What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Your System Is Infected...

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
1

OTL logfile created on: 1/18/2010 5:02:37 PM - Run 3
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\Kevin\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 70.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 161.94 Gb Free Space | 69.54% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KEVIN-6768101E8
Current User Name: Kevin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Documents and Settings\Kevin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\NOS\bin\getPlusPlus_Adobe.exe (NOS Microsystems Ltd.)
PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (NVIDIA Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Kevin\Desktop\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (NVSvc) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (avp) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (npggsvc) – C:\WINDOWS\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (gupdate1c9f211c636327a) Google Update Service (gupdate1c9f211c636327a) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe ()
SRV - (nSvcIp) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (NVIDIA Corporation)


========== Driver Services (SafeList) ==========

DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (klif) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (kl1) – C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (klbg) – C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (npf) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (nvata) – C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (nvatabus) – C:\WINDOWS\system32\drivers\nvatabus.sys (NVIDIA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (NVTCP) – C:\WINDOWS\system32\drivers\nvtcp.sys (NVIDIA Corporation)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (SaiH040B) – C:\WINDOWS\system32\drivers\SaiH040B.sys (Saitek)
DRV - (SaiU040B) – C:\WINDOWS\system32\drivers\SaiU040B.sys (Saitek)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.alienware.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.463
FF - prefs.js..extensions.enabledItems: [removed]:1.5
FF - prefs.js..keyword.URL: "http://search.freecause.com/search?fr=freecause&ourmark;=3&type;=58819&p;="

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 06:20:44 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/18 16:59:44 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/08/23 14:56:30 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010/01/18 16:59:44 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2009/08/23 14:55:17 | 00,000,000 | —D | M]

[2009/04/11 10:40:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Mozilla\Extensions
[2009/04/11 10:40:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Mozilla\Extensions\[removed]
[2010/01/18 16:57:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\lgilp8g5.default\extensions
[2010/01/18 16:57:25 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\lgilp8g5.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/12/19 11:29:10 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Profiles\lgilp8g5.default\extensions\[removed]
[2010/01/18 16:57:34 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/08/23 14:56:31 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]

