\system32\tuhenato.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{abccdc55-d644-4c70-ab81-474306b921b4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPM73f17527"=-
"peyajuyipe"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"=-
[-HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}]
[-HKEY_CLASSES_ROOT\CLSID\{abccdc55-d644-4c70-ab81-474306b921b4}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=-

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

Please post back with the combofix log.

How is it now?

Thanks

electriccrayon

Post #7July 27, 2009, 6:34 AM UTC

the bearshare slipped my mind because i havent been using it the past few weeks…should i remove it before continuing with your last instructions?

electriccrayon

Post #8July 27, 2009, 7:29 AM UTC

ComboFix 09-07-26.01 - Tony Gymetric 07/27/2009 3:15.8.2 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Tony Gymetric\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

file zipped: c:\windows\system32\duduhahi.dll
file zipped: c:\windows\system32\reguligu.dll
file zipped: c:\windows\system32\tuhenato.dll
file zipped: c:\windows\system32\tupabezu.dll
file zipped: c:\windows\system32\yapiniti.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\duduhahi.dll
c:\windows\system32\reguligu.dll
c:\windows\system32\tuhenato.dll
c:\windows\system32\tupabezu.dll
c:\windows\system32\yapiniti.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-27 to 2009-07-27 )))))))))))))))))))))))))))))))
.

2009-07-18 13:04 . 2009-06-29 04:13 353048 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgxch32.dll
2009-07-18 13:04 . 2009-06-29 04:13 2301208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avguiadv.dll
2009-07-07 22:18 . 2009-07-07 22:18 ——– d—–w- c:\documents and settings\Tony Gymetric\Local Settings\Application Data\AVG Security Toolbar
2009-07-07 22:18 . 2009-07-07 22:18 ——– d—–w- c:\documents and settings\Tony Gymetric\Local Settings\Application Data\Mozilla
2009-07-04 21:05 . 2009-06-29 04:13 327688 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgldx86.sys
2009-07-04 21:05 . 2009-07-04 21:04 2054424 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgcorex.dll
2009-07-04 21:05 . 2009-07-04 21:04 2167576 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgresf.dll
2009-07-04 21:05 . 2009-06-29 04:13 906520 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgemc.exe
2009-07-04 21:05 . 2009-07-04 21:04 3403032 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgui.exe
2009-07-04 21:05 . 2009-06-29 04:13 1204504 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgabout.dll
2009-07-04 21:05 . 2009-06-29 04:12 337176 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avglogx.dll
2009-07-04 21:05 . 2009-06-29 04:12 829208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgcfgx.dll
2009-07-04 21:05 . 2009-06-29 04:12 3298072 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\setup.exe
2009-07-04 21:03 . 2009-06-29 04:11 1085208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgupd.exe
2009-07-04 21:03 . 2009-06-29 04:11 1454360 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgupd.dll
2009-06-29 09:35 . 2009-06-29 09:35 ——– d—–w- c:\documents and settings\Tony Gymetric\Application Data\com.imeem.DesktopUploader.6C3F108F466C0F04F30B58747CAA4DF34281133B.1
2009-06-29 09:35 . 2009-06-29 09:35 ——– d—–w- c:\program files\imeem Uploader
2009-06-29 09:33 . 2009-06-29 09:32 38208 —-a-w- c:\documents and settings\Tony Gymetric\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-06-29 09:33 . 2009-06-29 09:33 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-06-29 04:14 . 2009-06-29 04:14 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
2009-06-29 04:14 . 2009-06-29 04:14 ——– d—–w- c:\documents and settings\LocalService\Application Data\AVGTOOLBAR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-27 07:04 . 2008-08-04 13:36 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-07-27 07:03 . 2008-08-04 13:01 ——– d—–w- c:\program files\BearShare
2009-07-26 23:14 . 2009-04-26 23:14 85504 –sha-w- c:\windows\system32\pufuniso.dll
2009-07-23 05:51 . 2008-08-03 22:05 ——– d—–w- c:\program files\Java
2009-07-22 07:23 . 2008-12-16 03:33 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-22 07:23 . 2009-01-05 18:33 3775176 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-13 17:36 . 2008-12-16 03:33 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2008-12-16 03:33 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-04 21:04 . 2008-10-15 03:17 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-29 04:13 . 2008-10-15 03:17 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-29 04:13 . 2008-10-15 03:17 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-26 01:09 . 2008-08-04 12:55 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!
2009-06-16 14:36 . 2004-08-04 07:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 07:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-14 20:21 . 2009-06-14 20:21 152576 —-a-w- c:\documents and settings\Tony Gymetric\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-03 19:09 . 2004-08-04 07:00 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-26 23:50 . 2009-06-26 01:09 607472 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-21 15:33 . 2008-12-19 18:39 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-05-08 18:48 . 2008-10-15 03:17 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:32 . 2004-08-04 07:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 07:00 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-07-23 03:38 . 2009-07-07 22:03 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2004-08-04 07:00 . 2008-08-03 22:39 73728 –sha-w- c:\windows\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-07-26_22.41.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-27 07:19 . 2009-07-27 07:19 16384 c:\windows\temp\Perflib_Perfdata_268.dat
+ 2009-07-27 07:21 . 2009-07-27 07:21 176128 c:\windows\ERDNT\AutoBackup\7-27-2009\Users\00000002\UsrClass.dat
+ 2009-07-27 07:21 . 2005-10-20 17:02 163328 c:\windows\ERDNT\AutoBackup\7-27-2009\ERDNT.EXE
+ 2009-07-27 07:21 . 2009-07-27 07:21 4878336 c:\windows\ERDNT\AutoBackup\7-27-2009\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-25 7569408]
"hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"lxdvmon.exe"="c:\program files\Lexmark X5400 Series\lxdvmon.exe" [2007-11-02 455336]
"lxdvamon"="c:\program files\Lexmark X5400 Series\lxdvamon.exe" [2007-11-02 25256]
"Lexmark X5400 Series Fax Server"="c:\program files\Lexmark X5400 Series\fm3032.exe" [2007-11-02 307880]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-29 1948440]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

c:\documents and settings\Tony Gymetric\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-4 113664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-29 04:13 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\lxdvcoms.exe"=
"c:\\Program Files\\Lexmark X5400 Series\\lxdvmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvjswx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)

R2 lxdvCATSCustConnectService;lxdvCATSCustConnectService;c:\windows\System32\spool\DRIVERS\W32X86\3\\lxdvserv.exe [2007-10-18 98984]
R3 Flash1;Flash1;c:\swsetup\SP36119\winphlash\Flash1.sys [2006-03-01 3456]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-07-04 335752]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-08 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-07-04 907032]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-06-29 298776]
S2 lxdv_device;lxdv_device;c:\windows\system32\lxdvcoms.exe [2007-10-18 594600]

.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.myspace.com
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
FF - ProfilePath - c:\documents and settings\Tony Gymetric\Application Data\Mozilla\Firefox\Profiles\r6htrlaj.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.myspace.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 03:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2156)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-07-27 3:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-27 07:24
ComboFix2.txt 2009-07-26 22:45

Pre-Run: 86,406,012,928 bytes free
Post-Run: 86,401,966,080 bytes free

230 — E O F — 2009-07-16 07:02

oldman960

Post #9July 27, 2009, 1:28 PM UTC

Hi electriccrayon,

You can uninstall BearShare at anytime during this fix.

Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Reg

:Files
c:\windows\system32\pufuniso.dll

:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL log

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNcheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt This will saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

Please post back with

OTL fix log
MBAM log
new OTL.txt

How is the computer?

Thanks

electriccrayon

Post #10July 28, 2009, 12:04 AM UTC

i removed bearshare. it seems to be running ok but i havent gotten online much other than doing this cleanup. heres the requested logs in the order they where given

All processes killed
========== REGISTRY ==========
========== FILES ==========
File\Folder c:\windows\system32\pufuniso.dll not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: All Users.WINDOWS

User: Default User

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Tony Gymetric
->Temp folder emptied: 16745 bytes
->Temporary Internet Files folder emptied: 1431807 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3495371 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 2950 bytes

Total Files Cleaned = 4.75 mb

OTL by OldTimer - Version 3.0.10.3 log created on 07272009_194638

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

Malwarebytes' Anti-Malware 1.39
Database version: 2515
Windows 5.1.2600 Service Pack 3

7/27/2009 7:53:04 PM
mbam-log-2009-07-27 (19-53-04).txt

Scan type: Quick Scan
Objects scanned: 84380
Time elapsed: 2 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e24211b3-a78a-c6a9-d317-70979ace5058} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OTL logfile created on: 7/27/2009 7:57:18 PM - Run 2
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\Tony Gymetric\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.54 Mb Total Physical Memory | 553.09 Mb Available Physical Memory | 57.70% Memory free
2.26 Gb Paging File | 1.91 Gb Available in Paging File | 84.68% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 80.56 Gb Free Space | 72.07% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MOTOROLA
Current User Name: Tony Gymetric
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\taskswitch.exe ()
PRC - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe (Hewlett-Packard)
PRC - C:\Program Files\Lexmark X5400 Series\lxdvmon.exe ()
PRC - C:\Program Files\Lexmark X5400 Series\lxdvamon.exe ()
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\System32\lxdvcoms.exe ( )
PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\System32\wdfmgr.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe (Yahoo! Inc.)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Auto | Running]) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (lxdvCATSCustConnectService [Auto | Stopped]) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdvserv.exe (Lexmark International, Inc.)
SRV - (lxdv_device [Auto | Running]) – C:\WINDOWS\System32\lxdvcoms.exe ( )
SRV - (NVSvc [Auto | Running]) – C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
SRV - (NWCWorkstation [Auto | Running]) – C:\WINDOWS\System32\nwwks.dll (Microsoft Corporation)
SRV - (UMWdf [Auto | Running]) – C:\WINDOWS\System32\wdfmgr.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AmdK8 [System | Running]) – C:\WINDOWS\System32\DRIVERS\AmdK8.sys (Advanced Micro Devices)
DRV - (AvgLdx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (BCM43XX [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\bcmwl5.sys (Broadcom Corporation)
DRV - (Flash1 [On_Demand | Stopped]) – C:\SwSetup\SP36119\winphlash\Flash1.sys ()
DRV - (HdAudAddService [On_Demand | Running]) – C:\WINDOWS\System32\drivers\CHDAud.sys (Conexant Systems Inc.)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (HSFHWAZL [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (mdmxsdk [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvata [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (NVENETFD [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvnetbus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nvnetbus.sys (NVIDIA Corporation)
DRV - (nvsmu [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nvsmu.sys (NVIDIA Corporation)
DRV - (NwlnkIpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (NWRDR [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nwrdr.sys (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (rimmptsk [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rimmptsk.sys (REDC)
DRV - (rimsptsk [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rimsptsk.sys (REDC)
DRV - (rismxdp [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rixdptsk.sys (REDC)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (winachsf [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.myspace.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: avg@igeared:2.506.026.001
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.1
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type;=yahoo_avg_hs2-tb-web_us&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/07/01 03:02:42 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008/12/19 14:39:00 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/07/22 03:30:16 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/22 23:38:55 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/07/22 23:38:55 | 00,000,000 | —D | M]

[2009/07/07 18:18:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Extensions
[2009/07/07 18:18:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/07/26 03:32:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Firefox\Profiles\r6htrlaj.default\extensions
[2009/07/07 18:18:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Firefox\Profiles\r6htrlaj.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2008/12/12 14:23:54 | 00,002,158 | —- | M] () – C:\Documents and Settings\Tony Gymetric\Application Data\Mozilla\FireFox\Profiles\r6htrlaj.default\searchplugins\MySpace.xml
[2009/07/07 18:18:08 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/07/22 23:38:55 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/07/22 23:38:50 | 00,023,544 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/07/22 23:38:50 | 00,137,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/07/22 23:38:53 | 00,065,016 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009/06/24 07:27:00 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/06/24 07:27:00 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/07/07 18:18:30 | 00,001,498 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml
[2009/06/24 07:27:00 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/06/24 07:27:00 | 00,002,344 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/06/24 07:27:00 | 00,002,371 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/06/24 07:27:00 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/06/24 07:27:00 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe ()
O4 - HKLM..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Lexmark X5400 Series Fax Server] C:\Program Files\Lexmark X5400 Series\fm3032.exe ()
O4 - HKLM..\Run: [lxdvamon] C:\Program Files\Lexmark X5400 Series\lxdvamon.exe ()
O4 - HKLM..\Run: [lxdvmon.exe] C:\Program Files\Lexmark X5400 Series\lxdvmon.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Tony Gymetric\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Tony Gymetric\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_14.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/buxus/docs/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\windows\system32\pufuniso.dll) - C:\WINDOWS\System32\pufuniso.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/03 17:58:09 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/07/27 19:39:02 | 00,000,000 | —D | C] – C:\_OTL
[2009/07/27 19:38:39 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/07/27 03:17:54 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/07/26 18:27:37 | 00,219,648 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/07/26 18:27:37 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/07/26 18:27:37 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/07/26 18:27:37 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/07/26 18:27:37 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/07/26 18:27:37 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/07/26 18:27:37 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/07/26 18:27:37 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/07/26 18:27:30 | 00,000,000 | —D | C] – C:\Qoobox
[2009/07/26 18:26:26 | 03,150,907 | R— | C] () – C:\Documents and Settings\Tony Gymetric\Desktop\ComboFix.exe
[2009/07/26 07:41:52 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe
[2009/07/22 15:40:55 | 02,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe
[2009/07/22 15:40:55 | 02,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe
[2009/07/22 15:40:55 | 01,614,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll
[2009/07/22 15:40:55 | 01,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\explorer.exe
[2009/07/22 15:40:55 | 00,989,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kernel32.dll
[2009/07/22 15:40:55 | 00,927,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mfc40u.dll
[2009/07/22 15:40:55 | 00,827,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wininet.dll
[2009/07/22 15:40:55 | 00,792,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comres.dll
[2009/07/22 15:40:55 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comctl32.dll
[2009/07/22 15:40:55 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\user32.dll
[2009/07/22 15:40:55 | 00,507,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\winlogon.exe
[2009/07/22 15:40:55 | 00,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll
[2009/07/22 15:40:55 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rpcss.dll
[2009/07/22 15:40:55 | 00,361,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tcpip.sys
[2009/07/22 15:40:55 | 00,295,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\termsrv.dll
[2009/07/22 15:40:55 | 00,182,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ndis.sys
[2009/07/22 15:40:55 | 00,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\srsvc.dll
[2009/07/22 15:40:55 | 00,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\appmgmts.dll
[2009/07/22 15:40:55 | 00,142,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\aec.sys
[2009/07/22 15:40:55 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\services.exe
[2009/07/22 15:40:55 | 00,110,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\imm32.dll
[2009/07/22 15:40:55 | 00,088,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rasauto.dll
[2009/07/22 15:40:55 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ws2_32.dll
[2009/07/22 15:40:55 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\spoolsv.exe
[2009/07/22 15:40:55 | 00,051,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wuauclt.exe
[2009/07/22 15:40:55 | 00,036,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ip6fw.sys
[2009/07/22 15:40:55 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\msgsvc.dll
[2009/07/22 15:40:55 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\userinit.exe
[2009/07/22 15:40:55 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kbdclass.sys
[2009/07/22 15:40:55 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lpk.dll
[2009/07/22 15:40:55 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\powrprof.dll
[2009/07/22 15:40:55 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ctfmon.exe
[2009/07/22 15:40:55 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\svchost.exe
[2009/07/22 15:40:55 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lsass.exe
[2009/07/22 15:40:55 | 00,011,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\acpiec.sys
[2009/07/22 15:40:55 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfc.dll
[2009/07/22 15:40:55 | 00,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\null.sys
[2009/07/22 15:40:55 | 00,000,000 | —D | C] – C:\WINDOWS\System32\dllcache\cache
[2009/07/22 01:52:20 | 00,000,000 | —- | C] () – C:\1891780116
[2009/07/10 08:31:14 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\My Documents\Downloads
[2009/07/07 18:18:30 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\AVG Security Toolbar
[2009/07/07 18:18:03 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\Mozilla
[2009/07/07 18:03:32 | 00,001,602 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2009/07/07 18:03:29 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2009/07/05 18:49:42 | 00,265,216 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\TFC.exe
[2009/06/29 05:35:38 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Application Data\com.imeem.DesktopUploader.6C3F108F466C0F04F30B58747CAA4DF34281133B.1
[2009/06/29 05:35:09 | 00,000,690 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\imeem Uploader.lnk
[2009/06/29 05:35:09 | 00,000,000 | —D | C] – C:\Program Files\imeem Uploader
[2009/06/29 05:33:09 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2009/06/29 00:14:44 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2009/04/21 14:08:16 | 00,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/04/21 14:08:14 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/04/21 14:08:14 | 00,795,648 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/04/21 14:08:14 | 00,130,048 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/04/21 14:08:13 | 00,067,584 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/04/21 14:08:13 | 00,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/11/06 01:36:40 | 00,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2008/09/06 18:20:46 | 00,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/08/24 13:09:40 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\LXDVPMON.DLL
[2008/08/24 13:09:40 | 00,032,768 | —- | C] () – C:\WINDOWS\System32\LXDVFXPU.DLL
[2008/08/24 13:09:20 | 00,069,632 | —- | C] () – C:\WINDOWS\System32\lxdvoem.dll
[2008/08/24 12:58:53 | 00,000,060 | -H– | C] () – C:\WINDOWS\System32\lxdvrwrd.ini
[2008/08/24 12:58:51 | 00,438,272 | —- | C] ( ) – C:\WINDOWS\System32\LXDVhcp.dll
[2008/08/24 12:58:51 | 00,348,160 | —- | C] () – C:\WINDOWS\System32\LXDVinst.dll
[2008/08/24 12:56:55 | 00,348,160 | R— | C] () – C:\WINDOWS\System32\lxdvcoin.dll
[2008/08/03 18:13:09 | 00,016,480 | —- | C] () – C:\WINDOWS\System32\rixdicon.dll
[2008/02/11 10:39:26 | 00,253,952 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLA.dll
[2008/02/11 10:39:18 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLW.dll
[2008/02/08 14:53:46 | 00,110,592 | —- | C] () – C:\WINDOWS\System32\OnlineScannerLang.dll
[2007/10/09 02:34:16 | 00,208,896 | —- | C] () – C:\WINDOWS\System32\lxdvgrd.dll
[2007/09/20 16:12:56 | 00,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxdvpmui.dll
[2007/09/20 16:09:35 | 01,069,056 | —- | C] ( ) – C:\WINDOWS\System32\lxdvserv.dll
[2007/09/20 16:06:19 | 00,569,344 | —- | C] ( ) – C:\WINDOWS\System32\lxdvlmpm.dll
[2007/09/20 16:06:19 | 00,339,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdviesc.dll
[2007/09/20 16:06:04 | 00,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxdvcomm.dll
[2007/09/20 16:05:01 | 00,663,552 | —- | C] ( ) – C:\WINDOWS\System32\lxdvhbn3.dll
[2007/09/20 16:04:32 | 00,954,368 | —- | C] ( ) – C:\WINDOWS\System32\lxdvusb1.dll
[2007/09/20 16:04:01 | 00,851,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdvcomc.dll
[2007/09/20 16:02:58 | 00,053,248 | —- | C] ( ) – C:\WINDOWS\System32\lxdvprox.dll
[2007/09/20 16:01:11 | 00,360,448 | —- | C] ( ) – C:\WINDOWS\System32\lxdvinpa.dll
[2007/09/06 16:40:36 | 00,692,224 | —- | C] () – C:\WINDOWS\System32\lxdvdrs.dll
[2007/08/10 15:49:54 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\lxdvcaps.dll
[2007/07/27 15:49:02 | 00,225,355 | —- | C] () – C:\WINDOWS\System32\lnod32apiW.dll
[2007/07/27 15:49:02 | 00,196,683 | —- | C] () – C:\WINDOWS\System32\lnod32apiA.dll
[2007/07/16 13:53:09 | 00,069,632 | —- | C] () – C:\WINDOWS\System32\lxdvcnv4.dll
[2006/08/25 01:40:00 | 01,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/25 01:40:00 | 01,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/25 01:40:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/25 01:40:00 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/25 01:40:00 | 00,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/08/01 01:53:18 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\lxdvvs.dll
[2005/12/05 20:25:22 | 00,139,264 | —- | C] () – C:\WINDOWS\System32\lnod32umc.dll
[2005/12/05 13:37:10 | 00,106,496 | —- | C] () – C:\WINDOWS\System32\lnod32upd.dll
[2005/04/27 21:42:49 | 00,000,068 | —- | C] () – C:\WINDOWS\System32\oobeinfo.ini
[2004/08/04 03:00:00 | 00,000,477 | —- | C] () – C:\WINDOWS\win.ini
[2004/08/04 03:00:00 | 00,000,246 | —- | C] () – C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[2009/07/27 19:55:13 | 00,050,868 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009/07/27 19:55:05 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/07/27 19:55:04 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/07/27 04:38:46 | 39,303,246 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/07/27 04:38:46 | 00,041,806 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/07/27 03:21:21 | 00,000,246 | —- | M] () – C:\WINDOWS\system.ini
[2009/07/27 03:21:09 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/07/27 03:14:29 | 00,011,168 | -H– | M] () – C:\WINDOWS\System32\gotufife
[2009/07/27 03:09:03 | 03,150,907 | R— | M] () – C:\Documents and Settings\Tony Gymetric\Desktop\ComboFix.exe
[2009/07/26 07:42:04 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe
[2009/07/26 02:49:24 | 00,013,758 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/26 02:47:35 | 04,804,404 | -H– | M] () – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\IconCache.db
[2009/07/22 01:52:20 | 00,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2009/07/22 01:52:20 | 00,000,000 | —- | M] () – C:\1891780116
[2009/07/16 03:02:37 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/07/13 13:36:34 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/07/13 13:36:12 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/07/13 05:48:54 | 00,219,648 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/07/07 18:03:32 | 00,001,602 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2009/07/05 18:50:49 | 00,265,216 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\TFC.exe
[2009/07/04 17:04:31 | 00,335,752 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/06/29 16:25:32 | 00,463,779 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/06/29 05:35:09 | 00,000,690 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\imeem Uploader.lnk
[2009/06/29 00:13:23 | 00,011,952 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2009/06/29 00:13:22 | 00,027,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D1B5B4F1
< End of report >

oldman960

Post #11July 28, 2009, 1:40 AM UTC

Hi electriccrayon,

Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:OTL
O20 - AppInit_DLLs: (c:\windows\system32\pufuniso.dll) - C:\WINDOWS\System32\pufuniso.dll File not found

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions.
You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
Click on My Computerr under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Change the Files of type to Text file (.txt)
Set the Save In to Desktop
click the Save button.
Please post this log in your next reply along with a OTL log.

Pleae post back with

Kaspersky log
new OTL log

Thanks

electriccrayon

Post #12July 28, 2009, 3:44 AM UTC

kaspersky is telling me i need to install a java that i already have installed. just to be sure i re-installed the version from the link on the kaspersky site, and it still pops up and says i need to install it…heres the otl log ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\pufuniso.dll deleted successfully. OTL by OldTimer - Version 3.0.10.3 log created on 07272009_232535

oldman960

Post #13July 28, 2009, 6:11 AM UTC

Hi

Kasperskey gets persnickerty sometimes, use this one instead.

Go here to run an online scannner from ESET:
http://www.eset.eu/online-scanner

(Note: You must use Internet Explorer for this scan.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
Re-enable your Antivirus software.
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. We will need this later.

Please post back with the ESET log and a new OTL log.

Thanks

electriccrayon

Post #14July 28, 2009, 7:19 AM UTC

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=7.00.6000.16850 (vista_gdr.090423-0018)
# OnlineScanner.ocx=1.0.0.5886
# api_version=3.0.2
# EOSSerial=e2a3a6a5c504ab4dbf920b56401c4a30
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-07-28 07:04:54
# local_time=2009-07-28 03:04:54 (-0500, Eastern Daylight Time)
# country="United States"
# lang=9
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1026 37 83 100 8424319218750
# scanned=43612
# found=6
# cleaned=0
# scan_time=1117
C:\Documents and Settings\Tony Gymetric\My Documents\My Music\go for a soda.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hididofu.dll.vir a variant of Win32/Kryptik.XN trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E2D965B9-2302-42B0-99CC-4C8CE0B5FAB5}\RP4\A0000084.dll a variant of Win32/Kryptik.XN trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E2D965B9-2302-42B0-99CC-4C8CE0B5FAB5}\RP4\A0000085.dll a variant of Win32/Kryptik.XN trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{E2D965B9-2302-42B0-99CC-4C8CE0B5FAB5}\RP4\A0000086.dll a variant of Win32/Kryptik.XN trojan 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\07272009_193902\windows\system32\pufuniso.dll a variant of Win32/Kryptik.XN trojan 00000000000000000000000000000000 I

OTL logfile created on: 7/28/2009 3:16:08 AM - Run 3
OTL by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\Tony Gymetric\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.54 Mb Total Physical Memory | 492.61 Mb Available Physical Memory | 51.39% Memory free
2.26 Gb Paging File | 1.87 Gb Available in Paging File | 82.83% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 80.35 Gb Free Space | 71.88% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MOTOROLA
Current User Name: Tony Gymetric
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\taskswitch.exe ()
PRC - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe (Hewlett-Packard)
PRC - C:\Program Files\Lexmark X5400 Series\lxdvmon.exe ()
PRC - C:\Program Files\Lexmark X5400 Series\lxdvamon.exe ()
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\System32\lxdvcoms.exe ( )
PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\System32\wdfmgr.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe (Yahoo! Inc.)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\AVG\AVG8\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (avg8emc [Auto | Running]) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (lxdvCATSCustConnectService [Auto | Stopped]) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdvserv.exe (Lexmark International, Inc.)
SRV - (lxdv_device [Auto | Running]) – C:\WINDOWS\System32\lxdvcoms.exe ( )
SRV - (NVSvc [Auto | Running]) – C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
SRV - (NWCWorkstation [Auto | Running]) – C:\WINDOWS\System32\nwwks.dll (Microsoft Corporation)
SRV - (UMWdf [Auto | Running]) – C:\WINDOWS\System32\wdfmgr.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AmdK8 [System | Running]) – C:\WINDOWS\System32\DRIVERS\AmdK8.sys (Advanced Micro Devices)
DRV - (AvgLdx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (BCM43XX [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\bcmwl5.sys (Broadcom Corporation)
DRV - (Flash1 [On_Demand | Stopped]) – C:\SwSetup\SP36119\winphlash\Flash1.sys ()
DRV - (HdAudAddService [On_Demand | Running]) – C:\WINDOWS\System32\drivers\CHDAud.sys (Conexant Systems Inc.)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (HSFHWAZL [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (mdmxsdk [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvata [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (NVENETFD [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvnetbus [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nvnetbus.sys (NVIDIA Corporation)
DRV - (nvsmu [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nvsmu.sys (NVIDIA Corporation)
DRV - (NwlnkIpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)
DRV - (NWRDR [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nwrdr.sys (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (rimmptsk [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rimmptsk.sys (REDC)
DRV - (rimsptsk [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rimsptsk.sys (REDC)
DRV - (rismxdp [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\rixdptsk.sys (REDC)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (winachsf [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://www.myspace.com/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: avg@igeared:2.506.026.001
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.1
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type;=yahoo_avg_hs2-tb-web_us&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/07/01 03:02:42 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/07/22 03:30:16 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/07/27 23:33:19 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/22 23:38:55 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/07/27 23:33:31 | 00,000,000 | —D | M]

[2009/07/07 18:18:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Extensions
[2009/07/07 18:18:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/07/26 03:32:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Firefox\Profiles\r6htrlaj.default\extensions
[2009/07/07 18:18:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\mozilla\Firefox\Profiles\r6htrlaj.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2008/12/12 14:23:54 | 00,002,158 | —- | M] () – C:\Documents and Settings\Tony Gymetric\Application Data\Mozilla\FireFox\Profiles\r6htrlaj.default\searchplugins\MySpace.xml
[2009/07/27 23:33:31 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/07/22 23:38:55 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/07/27 23:33:31 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/07/22 23:38:50 | 00,023,544 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/07/22 23:38:50 | 00,137,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/07/27 23:33:18 | 00,410,984 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2009/07/22 23:38:53 | 00,065,016 | —- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2009/06/24 07:27:00 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/06/24 07:27:00 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/07/07 18:18:30 | 00,001,498 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml
[2009/06/24 07:27:00 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/06/24 07:27:00 | 00,002,344 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/06/24 07:27:00 | 00,002,371 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/06/24 07:27:00 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/06/24 07:27:00 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe ()
O4 - HKLM..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Lexmark X5400 Series Fax Server] C:\Program Files\Lexmark X5400 Series\fm3032.exe ()
O4 - HKLM..\Run: [lxdvamon] C:\Program Files\Lexmark X5400 Series\lxdvamon.exe ()
O4 - HKLM..\Run: [lxdvmon.exe] C:\Program Files\Lexmark X5400 Series\lxdvmon.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Tony Gymetric\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Tony Gymetric\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/buxus/docs/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/03 17:58:09 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/07/28 02:41:27 | 00,000,000 | —D | C] – C:\WINDOWS\LastGood
[2009/07/28 02:41:26 | 00,000,000 | —D | C] – C:\Program Files\ESET
[2009/07/27 23:33:31 | 00,148,888 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/07/27 23:33:31 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/07/27 23:33:31 | 00,144,792 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/07/27 23:33:31 | 00,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/07/27 23:33:14 | 00,000,000 | —D | C] – C:\Program Files\Java
[2009/07/27 23:32:23 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
[2009/07/27 19:39:02 | 00,000,000 | —D | C] – C:\_OTL
[2009/07/27 19:38:39 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/07/27 03:17:54 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/07/26 18:27:37 | 00,219,648 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/07/26 18:27:37 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/07/26 18:27:37 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/07/26 18:27:37 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/07/26 18:27:37 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/07/26 18:27:37 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/07/26 18:27:37 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/07/26 18:27:37 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/07/26 18:27:30 | 00,000,000 | —D | C] – C:\Qoobox
[2009/07/26 18:26:26 | 03,150,907 | R— | C] () – C:\Documents and Settings\Tony Gymetric\Desktop\ComboFix.exe
[2009/07/26 07:41:52 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe
[2009/07/22 15:40:55 | 02,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe
[2009/07/22 15:40:55 | 02,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe
[2009/07/22 15:40:55 | 01,614,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll
[2009/07/22 15:40:55 | 01,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\explorer.exe
[2009/07/22 15:40:55 | 00,989,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kernel32.dll
[2009/07/22 15:40:55 | 00,927,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mfc40u.dll
[2009/07/22 15:40:55 | 00,827,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wininet.dll
[2009/07/22 15:40:55 | 00,792,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comres.dll
[2009/07/22 15:40:55 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comctl32.dll
[2009/07/22 15:40:55 | 00,578,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\user32.dll
[2009/07/22 15:40:55 | 00,507,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\winlogon.exe
[2009/07/22 15:40:55 | 00,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll
[2009/07/22 15:40:55 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rpcss.dll
[2009/07/22 15:40:55 | 00,361,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tcpip.sys
[2009/07/22 15:40:55 | 00,295,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\termsrv.dll
[2009/07/22 15:40:55 | 00,182,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ndis.sys
[2009/07/22 15:40:55 | 00,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\srsvc.dll
[2009/07/22 15:40:55 | 00,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\appmgmts.dll
[2009/07/22 15:40:55 | 00,142,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\aec.sys
[2009/07/22 15:40:55 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\services.exe
[2009/07/22 15:40:55 | 00,110,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\imm32.dll
[2009/07/22 15:40:55 | 00,088,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rasauto.dll
[2009/07/22 15:40:55 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ws2_32.dll
[2009/07/22 15:40:55 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\spoolsv.exe
[2009/07/22 15:40:55 | 00,051,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wuauclt.exe
[2009/07/22 15:40:55 | 00,036,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ip6fw.sys
[2009/07/22 15:40:55 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\msgsvc.dll
[2009/07/22 15:40:55 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\userinit.exe
[2009/07/22 15:40:55 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kbdclass.sys
[2009/07/22 15:40:55 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lpk.dll
[2009/07/22 15:40:55 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\powrprof.dll
[2009/07/22 15:40:55 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ctfmon.exe
[2009/07/22 15:40:55 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\svchost.exe
[2009/07/22 15:40:55 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lsass.exe
[2009/07/22 15:40:55 | 00,011,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\acpiec.sys
[2009/07/22 15:40:55 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfc.dll
[2009/07/22 15:40:55 | 00,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\null.sys
[2009/07/22 15:40:55 | 00,000,000 | —D | C] – C:\WINDOWS\System32\dllcache\cache
[2009/07/22 01:52:20 | 00,000,000 | —- | C] () – C:\1891780116
[2009/07/10 08:31:14 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\My Documents\Downloads
[2009/07/07 18:18:30 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\AVG Security Toolbar
[2009/07/07 18:18:03 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\Mozilla
[2009/07/07 18:03:32 | 00,001,602 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2009/07/07 18:03:29 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2009/07/05 18:49:42 | 00,265,216 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\TFC.exe
[2009/06/29 05:35:38 | 00,000,000 | —D | C] – C:\Documents and Settings\Tony Gymetric\Application Data\com.imeem.DesktopUploader.6C3F108F466C0F04F30B58747CAA4DF34281133B.1
[2009/06/29 05:35:09 | 00,000,690 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\imeem Uploader.lnk
[2009/06/29 05:35:09 | 00,000,000 | —D | C] – C:\Program Files\imeem Uploader
[2009/06/29 05:33:09 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2009/06/29 00:14:44 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2009/04/21 14:08:16 | 00,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/04/21 14:08:14 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/04/21 14:08:14 | 00,795,648 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/04/21 14:08:14 | 00,130,048 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/04/21 14:08:13 | 00,067,584 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/04/21 14:08:13 | 00,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/11/06 01:36:40 | 00,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2008/09/06 18:20:46 | 00,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/08/24 13:09:40 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\LXDVPMON.DLL
[2008/08/24 13:09:40 | 00,032,768 | —- | C] () – C:\WINDOWS\System32\LXDVFXPU.DLL
[2008/08/24 13:09:20 | 00,069,632 | —- | C] () – C:\WINDOWS\System32\lxdvoem.dll
[2008/08/24 12:58:53 | 00,000,060 | -H– | C] () – C:\WINDOWS\System32\lxdvrwrd.ini
[2008/08/24 12:58:51 | 00,438,272 | —- | C] ( ) – C:\WINDOWS\System32\LXDVhcp.dll
[2008/08/24 12:58:51 | 00,348,160 | —- | C] () – C:\WINDOWS\System32\LXDVinst.dll
[2008/08/24 12:56:55 | 00,348,160 | R— | C] () – C:\WINDOWS\System32\lxdvcoin.dll
[2008/08/03 18:13:09 | 00,016,480 | —- | C] () – C:\WINDOWS\System32\rixdicon.dll
[2008/02/11 10:39:26 | 00,253,952 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLA.dll
[2008/02/11 10:39:18 | 00,237,568 | —- | C] () – C:\WINDOWS\System32\OnlineScannerDLLW.dll
[2008/02/08 14:53:46 | 00,110,592 | —- | C] () – C:\WINDOWS\System32\OnlineScannerLang.dll
[2007/10/09 02:34:16 | 00,208,896 | —- | C] () – C:\WINDOWS\System32\lxdvgrd.dll
[2007/09/20 16:12:56 | 00,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxdvpmui.dll
[2007/09/20 16:09:35 | 01,069,056 | —- | C] ( ) – C:\WINDOWS\System32\lxdvserv.dll
[2007/09/20 16:06:19 | 00,569,344 | —- | C] ( ) – C:\WINDOWS\System32\lxdvlmpm.dll
[2007/09/20 16:06:19 | 00,339,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdviesc.dll
[2007/09/20 16:06:04 | 00,364,544 | —- | C] ( ) – C:\WINDOWS\System32\lxdvcomm.dll
[2007/09/20 16:05:01 | 00,663,552 | —- | C] ( ) – C:\WINDOWS\System32\lxdvhbn3.dll
[2007/09/20 16:04:32 | 00,954,368 | —- | C] ( ) – C:\WINDOWS\System32\lxdvusb1.dll
[2007/09/20 16:04:01 | 00,851,968 | —- | C] ( ) – C:\WINDOWS\System32\lxdvcomc.dll
[2007/09/20 16:02:58 | 00,053,248 | —- | C] ( ) – C:\WINDOWS\System32\lxdvprox.dll
[2007/09/20 16:01:11 | 00,360,448 | —- | C] ( ) – C:\WINDOWS\System32\lxdvinpa.dll
[2007/09/06 16:40:36 | 00,692,224 | —- | C] () – C:\WINDOWS\System32\lxdvdrs.dll
[2007/08/10 15:49:54 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\lxdvcaps.dll
[2007/07/27 15:49:02 | 00,225,355 | —- | C] () – C:\WINDOWS\System32\lnod32apiW.dll
[2007/07/27 15:49:02 | 00,196,683 | —- | C] () – C:\WINDOWS\System32\lnod32apiA.dll
[2007/07/16 13:53:09 | 00,069,632 | —- | C] () – C:\WINDOWS\System32\lxdvcnv4.dll
[2006/08/25 01:40:00 | 01,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/25 01:40:00 | 01,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/25 01:40:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/25 01:40:00 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/25 01:40:00 | 00,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/08/01 01:53:18 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\lxdvvs.dll
[2005/12/05 20:25:22 | 00,139,264 | —- | C] () – C:\WINDOWS\System32\lnod32umc.dll
[2005/12/05 13:37:10 | 00,106,496 | —- | C] () – C:\WINDOWS\System32\lnod32upd.dll
[2005/04/27 21:42:49 | 00,000,068 | —- | C] () – C:\WINDOWS\System32\oobeinfo.ini
[2004/08/04 03:00:00 | 00,000,477 | —- | C] () – C:\WINDOWS\win.ini
[2004/08/04 03:00:00 | 00,000,246 | —- | C] () – C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[2009/07/27 23:38:38 | 00,050,868 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009/07/27 23:38:32 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/07/27 23:38:31 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/07/27 23:37:17 | 04,805,486 | -H– | M] () – C:\Documents and Settings\Tony Gymetric\Local Settings\Application Data\IconCache.db
[2009/07/27 23:33:18 | 00,410,984 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2009/07/27 23:33:18 | 00,148,888 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/07/27 23:33:18 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/07/27 23:33:18 | 00,144,792 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2009/07/27 23:33:18 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2009/07/27 04:38:46 | 39,303,246 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/07/27 04:38:46 | 00,041,806 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/07/27 03:21:21 | 00,000,246 | —- | M] () – C:\WINDOWS\system.ini
[2009/07/27 03:21:09 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/07/27 03:14:29 | 00,011,168 | -H– | M] () – C:\WINDOWS\System32\gotufife
[2009/07/27 03:09:03 | 03,150,907 | R— | M] () – C:\Documents and Settings\Tony Gymetric\Desktop\ComboFix.exe
[2009/07/26 07:42:04 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\OTL.exe
[2009/07/26 02:49:24 | 00,013,758 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/22 01:52:20 | 00,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2009/07/22 01:52:20 | 00,000,000 | —- | M] () – C:\1891780116
[2009/07/16 03:02:37 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/07/13 13:36:34 | 00,038,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/07/13 13:36:12 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/07/13 05:48:54 | 00,219,648 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/07/07 18:03:32 | 00,001,602 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2009/07/05 18:50:49 | 00,265,216 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tony Gymetric\Desktop\TFC.exe
[2009/07/04 17:04:31 | 00,335,752 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/06/29 16:25:32 | 00,463,779 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/06/29 05:35:09 | 00,000,690 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\imeem Uploader.lnk
[2009/06/29 00:13:23 | 00,011,952 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2009/06/29 00:13:22 | 00,027,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys

========== LOP Check ==========

[2009/06/29 00:14:44 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data
[2009/06/29 00:14:44 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
[2008/08/03 18:05:30 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\CyberLink
[2008/08/04 09:09:13 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
[2009/07/27 23:22:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2008/08/24 13:09:08 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\X5400 Series
[2009/06/29 05:35:38 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Tony Gymetric\Application Data
[2008/10/15 03:20:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\AVGTOOLBAR
[2009/06/29 05:35:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\com.imeem.DesktopUploader.6C3F108F466C0F04F30B58747CAA4DF34281133B.1
[2008/08/07 21:21:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\CyberLink
[2008/08/08 04:36:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\Grisoft
[2008/10/01 16:58:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\Lexmark Productivity Studio
[2009/01/14 02:05:32 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\WinPatrol
[2008/08/24 18:40:21 | 00,000,000 | —D | M] – C:\Documents and Settings\Tony Gymetric\Application Data\X5400 Series
[2004/08/04 03:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/07/27 23:38:32 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D1B5B4F1
< End of report >

oldman960

Post #15July 28, 2009, 1:42 PM UTC

Hi electriccrayon,

Not too bad, just one file to remove. The other detections wll be removed when we clean up the tools.

First though

We need some file informantion

Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the following file path, into the "Suspicious files to scan" box on the top of the page:

C:\WINDOWS\System32\gotufife
Click on the Upload button
If a pop-up appears saying the file has been scanned already, please select the ReScan button.
Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
Paste the contents of the Clipboard in your next reply.

Please post back with

VirScan results

How's the computer?

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] pop up problem

✨ Ask AI

Ask AI