O1 HOSTS File: ([2010/01/17 12:33:42 | 00,373,517 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 12874 more lines…
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O9 - Extra Button: &Virtual; keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: URLs c&heck; - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O15 - HKLM\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kevin\Application Data\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2008/12/13 07:38:19 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/18 16:59:06 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/01/18 16:58:17 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2010/01/18 16:57:33 | 00,000,000 | —D | C] – C:\Program Files\NOS
[2010/01/18 16:57:33 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2010/01/18 16:45:11 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/01/18 16:45:09 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/01/18 16:44:41 | 00,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/01/18 16:44:40 | 00,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/18 16:44:40 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/18 16:44:40 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/18 16:44:15 | 00,000,000 | —D | C] – C:\Program Files\Java
[2010/01/18 16:42:48 | 16,254,752 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\Kevin\Desktop\jre-6u18-windows-i586.exe
[2010/01/18 09:02:18 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\Desktop\GooredFix Backups
[2010/01/18 09:02:00 | 00,070,858 | —- | C] (jpshortstuff) – C:\Documents and Settings\Kevin\Desktop\GooredFix.exe
[2010/01/18 00:25:47 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\Application Data\Malwarebytes
[2010/01/18 00:25:42 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/18 00:25:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/01/18 00:25:40 | 00,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/18 00:25:40 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/18 00:24:27 | 05,115,824 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Kevin\Desktop\mbam-setup.exe
[2010/01/17 23:30:21 | 00,000,000 | —D | C] – C:\Program Files\ESET
[2010/01/17 22:26:37 | 00,000,000 | —D | C] – C:\_OTL
[2010/01/17 18:04:01 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Kevin\Desktop\OTL.exe
[2010/01/17 15:31:10 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/01/17 15:00:44 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/01/17 12:28:34 | 00,064,288 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/01/17 12:28:34 | 00,000,000 | —D | C] – C:\WINDOWS\System32\DRVSTORE
[2010/01/17 12:10:43 | 00,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/01/17 12:10:18 | 00,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/01/15 09:34:51 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Desktop
[2010/01/13 06:26:43 | 00,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aclayers.dll
[2010/01/08 20:33:23 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\My Documents\EveHQ
[2010/01/08 20:33:23 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\Application Data\EveHQ
[2010/01/06 01:37:45 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\My Documents\EVE
[2010/01/06 01:37:39 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\Local Settings\Application Data\CCP
[2010/01/05 21:34:21 | 00,000,000 | —D | C] – C:\Program Files\CCP
[2010/01/05 21:34:21 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\CCP
[2010/01/02 13:02:38 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\Application Data\Battle Tanks
[2009/12/24 16:37:41 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusb.dll
[2009/12/24 16:37:40 | 00,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusd.dll
[2009/12/22 20:34:19 | 00,000,000 | —D | C] – C:\Documents and Settings\Kevin\Application Data\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2009/12/22 20:15:21 | 05,501,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dcsx_42.dll
[2009/12/22 20:15:21 | 01,974,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_42.dll
[2009/12/22 20:15:21 | 00,515,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_5.dll
[2009/12/22 20:15:21 | 00,238,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_5.dll
[2009/12/22 20:15:21 | 00,235,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx11_42.dll
[2009/12/22 20:15:20 | 00,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_42.dll
[2009/12/22 20:15:19 | 01,892,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_42.dll
[2009/12/22 20:11:20 | 00,000,000 | —D | C] – C:\Program Files\League of Legends
[2009/07/21 22:12:00 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/07/03 16:34:12 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/06/25 07:32:31 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/06/20 20:44:12 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2008/12/13 07:40:50 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/12/13 07:38:19 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/01/18 16:59:44 | 00,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/01/18 16:58:43 | 00,000,732 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Acrobat_com.lnk
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/01/18 16:54:40 | 00,004,452 | —- | M] () – C:\WINDOWS\System32\nvdb02.adghz
[2010/01/18 16:54:00 | 00,243,457 | —- | M] () – C:\WINDOWS\System32\NvApps.xml
[2010/01/18 16:53:58 | 00,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/01/18 16:53:58 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/18 16:53:56 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/18 16:53:02 | 07,077,888 | -H– | M] () – C:\Documents and Settings\Kevin\NTUSER.DAT
[2010/01/18 16:53:02 | 00,000,178 | -HS- | M] () – C:\Documents and Settings\Kevin\ntuser.ini
[2010/01/18 16:49:00 | 00,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/01/18 16:44:20 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/18 16:44:20 | 00,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/18 16:44:20 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/18 16:44:20 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/18 16:44:20 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/01/18 16:42:50 | 16,254,752 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Kevin\Desktop\jre-6u18-windows-i586.exe
[2010/01/18 16:32:37 | 00,001,257 | —- | M] () – C:\Documents and Settings\Kevin\Desktop\1263850349320-integrated.jnlp
[2010/01/18 12:59:46 | 00,000,000 | —- | M] () – C:\Documents
[2010/01/18 09:02:00 | 00,070,858 | —- | M] (jpshortstuff) – C:\Documents and Settings\Kevin\Desktop\GooredFix.exe
[2010/01/18 00:25:44 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/18 00:24:28 | 05,115,824 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Kevin\Desktop\mbam-setup.exe
[2010/01/17 23:30:09 | 02,672,312 | —- | M] () – C:\Documents and Settings\Kevin\Desktop\esetsmartinstaller_enu.exe
[2010/01/17 18:17:03 | 00,284,915 | —- | M] () – C:\Documents and Settings\Kevin\Desktop\gmer.zip
[2010/01/17 18:04:01 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Kevin\Desktop\OTL.exe
[2010/01/17 18:00:05 | 00,290,816 | —- | M] () – C:\Documents and Settings\Kevin\Desktop\exeHelper.com
[2010/01/17 15:00:44 | 00,001,734 | —- | M] () – C:\Documents and Settings\Kevin\Desktop\HijackThis.lnk
[2010/01/17 12:33:42 | 00,373,517 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/17 12:33:01 | 00,373,517 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100117-123342.backup
[2010/01/17 11:50:03 | 00,521,942 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/01/17 11:50:03 | 00,441,454 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/17 11:50:03 | 00,071,264 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/13 06:58:25 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/07 16:07:14 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/07 16:07:04 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/29 06:46:16 | 00,006,144 | —- | M] () – C:\Documents and Settings\Kevin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2010/01/18 16:59:44 | 00,001,729 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/01/18 16:58:43 | 00,000,732 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Acrobat_com.lnk
[2010/01/18 16:32:36 | 00,001,257 | —- | C] () – C:\Documents and Settings\Kevin\Desktop\1263850349320-integrated.jnlp
[2010/01/18 09:05:37 | 00,000,000 | —- | C] () – C:\Documents
[2010/01/18 00:25:44 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/17 23:30:09 | 02,672,312 | —- | C] () – C:\Documents and Settings\Kevin\Desktop\esetsmartinstaller_enu.exe
[2010/01/17 23:18:42 | 00,004,452 | —- | C] () – C:\WINDOWS\System32\nvdb02.adghz
[2010/01/17 18:17:13 | 00,293,376 | —- | C] () – C:\Documents and Settings\Kevin\Desktop\gmer.exe
[2010/01/17 18:17:02 | 00,284,915 | —- | C] () – C:\Documents and Settings\Kevin\Desktop\gmer.zip
[2010/01/17 18:00:05 | 00,290,816 | —- | C] () – C:\Documents and Settings\Kevin\Desktop\exeHelper.com
[2010/01/17 15:00:44 | 00,001,734 | —- | C] () – C:\Documents and Settings\Kevin\Desktop\HijackThis.lnk
[2010/01/17 14:48:39 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/01/17 14:48:39 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/01/17 14:48:39 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/01/17 14:48:39 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/01/17 13:26:15 | 00,015,880 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2010/01/17 12:33:17 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2009/06/26 19:59:55 | 00,000,023 | —- | C] () – C:\WINDOWS\BlendSettings.ini
[2009/03/02 15:08:19 | 00,000,128 | —- | C] () – C:\Documents and Settings\Kevin\Local Settings\Application Data\fusioncache.dat
[2009/02/20 13:14:04 | 00,006,144 | —- | C] () – C:\Documents and Settings\Kevin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/23 10:15:39 | 00,000,021 | —- | C] () – C:\WINDOWS\PI_setup.ini
[2008/12/23 10:15:17 | 00,000,022 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2008/12/23 10:13:12 | 00,096,768 | —- | C] () – C:\WINDOWS\SlantAdj.dll
[2008/12/23 10:13:12 | 00,000,072 | —- | C] () – C:\WINDOWS\System32\epDPE.ini
[2008/12/23 10:10:29 | 00,000,227 | —- | C] () – C:\WINDOWS\EPSON RX620 Installer.ini
[2008/12/13 08:12:41 | 00,143,360 | R— | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/10/07 13:33:00 | 01,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/10/07 13:33:00 | 01,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/10/07 13:33:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/10/07 13:33:00 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/10/07 13:33:00 | 00,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/10/07 08:13:22 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 08:13:20 | 00,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/06/05 08:58:26 | 00,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2006/04/22 18:00:10 | 00,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2005/12/28 11:01:34 | 00,002,374 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/08/05 14:01:54 | 00,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll

========== LOP Check ==========

[2010/01/05 21:34:21 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CCP
[2010/01/17 15:42:02 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/01/17 12:10:43 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/01/02 13:12:21 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Battle Tanks
[2010/01/12 17:39:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\EveHQ
[2009/09/06 11:30:31 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\GetRightToGo
[2008/12/23 10:19:05 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Leadertech
[2009/12/30 16:47:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\LimeWire
[2009/12/22 20:34:19 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2008/12/12 17:51:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Thunderbird
[2009/01/15 13:26:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Kevin\Application Data\Unity
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2010/01/18 16:56:22 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
< End of report >

2

Everything seems to be working normally now.
Post #17
OTL Clean-Up
Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
Please go ahead and delete exeHelper as well as any other logs leftover on your desktop.


Next:


Now that your system appears to be clean, there's just a few steps I'd like you to take to prevent any future infections.
  • System restore:
    We will now clear your existing system restore points and establish a new clean restore point:

o Click on the Start button to open your Start Menu.
o Click on the Control Panel menu option.
o Click on the System and Maintenance menu option.
o Click on the System menu option.
o Click on System Protection in the left-hand task list.
o Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point.
o Type in a title for the manual restore point and press the Create button.
o Close the System window after you have been advised that the procedure has been successfully completed.

o Next, go to Start > Run and type in cleanmgr
o Select the More options tab
o Choose the option to clean up system restore and OK it.

This will remove all restore points except the new one you just created.

Make sure you do this now, as your System Restore currently has infected files in it.

All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.
  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE
  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
    • If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
      • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #19
Hello Alteri, You are more than welcome. I'm glad we were able to get your PC back to normal. Stay Clean & Stay Safe. Best Regards, SweetTech.
Post #20
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI